Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
5 IOCs
Warlock Group: We’re only here for SharePoint and the Lamborghinis
Threat Actors
Excerpt
Overview IOCs Initial Inspection Safety Check Emptying Recycle Bin Prepare Target Drives Impair Defenses WOW Check Delete VSS Snapshots Worker Thread Setup Query Target Drives File Encryption Process Dropping Ransom Note MITRE ATT&CK Mapping Acknowledgment Overview In this post I’m going over my analysis of a Warlock ransomware sample, a family that has emerged as a result of the recent on-prem SharePoint chained RCE vulnerability (“ToolShell”) that has become a fan…
Read the original report →Diamond Model
Adversary(1)
Infrastructure(2)
Capability
Victim
Indicators of Compromise
Open the mindmap →5 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| URL | http://elqfbcx5nofwtqfookqml7ltx2g6q6tmddys6e25vgu3al2meim6cbqd.onion | High | Score 58/100 | First seen |
| URL | http://zfytizegsze6uiswodhbaalyy5rawaytv2nzyzdkt3susbewviqqh7yd.onion | High | Score 58/100 | First seen |
| SHA256 | 5e2420bf60f0d86f6483c85eb80214f13c061f455434ecba6612f89afb8b3ce3 | Medium | Score 53/100 | First seen |
| SHA256 | 31884aaf95592f1bd55d589916ef490e332c32dff722e536cea8e1331cfe5d8f | Medium | Score 53/100 | First seen |
| SHA256 | da8de7257c6897d2220cdf9d4755b15aeb38715807e3665716d2ee761c266fdb | Medium | Score 53/100 | First seen |
IOC Relationship Graph
Building graph…