Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
notpetya (threat actor)
Risk
79
Critical
23 techniques 55 tools/malware 1 vulnerabilities 40 IOCs 5/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
No data
›
2 Weaponization
No data
›
3 Delivery
1
T1566
Phishing initial access
›
4 Exploitation
6
T1047
Windows Management Instrumentation execution
T1053
Scheduled Task/Job execution
T1053.005
Scheduled Task execution
T1569
System Services execution
T1569.002
Service Execution execution
CVE CVE-2017-0144
›
5 Installation
4
T1003
OS Credential Dumping credential access
T1003.001
LSASS Memory credential access
T1083
File and Directory Discovery discovery
T1518
Software Discovery discovery
›
6 Command & Control
3
T1021
Remote Services lateral movement
T1021.001
Remote Desktop Protocol lateral movement
T1210
Exploitation of Remote Services lateral movement
›
7 Actions on Objectives
10
T1685
Disable or Modify Tools defense impairment
T1486
Data Encrypted for Impact impact
T1529
System Shutdown/Reboot impact
T1036
Masquerading stealth
T1070.003
Clear Command History stealth
T1078
Valid Accounts stealth
T1218
System Binary Proxy Execution stealth
T0828
T0828
T0866
T0866
T0867
T0867
Stage risk: Critical High Medium None

Tools & Malware (55)

Astaroth Backdoors Bad Rabbit BlackEnergy Carbon Credraptor Crisis Cyclops Cyclops Blink Dark Destructive Malware Device code phishing Diskcoder.C ETERNALBLUE EternalBlue EternalBlue exploit EternalRomance Exaramel Exaramel (Win32/Exaramel backdoor) Explorer Global GoldenEye Guard Industroyer M.E.Doc Malwarebytes Mimikatz Mobile malware NotPetya NotPetya ransomware Olympic Destroyer Payload Payload PetrWrap Petya PsExec Rundll32 STOP SentinelOne Snake SolarWinds TeleBots backdoor Triton Trojan WMIC WannaCry Wevtutil Wiper malware dllhost dllhost.dat perfc.dat phishing rundll32.exe systemd wmic

Indicators of Compromise (40)

Domain
pst.pvi.py.pyc.rar.rtf.sln.sql.tar.vbox README.txt vnd.openxmlformats-officedocument.spreadsheetml.sheet HHS.gov NJ.gov dllhost.dat perfc.dat esetsmart.org +7 more
Filename
cfg.conf.cpp.cs.ctl.dbf.disk.djvu.doc.docx work.xls.xlsx.xvd.zip cmd.exe rundll32.exe M.E.Doc shutdown.exe lsass.exe ns.exe +7 more
MD5 Hash
AEEE996FD3484F28E5CD85FE26B6BDCD 71B6A493388E7D0B40C83CE903BC6B04 2813D34F6197EB4DF42C886EC7F234A1 7E37AB34ECDCC3E77E24522DDFD4852D 71b6a493388e7d0b40c83ce903bc6b04
SHA-256 Hash
F8DBABDFA03068130C277CE49C60E35C029FF29D9E3C74C362521F3FB02670D5 02ef73bd2458627ed7b397ec26ee2de2e92c71a0e7588f78734761d8edbdcd9f 027CC450EF5F8C5F653329641EC1FED91F694E0D229928963B30F6B0D7D3A745 EAE9771E2EEB7EA3C6059485DA39E77B8C0C369232F01334954FBAC1C186C998
IPv4 Address
176.31.225.204

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

34 MITRE ATT&CK mitigations cover detected techniques

Browse all →
Delivery (6)
M1017 User Training M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1047 Audit M1049 Antivirus/Antimalware +1 more
Exploitation (7)
M1018 User Account Management M1022 Restrict File and Directory Permissions M1026 Privileged Account Management M1028 Operating System Configuration M1038 Execution Prevention +2 more
Installation (9)
M1015 Active Directory Configuration M1017 User Training M1025 Privileged Process Integrity M1026 Privileged Account Management M1027 Password Policies +4 more
Command & Control (14)
M1016 Vulnerability Scanning M1018 User Account Management M1019 Threat Intelligence Program M1026 Privileged Account Management M1027 Password Policies +9 more
Actions on Objectives (23)
M1013 Application Developer Guidance M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content +18 more

Detection Coverage

20 strategies
5/7 stages covered

Delivery (1)

DET0070 Detection Strategy for Phishing across p...

Exploitation (5)

DET0094 Cross-Platform Behavioral Detection of S... DET0279 Detection Strategy for System Services a... DET0364 Behavioral Detection Strategy for WMI Ex... DET0421 Detection Strategy for System Services S... DET0441 Detection of Suspicious Scheduled Task C...

Installation (4)

DET0234 Credential Dumping via Sensitive Memory... DET0363 Detection of Credential Dumping from LSA... DET0370 Recursive Enumeration of Files and Direc... DET0392 Multi-Platform Software Discovery Behavi...

Command & Control (3)

DET0118 Exploitation of Remote Services – multi-... DET0269 Behavioral Detection Strategy for Remote... DET0327 Multi-event Detection Strategy for RDP-B...

Actions on Objectives (7)

DET0081 Detection of Proxy Execution via Trusted... DET0127 Behavioral Detection of Masquerading Acr... DET0165 Behavioral Detection of Command History... DET0215 Detection of Multi-Platform File Encrypt... DET0497 Detection of Defense Impairment through... +2 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
80%

notpetya

Type: Criminal Sophistication: Medium First seen: 2017 Active
Telebots tracked as Petya resulting from the compro Sandworm
Infrastructure 16 IOC(s)
50%
Domain
pst.pvi.py.pyc.rar.rtf.sln.sql.tar.vbox README.txt vnd.openxmlformats-officedocument.spreadsheetml.sheet HHS.gov NJ.gov +10
IPv4 Address
176.31.225.204
Artifacts (24)
cfg.conf.cpp.cs.ctl.dbf.disk.djvu.doc.docx work.xls.xlsx.xvd.zip cmd.exe rundll32.exe M.E.Doc shutdown.exe +18
Capability
50%
23 technique(s) 55 tool(s)/malware 1 CVE(s)
Astaroth Backdoors Bad Rabbit BlackEnergy Carbon Credraptor Crisis Cyclops +47
T0828 T0866 T0867
credential access
T1003 T1003.001
defense impairment
T1685
discovery
T1083 T1518
Victim
70%

Targeted Sectors

government financial-services education energy transportation manufacturing healthcare critical-infrastructure media

Targeted Countries

UA RU US GB CN

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Criminal

First Seen

2017-01-01

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1566

Capability (Malware)

Astaroth Backdoors Bad Rabbit
4 Exploitation

Capability (Malware)

Astaroth Backdoors Bad Rabbit
5 Installation

Capability (Malware)

Astaroth Backdoors Bad Rabbit
6 Command & Control

Capability (Techniques)

T1021 T1021.001 T1210

Capability (Malware)

Astaroth Backdoors Bad Rabbit
7 Actions on Objectives

Capability (Techniques)

T1486 T1529

Capability (Malware)

Astaroth Backdoors Bad Rabbit
Leaving Threaticon

This link opens an external site that isn't part of the platform.