Malicious ISO File Leads to Domain Wide Ransomware
thedfirreport.com · Undated · Licence: TRAM repository license; underlying reports not cleared for redistribution
CVEs this report names
1 CVE- CVE-2020-1472Microsoft Netlogon Privilege Escalation VulnerabilityMicrosoft · NetlogonKEVRansomwarePublic exploitMedium · 5.5T1133External Remote ServicesT1068Exploitation for Privilege Escalation+4 more · 8 reports99.4%Top 0.06%86.8priority
Where it names them
CVE-2020-1472 Original (opens in a new tab) ↗ Original (opens in a new tab) ↗ Original (opens in a new tab) ↗ Original (opens in a new tab) ↗ Original (opens in a new tab) ↗
The threat actor then proceeded to exploit CVE-2020-1472, aka ZeroLogon.
This traffic then triggered several network signatures for CVE-2020-1472 otherwise known as ZeroLogon.
ET EXPLOIT Possible Zerologon Phase 1/3 - NetrServerReqChallenge with 0x00 Client Challenge (CVE-2020-1472)
ET EXPLOIT Zerologon Phase 2/3 - NetrServerAuthenticate2 Request with 0x00 Client Challenge and Sign and Seal Disabled (CVE-2020-1472) M1
ET HUNTING Suspicious lsass.exe in URI ET MALWARE Win32/IcedID Request Cookie ET POLICY SSL/TLS Certificate Observed (AnyDesk Remote Desktop Software) ET USER_AGENTS AnyDesk Remote Desktop Software User-Agent ET EXPLOIT Possible Zerologon Phase 1/3 - NetrServerReqChallenge with 0x00 Client Challenge (CVE-2020-1472)
Techniques drawn from this report
NoneNo passage in this report has been tied to an ATT&CK technique.