Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

goddamn ransomwhere (threat actor)

Risk

Medium

0 techniques 45 tools/malware 0 vulnerabilities 24 IOCs 0/7 stages covered

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

No data

›

4 Exploitation

No data

›

5 Installation

No data

›

6 Command & Control

No data

›

7 Actions on Objectives

No data

Stage risk: Critical High Medium None

Tools & Malware (45)

8Base Akira AlphaLocker Alphv Avaddon AvosLocker BRAIN Babuk Babuk Ransomware BlackCat ChaCha20 Chaos Conti Crytox Cuba Cyclops Dark DoppelPaymer DragonForce Global HELLOKITTY Hades Hive Infostealer LockBit LockBit 3.0 Lynx Medusa MedusaLocker Nemty Netwalker Payload Payload Phishing emails PingBack PolyVice Qilin RALord Royal STOP Trigona VanHelsing YARA phishing rock

Indicators of Compromise (24)

Domain

WebWebWeb.com Logo.dev Trojan-Ransom.Win32.Generic my.docx.locked cyfirma.com READ-ME.txt cisa.gov X.com +11 more

Email Address

God8Damn@hotmail.com cortizol@atomicmail.io god8damn@cyberfear.com

Filename

schtasks.exe

URL

http://tox.chat/download.html

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

80%

goddamn ransomwhere

Type: Criminal Sophistication: Medium Active

tracked as Bjorka SkyWave quic Colddraw Ransomware +21 more

Infrastructure 20 IOC(s)

50%

Domain

WebWebWeb.com Logo.dev Trojan-Ransom.Win32.Generic my.docx.locked cyfirma.com +14

URL

http://tox.chat/download.html

Artifacts (4)

God8Damn@hotmail.com cortizol@atomicmail.io god8damn@cyberfear.com schtasks.exe

Capability

50%

45 tool(s)/malware

8Base Akira AlphaLocker Alphv Avaddon AvosLocker BRAIN Babuk +37

Victim

70%

Targeted Sectors

healthcare financial-services construction government critical-infrastructure transportation manufacturing energy oil-gas hospitality defense education telecommunications retail information-technology

Targeted Countries

US PK CA AU BR FR IL IR RU

Diamond Model Meta-Features

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Criminal

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges