MVISION Insights: Threat Profile: UNC2447

Technical Articles ID: KB95212
Last Modified: 1/21/2022

Environment

IMPORTANT: This Knowledge Base article discusses a specific threat that is being automatically tracked by MVISION Insights technology. The content is intended for use by MVISION Insights users, but is provided for general knowledge to all customers. Contact us for more information about MVISION Insights.

Summary

Description of Campaign
UNC2447 is an aggressive and financially motivated group that monetizes intrusions not only by holding the victim's data to ransom, but subsequently by applying pressure to the victims with threats of media attention and leaking of data on hacker forums. Furthermore, if the victim does not respond quickly or does not pay the ransom, the actor launches a Distributed Denial of Service (DDoS) attack against the public facing website of the victim. The ransom payment is requested in bitcoin (BTC) with the amount dependent on the prior assessment of the victims ability to pay it. If the ransom is not paid, the actor posts the data on the Babuk site (payload.bin) or sells it to third-party data brokers.

This is a highly advanced group that employs successful evasive and anti-forensics techniques to carry out attacks without being caught. The group has used several pieces of malware throughout their campaigns, such as SOMBRAT, RAGNARLOCKER ransomware, and the latest the HelloKitty and FiveHands ransomwares.

High profile attacks using these latest pieces of ransomware were carried out by exploiting the SonicWall products vulnerabilities (CVE-2021-20016, CVE-2021-20021, CVE-2021- 20022, CVE-2021-20023). When inside of the network, the attacker would deploy the ransomware which in turn would use publicly available tools to map the network, escalate privileges, exfiltrate data and finally encrypt the victims files.

This group's activity has been observed in both Europe and North America

How to use this article:

If a Threat Hunting table has been created, use the rules contained to search for malware related to this campaign.
Review the product detection table and confirm that your environment is at least on the specified content version.
To download the latest content versions, go to the Security Updates page.
Scroll down and review the "Product Countermeasures" section of this article. Consider implementing them if they are not already in place.
Review KB91836 - Countermeasures for entry vector threats.
Review KB87843 - Dynamic Application Containment rules and best practices.
Review KB82925 - Identify what rule corresponds to an Adaptive Threat Protection and Threat Intelligence Exchange event.

Threat Hunting:

YARA

rule CISA_10324784_01 : ransomware trojan loader FIVEHANDS
{
meta:
Author = "CISA Code & Media Analysis"
Incident = "10324784"
Date = "2021-03-23"
Last_Modified = "20210323_1100"
Actor = "n/a"
Category = "Ransomware Trojan Loader"
Family = "FIVEHANDS"
Description = "Detects Five Hands Ransomware Loader"
MD5_1 = "c095498fc44d680ad8b4efeb014d339f"
SHA256_1 = "2703aba98d6ecf0bf0b5aafe70edc4bc14d223a11021990bfb10acf5641d3a12"
strings:
$s0 = { 2D 00 6B 00 65 00 79 }
$s1 = "GetCommandLineW"
$s2 = "CommandLineToArgvW"
$s3 = { 81 39 50 45 00 00 }
$s4 = { B9 4D 5A 00 00 }
$s5 = { 8B C3 C1 E8 10 83 E9 10 0F B6 C0 }
$s6 = { 8B CA C1 E9 08 0F B6 D1 8B 4D F0 C1 E9 10 0F B6 C9 }
$s7 = { 8B 3C 96 03 F9 33 F6 }
$s8 = { 85 C0 74 02 FF D0 }
condition:
all of them
}

YARA

rule Sig_RemoteAdmin_1 {
meta:
description = "Detects strings from well-known APT malware"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
author = "Florian Roth"
reference = "Internal Research"
date = "2017-12-03"
score = 45
strings:
$ = "Radmin, Remote Administrator" wide
$ = "Radmin 3.0" wide
condition:
uint16(0) == 0x5a4d and filesize < 3000KB and 1 of them
}

This Knowledge Base article discusses a specific threat that is being tracked. The list of IOCs will change over time; check MVISION Insights for the latest IOCs.

