US-CERT. (2017, July 1). Alert (TA17-181A): Petya Ransomware. Retrieved March 15, 2019.
None recorded.
None recorded.
| Technique | Used by | Procedure example |
|---|---|---|
| T1003.001 LSASS Memory |
MalwareNotPetya | NotPetya contains a modified version of Mimikatz to help gather credentials that are later used for lateral movement. |
| T1021.002 SMB/Windows Admin Shares |
MalwareNotPetya | NotPetya can use PsExec, which interacts with the |
| T1047 Windows Management Instrumentation |
MalwareNotPetya | NotPetya can use |
| T1078.003 Local Accounts |
MalwareNotPetya | NotPetya can use valid credentials with PsExec or |
| T1210 Exploitation of Remote Services |
MalwareNotPetya | NotPetya can use two exploits in SMBv1, EternalBlue and EternalRomance, to spread itself to other remote systems on the network. |
| T1486 Data Encrypted for Impact |
MalwareNotPetya | NotPetya encrypts user files and disk structures like the MBR with 2048-bit RSA. |
| T1569.002 Service Execution |
MalwareNotPetya | NotPetya can use PsExec to help propagate itself across a network. |
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
