Ransomwarehigh
Customizable Elpaco ransomware abuses the Everything library
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2020-1472 | Unauthenticated Privilege Escalation (Zerologon) in Microsoft Netlogon Domain Controllers | 5.5 | 99% | KEVRansomwarePoC | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| sha1 | 61f73e692e9549ad8bc9b965e25d2da683d56dc1 | un Keys / Startup Folder T1547.001 Indicators of Compromise 61f73e692e9549ad8bc9b965e25d2da683d56dc1 (dropper) 8af05099986d0b105d8e38f305efe9098a9fbda6 ( svhost |
| sha1 | 8af05099986d0b105d8e38f305efe9098a9fbda6 | mpromise 61f73e692e9549ad8bc9b965e25d2da683d56dc1 (dropper) 8af05099986d0b105d8e38f305efe9098a9fbda6 ( svhostss . exe ) |
From the original article
8 min read at securelist.com
In a recent incident response case, we dealt with a variant of the Mimic ransomware with some interesting customization features. The attackers were able to connect via RDP to the victim’s server after a successful brute force attack and then launch the ransomware. After that, the adversary was able to elevate their privileges by exploiting the CVE-2020-1472 vulnerability (Zerologon).
By @Securelist · securelist.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.