TTPwire Vol. 1 · MITRE ATT&CK·Tagged

← All stories

Huntress

ReadText34 Ransomware Incident | Huntress

2024-09-22 · Read original ↗

ATT&CK techniques detected

12 predictions
T1486Data Encrypted for Impact
99%
“##ypted file system. the “ / w ” option, from typing the command cipher /?, has the effect illustrated in figure 6. in short, the use of the cipher. exe command does not encrypt files, but rather adds a layer of complexity to recovery by removing data from unallocated space withi…”
T1486Data Encrypted for Impact
98%
“readtext34 ransomware incident | huntress background huntress analysts observe and block a wide variety of attacks on a weekly basis. some of these attacks may be initial forays into the compromised infrastructure, attempts to launch ransomware, or even successful ransomware depl…”
T1068Exploitation for Privilege Escalation
97%
“vulnerable - driver ( “ byovd ” ) attacks. for example, huntress analysts have observed this vulnerable driver being leveraged during lukalocker ransomware attacks. immediately after the driver was installed, the security applications running on the endpoint ( in this case, trend…”
T1489Service Stop
96%
“multiple references to the ip address being the c2 address for the bianlian go trojan, which correlates to the anti - virus detection illustrated in figure 4. it is interesting to note that launching the instance of winppx. exe apparently resulted in multiple persistence mechanis…”
T1486Data Encrypted for Impact
91%
“, and / or via endpoints that did not have the huntress agent installed. conclusion cyber attacks can have a detrimental impact on organizations, in general, with ransomware attacks being not only devastating but also highly visible. as a result, organizations should strongly con…”
T1080Taint Shared Content
90%
“readtext34 ransomware incident | huntress background huntress analysts observe and block a wide variety of attacks on a weekly basis. some of these attacks may be initial forays into the compromised infrastructure, attempts to launch ransomware, or even successful ransomware depl…”
T1068Exploitation for Privilege Escalation
87%
“in figure 1. the threat actor then attempted to log in via rdp ; however, the first attempt failed, as they misspelled the account name as “ adminitrator ” ( note the missing “ s ” ). over a minute and half later, they successfully logged in from a source endpoint with the workst…”
T1021.001Remote Desktop Protocol
70%
“readtext34 ransomware incident | huntress background huntress analysts observe and block a wide variety of attacks on a weekly basis. some of these attacks may be initial forays into the compromised infrastructure, attempts to launch ransomware, or even successful ransomware depl…”
T1543.003Windows Service
59%
“\ winppx. exe " type = kernel start = boot error = normal tag = no displayname = " winppx " the first command, running bcdedit. exe, is intended to disable the driver signature check prior to installing the kernel driver. however, records across the system, security, and applicat…”
T1679Selective Exclusion
44%
“##ypted file system. the “ / w ” option, from typing the command cipher /?, has the effect illustrated in figure 6. in short, the use of the cipher. exe command does not encrypt files, but rather adds a layer of complexity to recovery by removing data from unallocated space withi…”
T1652Device Driver Discovery
40%
“in figure 1. the threat actor then attempted to log in via rdp ; however, the first attempt failed, as they misspelled the account name as “ adminitrator ” ( note the missing “ s ” ). over a minute and half later, they successfully logged in from a source endpoint with the workst…”
T1055.001Dynamic-link Library Injection
35%
“##4bc, 0x366c, c : \ users \ redacted \ appdata \ roaming \ winppx. exe evtx redacted - application popup / 26 ;, \ systemroot \ winppx. exe failed to load evtx redacted - microsoft - windows - security - auditing / 5038 ; \ device \ harddiskvolume6 \ windows \ winppx. exe the mi…”

Summary

Huntress analysts see a number of attacks on a daily and weekly basis, some of which include ransomware attacks. Now and again, Huntress analysts will observe a ransomware attack that stands out in some novel manner.