Campaign IOC

Type	Value
SHA256	3090BFF3D16B0B150444C3BFB196229BA0AB0B6B826FA306803DE0192BEDDB80
SHA256	63BA6DB8C81C60DD9F1A0C7C4A4C51E2E56883F063509ED7B543AD7651FD8806
SHA256	9882C2F5A95D7680626470F6C0D3609C7590EB552065F81AB41FFE074EA74E82
SHA256	10887D13DBA1F83EF34E047455A04416D25A83079A7F3798CE3483E0526E3768
SHA256	3F77E49BBA22D8DF168F774239C523979A3D8E353F2838D97D7DB2DC1166D00C
SHA256	4AA0985CCD4389EEF5F3D6D9607CE27B0659AA0E839D1E7A0DC6F1A7EBE31878
SHA256	99BAFFCD7A6B939B72C99AF7C1E88523A50053AB966A079D9BF268AFF884426E
SHA256	947E357BFDFE411BE6C97AF6559FD1CDC5C9D6F5CEA122BF174D124EE03D2DE8
SHA256	AE2D3A638B12E97D4A8E54FB5770FAD51103D38D6FAF645CF7C479D687BD5205
SHA256	C2498845ED4B287FD0F95528926C8EE620EF0CBB5B27865B2007D6379FFE4323
SHA256	7CD18FAD221A1745CD608C6231EEDB47C9CA548455A053C45BEF6EDBD4852AB1
SHA256	A147945635D5BD0FA832C9B55BC3EBCEA7A7787E8F89B98A44279F8EDDDA2A77
SHA256	DC007E71085297883CA68A919E37687427B7E6DB0C24CA014C148F226D8DD98F
SHA256	FE6F356105B488F407AD09819547E138007D6A6C5C1E731C7DA52F5A985006EF
SHA256	7BE901C5F7FFEB8F99E4F5813C259D0227335680380ED06DF03FB836A041CB06
SHA256	CF416C1893098FCB4A3572C9575A43D53EF3657BF48A597174AC2283FBCB0F4C
SHA256	61E286C62E556AC79B01C17357176E58EFB67D86C5D17407E128094C3151F7F9
SHA256	02A08B994265901A649F1BCF6772BC06DF2EB51EB09906AF9FD0F4A8103E9851
SHA256	6ABED03C2454050E1095F6DB954FB2A40BA5AF0736E5BF31BF9DB36DF149FD2E
SHA256	7CAE410D16D9315655F8A2E64458F5BF9A5224D9C4E3743CF31C180D304C8473
SHA256	EF614B456CA4EAA8156A895F450577600AD41BD553B4512AE6ABF3FB8B5EB04E
SHA256	CAB7AFEC0B4B8849CEF1A00557E8FC9F6F2F05996861A6665D7F67B5E961B195
SHA256	0E5F7737704C8F25B2B8157561BE54A463057CD4D79C7E016C30A1CF6590A85C
SHA256	501487B025F25DDF1CA32DEB57A2B4DB43CCF6635C1EDC74B9CFF54CE0E5BCFE
SHA256	ABBE770CED0447A8677AFC64040C77E103C8297AB7E34877D48E14A779E6082E
SHA256	E09EAD5B6AC9EC9203B9FB6C9152BA451498BB291478A69AC71FF6C36C468F9E
SHA256	B41A303A4CAA71FA260DD601A796033D8BFEBCAA6BD9DFD7AD956FAC5229A735
SHA256	AB828F0E0555F88E3005387CB523F221A1933BBD7DB4F05902A1E5CC289E7BA4
SHA256	15DF17BE2F97295B0D8D66E434E2949850C8EDC2A8EDDDF9B30B2B638B20612B
SHA256	CCACF4658AE778D02E4E55CD161B5A0772EB8B8EEE62FED34E2D8F11DB2CC4BC
SHA256	822E73ED2F92E3A061FA830244CD838617D6533EE47143A98C9CB1F119026ADC
SHA256	71C97EA6D14F4A6DA86D51D07EA284447CC486488B9637F9C1DE0BA42054C6F2
SHA256	DAE04677E464F4E4CC317E369380D2FF1BE7C2819B83ED0AD04B4C9489AF381C
SHA256	52DACE403E8F9B4F7EA20C0C3565FA11B6953B404A7D49D63AF237A57B36FD2A
SHA256	FDC2DE095390EC046DC3F398A47A38670282BDC2EF76DD7FC1195AC4EE0421A8
SHA256	3B90D9FAD35A45A738C6B2830896168C99014474DE17984411BE61B25ACF6DB5
SHA256	9A7DAAFC56300BD94CEEF23EAC56A0735B63EC6B9A7A409FB5A9B63EFE1AA0B0
SHA256	BADE05A30ABA181FFBE4325C1BA6C76EF9E02CBE41A4190BD3671152C51C4A7B
SHA256	3AE7BEDF236D4E53A33F3A3E1E80EAE2D93E91B1988DA2F7FCB8FDE5DCC3A0E9
SHA256	13E493C48958A00F2EDA0422C719B8F271CFBC8C14D66C642FA2F6F42928BED4
SHA256	7D57E0BA8B36EC221B16807CE4E13A1125D53922FA50C3827A5EBD6811736FFD
SHA256	18229920A45130F00539405FECAB500D8010EF93856E1C5BCABF5AA5532B3311
SHA256	A710F573F73C163D54C95B4175706329DB3ED89CD9337C583D0BB24B6A384789
SHA256	4DE1BD4B1BB28ED0897B9D3C5D16A4B1442C7F53CB389CBED82AF189696D3F40
SHA256	FB0C56F73905838F972C5756FAB20D1EF2F494CD774B40AF36018E4E632FB741
SHA256	333DEC193A992439D203E0D8FFFD32DD9657EDC91D440A495173B9EBA4D020F8
SHA256	EEB51DCE12F243B332B51D7B1B11ECFF155DD823FF8F9B79D6AD486CC49098BA
SHA256	02FE4B8F01FC282EF8D1398F431A89E96ED2408E72CB14892B576D950A48AE37
SHA256	A7833B0626DD5A8EFDBFB17E3912CFC6EB2DDF57A6EB18A220E3F3EDDB713ECD
SHA256	A4876228756A4D0FE641EFA0869B38AF66B858DB1196853838DDBBB413C44E7D
SHA256	E94064401B54C399D3F844FDF08F880CB8C5D74C34DE9DC28733DD22DABBA678
IP-DST	51.89.50.152
IP-DST	64.227.24.12
IP-DST	157.230.184.142
DOMAIN	feticost.com
DOMAIN	celomito.com
DOMAIN	cosarm.com
DOMAIN	portalcos.com

Minimum Content Versions:

Content Type	Version
V2 DAT (VirusScan Enterprise)	10058
V3 DAT (Endpoint Security)	4510

Detection Summary

IOC	Scanner	Detection
3090BFF3D16B0B150444C3BFB196229BA0AB0B6B826FA306803DE0192BEDDB80	AVEngine V2	Ransom-SunCrypt
	AVEngine V3	Ransom-SunCrypt
	JTI (ATP Rules)	-
	RP Static	Real Protect-PSL!D87FCD8D2BF4
	RP Dynamic	-

IOC	Scanner	Detection
63BA6DB8C81C60DD9F1A0C7C4A4C51E2E56883F063509ED7B543AD7651FD8806	AVEngine V2	Ransom-SunCrypt
	AVEngine V3	Ransom-SunCrypt
	JTI (ATP Rules)	-
	RP Static	Real Protect-PSL!C171BCD34151
	RP Dynamic	-

IOC	Scanner	Detection
9882C2F5A95D7680626470F6C0D3609C7590EB552065F81AB41FFE074EA74E82	AVEngine V2	PS/Agent.dm
	AVEngine V3	PS/Agent.dm
	JTI (ATP Rules)	-
	RP Static	Real Protect-PSL!F73997700498
	RP Dynamic	-

IOC	Scanner	Detection
10887D13DBA1F83EF34E047455A04416D25A83079A7F3798CE3483E0526E3768	AVEngine V2	Trojan-ransom.k
	AVEngine V3	Trojan-ransom.k
	JTI (ATP Rules)	JTI/Suspect.196612!d96adf82f061
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
3F77E49BBA22D8DF168F774239C523979A3D8E353F2838D97D7DB2DC1166D00C	AVEngine V2	PS/CobalStrike
	AVEngine V3	PS/CobalStrike
	JTI (ATP Rules)	-
	RP Static	Real Protect-PSL!DF6E6B3E53CC
	RP Dynamic	-

IOC	Scanner	Detection
4AA0985CCD4389EEF5F3D6D9607CE27B0659AA0E839D1E7A0DC6F1A7EBE31878	AVEngine V2	PS/WarPrism
	AVEngine V3	PS/WarPrism
	JTI (ATP Rules)	-
	RP Static	Real Protect-PSL!8071F66D6439
	RP Dynamic	-

