Disrupting an Active Ransomware Attack Over the Course of Hours
Tags
cmtmf-attack-pattern: Masquerading
maec-delivery-vectors: Watering Hole
attack-pattern: Data Models Domain Accounts - T1078.002 Exploits - T1587.004 Exploits - T1588.005 Malware - T1587.001 Malware - T1588.001 Masquerading - T1655 Phishing - T1660 Phishing - T1566 Powershell - T1059.001 Software - T1592.002 Tool - T1588.002 Vulnerabilities - T1588.006 Brute Force - T1110 Masquerading - T1036 Powershell - T1086 Windows Management Instrumentation - T1047 Masquerading
Show in Graph
Common Information
Type Value
UUID e62b7f25-8715-4e1f-beab-3dc8e54d3bfe
Fingerprint 25861cddab0f1bce
Analysis status DONE
Considered CTI value 0
Text language
Published Dec. 1, 2022, midnight
Added to db Jan. 16, 2023, 3:50 p.m.
Last updated Nov. 17, 2024, 6:54 p.m.
Headline Disrupting an Active Ransomware Attack Over the Course of Hours
Title Disrupting an Active Ransomware Attack Over the Course of Hours
Detected Hints/Tags/Attributes 87/3/7
Source URLs
Redirection Url
Details Source https://www.esentire.com/blog/disrupting-an-active-ransomware-attack
URL Provider
Details Provider Source level domain
Details esentire.com www.esentire.com
Attributes
Details Type #Events CTI Value
Details CVE 60 
cve-2022-27518
Details File 367 
readme.txt
Details File 15 
test.bat
Details File 155 
cscript.exe
Details File 2 
copys.bat
Details md5 1 
8DFEAAF7351F695024ED3604A4985E98
Details Windows Registry Key 1 
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE