C0015
C0015 was a ransomware intrusion during which the unidentified attackers used Bazar, Cobalt Strike, and Conti, along with other tools, over a 5 day period. Security researchers assessed the actors likely used the widely-circulated Conti ransomware playbook based on the observed pattern of activity and operator errors.[1]
Techniques Used
| Domain | ID | Name | Use | |
|---|---|---|---|---|
| Enterprise | T1059 | .003 | Command and Scripting Interpreter: Windows Command Shell |
During C0015, the threat actors used |
| .005 | Command and Scripting Interpreter: Visual Basic |
During C0015, the threat actors used a malicious HTA file that contained a mix of HTML and JavaScript/VBScript code.[1] |
||
| .007 | Command and Scripting Interpreter: JavaScript |
During C0015, the threat actors used a malicious HTA file that contained a mix of encoded HTML and JavaScript/VBScript code.[1] |
||
| Enterprise | T1486 | Data Encrypted for Impact |
During C0015, the threat actors used Conti ransomware to encrypt a compromised network.[1] |
|
| Enterprise | T1005 | Data from Local System |
During C0015, the threat actors obtained files and data from the compromised network.[1] |
|
| Enterprise | T1039 | Data from Network Shared Drive |
During C0015, the threat actors collected files from network shared drives prior to network encryption.[1] |
|
| Enterprise | T1074 | .001 | Data Staged: Local Data Staging |
During C0015, PowerView's file share enumeration results were stored in the file |
| Enterprise | T1030 | Data Transfer Size Limits |
During C0015, the threat actors limited Rclone's bandwidth setting during exfiltration.[1] |
|
| Enterprise | T1482 | Domain Trust Discovery |
During C0015, the threat actors used the command |
|
| Enterprise | T1567 | .002 | Exfiltration Over Web Service: Exfiltration to Cloud Storage |
During C0015, the threat actors exfiltrated files and sensitive data to the MEGA cloud storage site using the Rclone command |
| Enterprise | T1083 | File and Directory Discovery |
During C0015, the threat actors conducted a file listing discovery against multiple hosts to ensure locker encryption was successful.[1] |
|
| Enterprise | T1105 | Ingress Tool Transfer |
During C0015, the threat actors downloaded additional tools and files onto a compromised network.[1] |
|
| Enterprise | T1570 | Lateral Tool Transfer |
During C0015, the threat actors used WMI to load Cobalt Strike onto additional hosts within a compromised network.[1] |
|
| Enterprise | T1036 | Masquerading |
During C0015, the threat actors named a binary file |
|
| Enterprise | T1135 | Network Share Discovery |
During C0015, the threat actors executed the PowerView ShareFinder module to identify open shares.[1] |
|
| Enterprise | T1027 | Obfuscated Files or Information |
During C0015, the threat actors used Base64-encoded strings.[1] |
|
| Enterprise | T1588 | .001 | Obtain Capabilities: Malware |
For C0015, the threat actors used Cobalt Strike and Conti ransomware.[1] |
| .002 | Obtain Capabilities: Tool |
For C0015, the threat actors obtained a variety of tools, including AdFind, AnyDesk, and Process Hacker.[1] |
||
| Enterprise | T1069 | .001 | Permission Groups Discovery: Local Groups |
During C0015, the threat actors used the command |
| .002 | Permission Groups Discovery: Domain Groups |
During C0015, the threat actors use the command |
||
| Enterprise | T1566 | .001 | Phishing: Spearphishing Attachment |
For C0015, security researchers assessed the threat actors likely used a phishing campaign to distribute a weaponized attachment to victims.[1] |
| Enterprise | T1057 | Process Discovery |
During C0015, the threat actors used the |
|
| Enterprise | T1055 | .001 | Process Injection: Dynamic-link Library Injection |
During C0015, the threat actors used a DLL named |
| Enterprise | T1219 | Remote Access Software |
During C0015, the threat actors installed the AnyDesk remote desktop application onto the compromised network.[1] |
|
| Enterprise | T1021 | .001 | Remote Services: Remote Desktop Protocol |
During C0015, the threat actors used RDP to access specific network hosts of interest.[1] |
| Enterprise | T1018 | Remote System Discovery |
During C0015, the threat actors used the commands |
|
| Enterprise | T1553 | .002 | Subvert Trust Controls: Code Signing |
For C0015, the threat actors used DLL files that had invalid certificates.[1] |
| Enterprise | T1218 | .005 | System Binary Proxy Execution: Mshta |
During C0015, the threat actors used |
| .010 | System Binary Proxy Execution: Regsvr32 |
During C0015, the threat actors employed code that used |
||
| .011 | System Binary Proxy Execution: Rundll32 |
During C0015, the threat actors loaded DLLs via |
||
| Enterprise | T1016 | System Network Configuration Discovery |
During C0015, the threat actors used code to obtain the external public-facing IPv4 address of the compromised host.[1] |
|
| Enterprise | T1124 | System Time Discovery |
During C0015, the threat actors used the command |
|
| Enterprise | T1204 | .002 | User Execution: Malicious File |
During C0015, the threat actors relied on users to enable macros within a malicious Microsoft Word document.[1] |
| Enterprise | T1047 | Windows Management Instrumentation |
During C0015, the threat actors used |
|