IOC	Scanner	Detection
99BAFFCD7A6B939B72C99AF7C1E88523A50053AB966A079D9BF268AFF884426E	AVEngine V2	Spy.agent.b
	AVEngine V3	Spy.agent.b
	JTI (ATP Rules)	JTI/Suspect.196612!6382d48fae67
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
947E357BFDFE411BE6C97AF6559FD1CDC5C9D6F5CEA122BF174D124EE03D2DE8	AVEngine V2	Ransom-HelloKitty
	AVEngine V3	Ransom-HelloKitty
	JTI (ATP Rules)	JTI/Suspect.196612!22d35005e926
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
AE2D3A638B12E97D4A8E54FB5770FAD51103D38D6FAF645CF7C479D687BD5205	AVEngine V2	PS/CobalStrike
	AVEngine V3	PS/CobalStrike
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
C2498845ED4B287FD0F95528926C8EE620EF0CBB5B27865B2007D6379FFE4323	AVEngine V2	Ransom-HelloKitty
	AVEngine V3	Ransom-HelloKitty
	JTI (ATP Rules)	JTI/Suspect.196612!f568229e696c
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
7CD18FAD221A1745CD608C6231EEDB47C9CA548455A053C45BEF6EDBD4852AB1	AVEngine V2	Trojan-Encoded
	AVEngine V3	Trojan-Encoded
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
A147945635D5BD0FA832C9B55BC3EBCEA7A7787E8F89B98A44279F8EDDDA2A77	AVEngine V2	Ransom-HelloKitty
	AVEngine V3	Ransom-HelloKitty
	JTI (ATP Rules)	JTI/Suspect.196612!46ecc24ef6d2
	RP Static	Real Protect-LS!46ECC24EF6D2
	RP Dynamic	-

IOC	Scanner	Detection
DC007E71085297883CA68A919E37687427B7E6DB0C24CA014C148F226D8DD98F	AVEngine V2	Ransom-HelloKitty
	AVEngine V3	Ransom-HelloKitty
	JTI (ATP Rules)	JTI/Suspect.196612!6c849920155f
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
FE6F356105B488F407AD09819547E138007D6A6C5C1E731C7DA52F5A985006EF	AVEngine V2	GenericRXLP-MH!7D6E57CBC112
	AVEngine V3	GenericRXLP-MH!7D6E57CBC112
	JTI (ATP Rules)	-
	RP Static	Real Protect-LS!7D6E57CBC112
	RP Dynamic	-

IOC	Scanner	Detection
7BE901C5F7FFEB8F99E4F5813C259D0227335680380ED06DF03FB836A041CB06	AVEngine V2	Ransom-HelloKitty
	AVEngine V3	Ransom-HelloKitty
	JTI (ATP Rules)	JTI/Suspect.196612!a64d79eba402
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
CF416C1893098FCB4A3572C9575A43D53EF3657BF48A597174AC2283FBCB0F4C	AVEngine V2	PS/WarPrism
	AVEngine V3	PS/WarPrism
	JTI (ATP Rules)	-
	RP Static	Real Protect-PSL!E18B27F75C95
	RP Dynamic	-

IOC	Scanner	Detection
61E286C62E556AC79B01C17357176E58EFB67D86C5D17407E128094C3151F7F9	AVEngine V2	Spy.agent.b
	AVEngine V3	Spy.agent.b
	JTI (ATP Rules)	JTI/Suspect.196612!87c78d62fd35
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
02A08B994265901A649F1BCF6772BC06DF2EB51EB09906AF9FD0F4A8103E9851	AVEngine V2	Ransom-HelloKitty
	AVEngine V3	Ransom-HelloKitty
	JTI (ATP Rules)	JTI/Suspect.196612!39ea2394a6e6
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
6ABED03C2454050E1095F6DB954FB2A40BA5AF0736E5BF31BF9DB36DF149FD2E	AVEngine V2	PS/WarPrism
	AVEngine V3	PS/WarPrism
	JTI (ATP Rules)	-
	RP Static	Real Protect-PSL!8226D7615532
	RP Dynamic	-

IOC	Scanner	Detection
7CAE410D16D9315655F8A2E64458F5BF9A5224D9C4E3743CF31C180D304C8473	AVEngine V2	PS/WarPrism
	AVEngine V3	PS/WarPrism
	JTI (ATP Rules)	-
	RP Static	Real Protect-PSL!29E53B32D5B4
	RP Dynamic	-

IOC	Scanner	Detection
EF614B456CA4EAA8156A895F450577600AD41BD553B4512AE6ABF3FB8B5EB04E	AVEngine V2	Ransom-HelloKitty
	AVEngine V3	Ransom-HelloKitty
	JTI (ATP Rules)	JTI/Suspect.196612!57824214710b
	RP Static	Real Protect-PEE!57824214710B
	RP Dynamic	-

IOC	Scanner	Detection
CAB7AFEC0B4B8849CEF1A00557E8FC9F6F2F05996861A6665D7F67B5E961B195	AVEngine V2	PS/CobalStrike
	AVEngine V3	PS/CobalStrike
	JTI (ATP Rules)	-
	RP Static	Real Protect-PSL!E39184EACBA2
	RP Dynamic	-

IOC	Scanner	Detection
0E5F7737704C8F25B2B8157561BE54A463057CD4D79C7E016C30A1CF6590A85C	AVEngine V2	Ransom-HelloKitty
	AVEngine V3	Ransom-HelloKitty
	JTI (ATP Rules)	JTI/Suspect.196612!1a79b6d169aa
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
501487B025F25DDF1CA32DEB57A2B4DB43CCF6635C1EDC74B9CFF54CE0E5BCFE	AVEngine V2	GenericRXNU-US!136BD70F7AA9
	AVEngine V3	GenericRXNU-US!136BD70F7AA9
	JTI (ATP Rules)	JTI/Suspect.196612!136bd70f7aa9
	RP Static	Real Protect-PEE!136BD70F7AA9
	RP Dynamic	-

IOC	Scanner	Detection
ABBE770CED0447A8677AFC64040C77E103C8297AB7E34877D48E14A779E6082E	AVEngine V2	PS/WarPrism
	AVEngine V3	PS/WarPrism
	JTI (ATP Rules)	-
	RP Static	Real Protect-PSL!1CD03C0D00F7
	RP Dynamic	-

IOC	Scanner	Detection
E09EAD5B6AC9EC9203B9FB6C9152BA451498BB291478A69AC71FF6C36C468F9E	AVEngine V2	Trojan-Encoded
	AVEngine V3	Trojan-Encoded
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
B41A303A4CAA71FA260DD601A796033D8BFEBCAA6BD9DFD7AD956FAC5229A735	AVEngine V2	PS/WarPrism
	AVEngine V3	PS/WarPrism
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
AB828F0E0555F88E3005387CB523F221A1933BBD7DB4F05902A1E5CC289E7BA4	AVEngine V2	Trojan-FRON!C50AB1DF254C
	AVEngine V3	Trojan-FRON!C50AB1DF254C
	JTI (ATP Rules)	JTI/Suspect.196612!c50ab1df254c
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
15DF17BE2F97295B0D8D66E434E2949850C8EDC2A8EDDDF9B30B2B638B20612B	AVEngine V2	Trojan-Encoded
	AVEngine V3	Trojan-Encoded
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
CCACF4658AE778D02E4E55CD161B5A0772EB8B8EEE62FED34E2D8F11DB2CC4BC	AVEngine V2	PS/Wwansvc
	AVEngine V3	PS/Wwansvc
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
822E73ED2F92E3A061FA830244CD838617D6533EE47143A98C9CB1F119026ADC	AVEngine V2	GenericRXLP-MH!74C688A22822
	AVEngine V3	GenericRXLP-MH!74C688A22822
	JTI (ATP Rules)	JTI/Suspect.196612!74c688a22822
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
71C97EA6D14F4A6DA86D51D07EA284447CC486488B9637F9C1DE0BA42054C6F2	AVEngine V2	Trojan-Encoded
	AVEngine V3	Trojan-Encoded
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
DAE04677E464F4E4CC317E369380D2FF1BE7C2819B83ED0AD04B4C9489AF381C	AVEngine V2	Hacktool.g
	AVEngine V3	Hacktool.g
	JTI (ATP Rules)	JTI/Suspect.196612!a01a2ba3ae9f
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
52DACE403E8F9B4F7EA20C0C3565FA11B6953B404A7D49D63AF237A57B36FD2A	AVEngine V2	Ransom-HelloKitty
	AVEngine V3	Ransom-HelloKitty
	JTI (ATP Rules)	JTI/Suspect.196612!1b0b9e4cddcb
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
FDC2DE095390EC046DC3F398A47A38670282BDC2EF76DD7FC1195AC4EE0421A8	AVEngine V2	Trojan-Encoded
	AVEngine V3	Trojan-Encoded
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
3B90D9FAD35A45A738C6B2830896168C99014474DE17984411BE61B25ACF6DB5	AVEngine V2	PS/WarPrism
	AVEngine V3	PS/WarPrism
	JTI (ATP Rules)	-
	RP Static	Real Protect-PSL!C925822C6D51
	RP Dynamic	-

IOC	Scanner	Detection
9A7DAAFC56300BD94CEEF23EAC56A0735B63EC6B9A7A409FB5A9B63EFE1AA0B0	AVEngine V2	Ransom-Kitty!06CE6CD8BDE7
	AVEngine V3	Ransom-Kitty!06CE6CD8BDE7
	JTI (ATP Rules)	JTI/Suspect.196612!06ce6cd8bde7
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
BADE05A30ABA181FFBE4325C1BA6C76EF9E02CBE41A4190BD3671152C51C4A7B	AVEngine V2	Ransom-HelloKitty
	AVEngine V3	Ransom-HelloKitty
	JTI (ATP Rules)	JTI/Suspect.196612!87c0b190e3b4
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
3AE7BEDF236D4E53A33F3A3E1E80EAE2D93E91B1988DA2F7FCB8FDE5DCC3A0E9	AVEngine V2	GenericRXNU-US!AF568E8A6060
	AVEngine V3	GenericRXNU-US!AF568E8A6060
	JTI (ATP Rules)	JTI/Suspect.196612!af568e8a6060
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
13E493C48958A00F2EDA0422C719B8F271CFBC8C14D66C642FA2F6F42928BED4	AVEngine V2	PS/CobalStrike
	AVEngine V3	PS/CobalStrike
	JTI (ATP Rules)	-
	RP Static	Real Protect-PSL!A809068B052B
	RP Dynamic	-

IOC	Scanner	Detection
7D57E0BA8B36EC221B16807CE4E13A1125D53922FA50C3827A5EBD6811736FFD	AVEngine V2	TrojanFFGrabber
	AVEngine V3	TrojanFFGrabber
	JTI (ATP Rules)	JTI/Suspect.196612!4d3d3919dda0
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
18229920A45130F00539405FECAB500D8010EF93856E1C5BCABF5AA5532B3311	AVEngine V2	GenericRXNT-SV!9CFD524557C7
	AVEngine V3	GenericRXNT-SV!9CFD524557C7
	JTI (ATP Rules)	JTI/Suspect.196612!9cfd524557c7
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
A710F573F73C163D54C95B4175706329DB3ED89CD9337C583D0BB24B6A384789	AVEngine V2	Hacktool-netscan.a
	AVEngine V3	Hacktool-netscan.a
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
4DE1BD4B1BB28ED0897B9D3C5D16A4B1442C7F53CB389CBED82AF189696D3F40	AVEngine V2	PS/Agent.co
	AVEngine V3	PS/Agent.co
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
FB0C56F73905838F972C5756FAB20D1EF2F494CD774B40AF36018E4E632FB741	AVEngine V2	GenericRXPC-KT!254EA4E12DC7
	AVEngine V3	GenericRXPC-KT!254EA4E12DC7
	JTI (ATP Rules)	JTI/Suspect.196612!254ea4e12dc7
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
333DEC193A992439D203E0D8FFFD32DD9657EDC91D440A495173B9EBA4D020F8	AVEngine V2	PUP-RemoteAdmin.a
	AVEngine V3	PUP-RemoteAdmin.a
	JTI (ATP Rules)	JTI/Suspect.196612!824c21c6aa2c
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
EEB51DCE12F243B332B51D7B1B11ECFF155DD823FF8F9B79D6AD486CC49098BA	AVEngine V2	GenericRXPC-KT!D17E1802ECCD
	AVEngine V3	GenericRXPC-KT!D17E1802ECCD
	JTI (ATP Rules)	JTI/Suspect.196612!d17e1802eccd
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
02FE4B8F01FC282EF8D1398F431A89E96ED2408E72CB14892B576D950A48AE37	AVEngine V2	GenericRXPC-KT!B140E53FBBCC
	AVEngine V3	GenericRXPC-KT!B140E53FBBCC
	JTI (ATP Rules)	JTI/Suspect.196612!b140e53fbbcc
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
A7833B0626DD5A8EFDBFB17E3912CFC6EB2DDF57A6EB18A220E3F3EDDB713ECD	AVEngine V2	GenericRXPC-KT!9DFF30687B9C
	AVEngine V3	GenericRXPC-KT!9DFF30687B9C
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
A4876228756A4D0FE641EFA0869B38AF66B858DB1196853838DDBBB413C44E7D	AVEngine V2	PUP-RemoteAdmin.a
	AVEngine V3	PUP-RemoteAdmin.a
	JTI (ATP Rules)	JTI/Suspect.196612!1242f4fa42d7
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
E94064401B54C399D3F844FDF08F880CB8C5D74C34DE9DC28733DD22DABBA678	AVEngine V2	Ransom-HeloKity!C45F5895C255
	AVEngine V3	Ransom-HeloKity!C45F5895C255
	JTI (ATP Rules)	JTI/Suspect.196612!c45f5895c255
	RP Static	-
	RP Dynamic	-

Minimum set of Manual Rules to improve protection to block this campaign
IMPORTANT: Always follow best practices when you enable new rules and signatures.

When you implement new rules or signatures, always set them to Report mode first and check the alerts generated. Resolve any issues that arise and then set the rules to Block. This step mitigates against triggering false positives and allows you to refine your configuration.

For more information, see KB87843 - List of and best practices for Endpoint Security Dynamic Application Containment rules.

Endpoint Security - Advanced Threat Protection:

Rule ID: 4 Use GTI file reputation to identify trusted or malicious files

Endpoint Security - Exploit Prevention:

Rule ID: 6127 Suspicious LSASS Access from Powershell
Rule ID: 6135 Unmanaged Powershell Detected
Rule ID: 6085 Powershell Command Restriction - File
Rule ID: 6086 Powershell Command Restriction - Command
Rule ID: 6073 Execution Policy Bypass in Powershell

Host Intrusion Prevention:

Rule ID: 6082 Powershell Command Restriction - ExecutionPolicy Unrestricted
Rule ID: 6085 Powershell Command Restriction - File
Rule ID: 6135 Unmanaged Powershell Detected
Rule ID: 6073 Execution Policy Bypass in Powershell
Rule ID: 6081 Powershell Command Restriction - NoProfile

Endpoint Security - Access Protection Custom Rules:

Rule: 1
Executables (Include):
*
Subrules:
Subrule Type: Files
Operations:
create
Targets (Include):
*your_files_are_encrypted.html

VirusScan Enterprise - Access Protection Custom Rules:

Rule: 1
Rule Type: File
Process to include: *
File or folder name to block: *your_files_are_encrypted.html
File actions to prevent: Create

Aggressive set of Manual Rules to improve protection to block this campaign
IMPORTANT: Always follow best practices when you enable new rules and signatures.

When you implement new rules or signatures, always set them to Report mode first and check the alerts generated. Resolve any issues that arise and then set the rules to Block. This step mitigates against triggering false positives and allows you to refine your configuration.

For more information, see KB87843 - List of and best practices for Endpoint Security Dynamic Application Containment rules.

Virusscan Enterprise - Access Protection Rules:

Prevent creation of new executable files in the Windows folder
Prevent programs registering as a service

Host Intrusion Prevention:

Rule ID: 910 Uninstall Registry Key Modification
Rule ID: 1020 Windows Agent Shielding - File Access
Rule ID: 2265 Delay Delete File Protection
Rule ID: 6010 Generic Application Hooking Protection
Rule ID: 1148 CMD Tool Access by a Network Aware Application
Rule ID: 2806 Attempt to create a hardlink to a file
Rule ID: 6053 Accessing other users home directory
Rule ID: 6011 Generic Application Invocation Protection
Rule ID: 990 New Startup Folder Program Creation
Rule ID: 2218 Autorun File Read Blocked

Affected Products

MVISION Insights

Knowledge Center

MVISION Insights: Threat Profile: UNC2447

Environment

Summary

Affected Products

Title

Title

Knowledge Center

MVISION Insights: Threat Profile: UNC2447

Environment

Summary

Affected Products

Choose your region

Title

Title