Procedure examples

Pysa can perform OS credential dumping using Mimikatz.

Pysa can perform network reconnaissance using the Advanced IP Scanner tool.

Pysa has laterally moved using RDP connections.

Pysa has executed a malicious executable by naming it svchost.exe.

Pysa can perform network reconnaissance using the Advanced Port Scanner tool.

Pysa has used Powershell scripts to deploy its ransomware.

Pysa has used Python scripts to deploy ransomware.

Pysa has deleted batch files after execution.

Pysa has used brute force attempts against a central management console, as well as some Active Directory accounts.

Pysa has modified the registry key “SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System” and added the ransom note.

Pysa has used RSA and AES-CBC encryption algorithm to encrypt a list of targeted file extensions.

Pysa can stop services and processes.

Pysa has the functionality to delete shadow copies.

Pysa has extracted credentials from the password database before encrypting the files.

Pysa has used PsExec to copy and execute the ransomware.

Pysa has the capability to stop antivirus services and disable Windows Defender.