Ransomware, interrupted: Sodinokibi and the supply chain
Tags
cmtmf-attack-pattern: Process Injection Supply Chain Compromise
maec-delivery-vectors: Watering Hole
attack-pattern: Data Credentials - T1589.001 Exploits - T1587.004 Exploits - T1588.005 Malware - T1587.001 Malware - T1588.001 Phishing - T1660 Phishing - T1566 Powershell - T1059.001 Process Injection - T1631 Remote Access Software - T1663 Software - T1592.002 Supply Chain Compromise - T1474 Powershell - T1086 Process Injection - T1055 Remote Access Tools - T1219 Scripting - T1064 Supply Chain Compromise - T1195 Scripting Supply Chain Compromise
Show in Graph
Common Information
Type Value
UUID ec163811-5fe0-4009-b442-6117bec90664
Fingerprint a4210d91a875cc4b
Analysis status DONE
Considered CTI value 0
Text language
Published Dec. 4, 2019, midnight
Added to db Sept. 26, 2022, 9:31 a.m.
Last updated Nov. 17, 2024, 10:40 p.m.
Headline UNKNOWN
Title Ransomware, interrupted: Sodinokibi and the supply chain
Detected Hints/Tags/Attributes 55/3/5
Source URLs
Redirection Url
Details Source https://www.elastic.co/blog/ransomware-interrupted-sodinokibi-and-the-supply-chain
URL Provider
Details Provider Source level domain
Details elastic.co www.elastic.co
Attributes
Details Type #Events CTI Value
Details Domain 358 
pastebin.com
Details File 1208 
powershell.exe
Details File 5 
windowsclient.exe
Details File 2126 
cmd.exe
Details Url 2 
https://pastebin.com/raw