Cервис управления информационной безопасностью
Cервис управления информационной безопасностью
Вход Регистрация
MITRE ATT&CK - Инструмент Egregor
Каталоги
MITRE ATT&CK
БДУ ФСТЭК
Новая БДУ ФСТЭК
Риски
Каталоги
MITRE ATT&CK
Инструмент
Egregor
Куда я попал?
SECURITM это SGRC система, ? автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.
Подробнее
Наш канал

Egregor

Egregor is a Ransomware-as-a-Service (RaaS) tool that was first observed in September 2020. Researchers have noted code similarities between Egregor and Sekhmet ransomware, as well as Maze ransomware.(Citation: NHS Digital Egregor Nov 2020)(Citation: Cyble Egregor Oct 2020)(Citation: Security Boulevard Egregor Oct 2020)
ID: S0554
Type: MALWARE
Platforms: Windows
Version: 1.0
Created: 29 Dec 2020
Last Modified: 14 Oct 2021

Techniques Used
Domain ID Name Use
Enterprise T1071 .001 Application Layer Protocol: Web Protocols

Egregor has communicated with its C2 servers via HTTPS protocol.(Citation: Intrinsec Egregor Nov 2020)
Enterprise T1059 .001 Command and Scripting Interpreter: PowerShell

Egregor has used an encoded PowerShell command by a service created by Cobalt Strike for lateral movement.(Citation: Intrinsec Egregor Nov 2020)
.003 Command and Scripting Interpreter: Windows Command Shell

Egregor has used batch files for execution and can launch Internet Explorer from cmd.exe.(Citation: JoeSecurity Egregor 2020)(Citation: Cybereason Egregor Nov 2020)

Enterprise T1484 .001 Domain Policy Modification: Group Policy Modification

Egregor can modify the GPO to evade detection.(Citation: Cybereason Egregor Nov 2020) (Citation: Intrinsec Egregor Nov 2020)
Enterprise T1574 .002 Hijack Execution Flow: DLL Side-Loading

Egregor has used DLL side-loading to execute its payload.(Citation: Cyble Egregor Oct 2020)

Enterprise T1562 .001 Impair Defenses: Disable or Modify Tools

Egregor has disabled Windows Defender to evade protections.(Citation: Intrinsec Egregor Nov 2020)
Enterprise T1036 .004 Masquerading: Masquerade Task or Service

Egregor has masqueraded the svchost.exe process to exfiltrate data.(Citation: Intrinsec Egregor Nov 2020)
Enterprise T1027 .002 Obfuscated Files or Information: Software Packing

Egregor's payloads are custom-packed, archived and encrypted to prevent analysis.(Citation: NHS Digital Egregor Nov 2020)(Citation: Cyble Egregor Oct 2020)
Enterprise T1069 .002 Permission Groups Discovery: Domain Groups

Egregor can conduct Active Directory reconnaissance using tools such as Sharphound or AdFind.(Citation: Intrinsec Egregor Nov 2020)
Enterprise T1218 .010 System Binary Proxy Execution: Regsvr32

Egregor has used regsvr32.exe to execute malicious DLLs.(Citation: JoeSecurity Egregor 2020)
.011 System Binary Proxy Execution: Rundll32

Egregor has used rundll32 during execution.(Citation: Cybereason Egregor Nov 2020)

Enterprise T1497 .003 Virtualization/Sandbox Evasion: Time Based Evasion

Egregor can perform a long sleep (greater than or equal to 3 minutes) to evade detection.(Citation: JoeSecurity Egregor 2020)

References

  1. NHS Digital. (2020, November 26). Egregor Ransomware The RaaS successor to Maze. Retrieved December 29, 2020.
  2. Cybleinc. (2020, October 31). Egregor Ransomware – A Deep Dive Into Its Activities and Techniques. Retrieved December 29, 2020.
  3. Meskauskas, T.. (2020, October 29). Egregor: Sekhmet’s Cousin. Retrieved January 6, 2021.
  4. Joe Security. (n.d.). Analysis Report fasm.dll. Retrieved January 6, 2021.
  5. Bichet, J. (2020, November 12). Egregor – Prolock: Fraternal Twins ?. Retrieved January 6, 2021.
  6. Rochberger, L. (2020, November 26). Cybereason vs. Egregor Ransomware. Retrieved December 30, 2020.
Навигация

Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.