Incident Score: Analysis & Impact (ROY1784715914)

Rankiteo's analysis has identified several MITRE ATT&CK tactics and techniques associated with this incident, each with varying levels of confidence based on available evidence. Under the Initial Access tactic, the analysis identified Phishing (T1566) with high confidence (90%), supported by evidence indicating phishing or spearphishing emails delivering malware like Qbot or IcedID and Spearphishing Attachment (T1566.001) with moderate to high confidence (80%), supported by evidence indicating hTML smuggling and password-protected archives containing ISO files. Under the Execution tactic, the analysis identified User Execution: Malicious File (T1204.002) with moderate to high confidence (80%), supported by evidence indicating hidden payloads to execute Qbot on victim systems and Command and Scripting Interpreter: PowerShell (T1059.001) with high confidence (90%), supported by evidence indicating encoded PowerShell and Windows command shell for persistence. Under the Persistence tactic, the analysis identified Scheduled Task/Job: Scheduled Task (T1053.005) with moderate to high confidence (70%), supported by evidence indicating bypass UAC via scheduled tasks and Command and Scripting Interpreter: PowerShell (T1059.001) with moderate to high confidence (80%), supported by evidence indicating encoded PowerShell for persistence. Under the Privilege Escalation tactic, the analysis identified Abuse Elevation Control Mechanism: Bypass User Account Control (T1548.002) with moderate to high confidence (70%), supported by evidence indicating bypass UAC via scheduled tasks. Under the Defense Evasion tactic, the analysis identified Process Injection (T1055) with high confidence (90%), supported by evidence indicating inject malicious code into legitimate processes, Obfuscated Files or Information (T1027) with moderate to high confidence (80%), supported by evidence indicating encoded PowerShell and hidden payloads in ISO files, and Hide Artifacts: Hidden Window (T1564.003) with moderate to high confidence (70%), supported by evidence indicating malicious code injected into legitimate processes. Under the Credential Access tactic, the analysis identified Credentials from Password Stores (T1555) with moderate to high confidence (70%), supported by evidence indicating credential abuse, including pass-the-hash techniques and OS Credential Dumping (T1003) with moderate confidence (60%), supported by evidence indicating lateral movement achieved through credential abuse. Under the Discovery tactic, the analysis identified Account Discovery (T1087) with moderate to high confidence (80%), supported by evidence indicating tools like PowerSploit and AdFind map the network and File and Directory Discovery (T1083) with moderate to high confidence (70%), supported by evidence indicating network mapping for mass encryption. Under the Lateral Movement tactic, the analysis identified Use Alternate Authentication Material: Pass the Hash (T1550.002) with moderate to high confidence (80%), supported by evidence indicating lateral movement achieved through credential abuse, pass-the-hash and Remote Services: SMB/Windows Admin Shares (T1021.002) with moderate to high confidence (70%), supported by evidence indicating sMB-named pipes for command-and-control communication. Under the Collection tactic, the analysis identified Data from Local System (T1005) with high confidence (90%), supported by evidence indicating data is exfiltrated to cloud storage platforms like Dropbox and Mega. Under the Command and Control tactic, the analysis identified Application Layer Protocol: Web Protocols (T1071.001) with moderate to high confidence (80%), supported by evidence indicating hTTPS for command-and-control communication, Proxy: Multi-hop Proxy (T1090.003) with moderate to high confidence (70%), supported by evidence indicating tor-based portal referenced in ransom notes, and Application Layer Protocol: File Transfer Protocols (T1071.002) with moderate to high confidence (70%), supported by evidence indicating data exfiltrated to cloud storage platforms. Under the Exfiltration tactic, the analysis identified Exfiltration Over Web Service: Exfiltration to Cloud Storage (T1567.002) with high confidence (90%), supported by evidence indicating data exfiltrated to cloud storage platforms like Dropbox and Mega and Exfiltration Over C2 Channel (T1041) with moderate to high confidence (80%), supported by evidence indicating hTTPS and SMB-named pipes for command-and-control. Under the Impact tactic, the analysis identified Data Encrypted for Impact (T1486) with high confidence (100%), supported by evidence indicating double-extortion model, encrypting data while stealing it and Inhibit System Recovery (T1490) with moderate to high confidence (70%), supported by evidence indicating mass encryption of data to pressure victims. These correlations help security teams understand the attack chain and develop appropriate defensive measures based on the observed tactics and techniques.