Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

ta2730 (threat actor)

Risk

Medium

7 techniques 35 tools/malware 0 vulnerabilities 39 IOCs 1/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

No data

›

4 Exploitation

No data

›

5 Installation

No data

›

6 Command & Control

No data

›

7 Actions on Objectives

T1005 - Data from Local System

T1059.003 - Command and Scripting Interpreter: PowerShell

T1078.004 - Valid Accounts: Default Accounts

T1105 - Remote File Copy

T1110.001 - Brute Force: Password Guessing

T1204.002 - User Execution: Malicious File

T1566.001 - Phishing (Spearphishing Link)

Stage risk: Critical High Medium None

Tools & Malware (35)

Agentic Ransomware Backdoors Black Basta CHINACHOPPER ClickFix Global Hafnium HawkEye Impacket Impacket Framework Legitimate Software Leverage Matrix Nexus Payload Payload Phishing campaigns Phishing kits Phishing kits (generic) Pikabot Qbot Remote access tools RemotePC SMAUG STOP Satori ScreenConnect Unknown ValleyRAT Void WAVESHAPER WhatsApp Zoho Assist curl phishing

Indicators of Compromise (39)

Email Address

Bella1987Jenny8927@outlook.com threatinsight@infosec.exchange Quirita42462vpp@hotmail.com Rafael0746881jxk@hotmail.com Sabah30035vrj@hotmail.com Tanisha535486nyg@hotmail.com Violet82113vbv@hotmail.com Violet900048ege@hotmail.com +22 more

SHA-256 Hash

d338a7f85737cac1a7b4b5a1cca94e33d0aa8260548667c6733225d4c20cb848

IPv4 Address

89.117.2.33 146.19.213.36 176.123.2.146 89.117.1.160 89.117.2.34 121.127.232.253 89.117.1.161

URL

http://www.upsystems.one/Alex.exe

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

55%

ta2730

Type: Unknown Active

tracked as

Infrastructure 8 IOC(s)

50%

IPv4 Address

89.117.2.33 146.19.213.36 176.123.2.146 89.117.1.160 89.117.2.34 +2

URL

http://www.upsystems.one/Alex.exe

Artifacts (31)

Bella1987Jenny8927@outlook.com threatinsight@infosec.exchange Quirita42462vpp@hotmail.com Rafael0746881jxk@hotmail.com Sabah30035vrj@hotmail.com Tanisha535486nyg@hotmail.com +25

Capability

50%

7 technique(s) 35 tool(s)/malware

Agentic Ransomware Backdoors Black Basta CHINACHOPPER ClickFix Global Hafnium HawkEye +27

T1005 - Data from Local System T1059.003 - Command and Scripting Interpreter: PowerShell T1078.004 - Valid Accounts: Default Accounts T1105 - Remote File Copy +3

Victim

70%

Targeted Sectors

financial-services government defense energy hospitality

Targeted Countries

JP CA AU SG US TR MX ES CN KP IN TW IT

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges