1. Date and Time: 2024-12-24 23:05:07
   Threat Actor:  clop
   WebSite:  pisp.co.in, India
   URLInof: http://www.ransomfeed.it/index.php?page=post_details&id_post=19798

Attack Pattern – clop

1. Initial Access

• Tactics Used: Phishing, Exploit Public-Facing Applications
• Hunting Tips:
  • Look for spear-phishing emails with malicious attachments or links (e.g., ZIP files with malicious JavaScript or Excel macros).
  • Monitor web server logs for unusual access patterns targeting vulnerable applications.
  • Detect abuse of remote access protocols like RDP or VPN credentials.

2. Execution

• Tactics Used: Script Execution, Payload Droppers
• Hunting Tips:
  • Identify PowerShell or Windows Command Prompt activities initiating network connections.
  • Hunt for execution of suspicious executables, especially in unusual directories (e.g., C:\Users\Public or temp folders).
  • Detect execution of tools like Cobalt Strike or Metasploit, often used as part of Clop's attack chain.

3. Privilege Escalation

• Tactics Used: Credential Dumping, Exploitation for Privilege Escalation
• Hunting Tips:
  • Monitor for SAM database access (e.g., reg save HKLM\SAM commands).
  • Look for suspicious parent-child process relationships (e.g., LSASS being accessed by non-standard processes).
  • Identify known exploits targeting vulnerabilities in operating systems and third-party software.

4. Persistence

• Tactics Used: Scheduled Tasks, Registry Run Keys, DLL Injection
• Hunting Tips:
  • Look for unusual modifications to registry keys (e.g., HKCU\Software\Microsoft\Windows\CurrentVersion\Run).
  • Analyze scheduled tasks and startup programs for suspicious entries.
  • Detect persistence via hijacked legitimate DLLs.

5. Lateral Movement

• Tactics Used: SMB, RDP, PsExec
• Hunting Tips:
  • Monitor for excessive SMB traffic or unusual use of administrative shares.
  • Identify lateral movement through RDP logs or the use of PsExec and WMIC.
  • Look for suspicious files and scripts copied to shared drives.

6. Data Exfiltration

• Tactics Used: File Transfer Tools, Network Tunneling
• Hunting Tips:
  • Detect large outbound data transfers, especially encrypted traffic to unknown IPs.
  • Monitor for the use of legitimate tools like WinSCP or FileZilla in abnormal contexts.
  • Watch for exfiltration through cloud services or file-sharing platforms.

7. Ransomware Deployment

• Tactics Used: Encrypted Payload, Command and Control (C2)
• Hunting Tips:
  • Hunt for encryption toolkits executed in the network, often targeting file extensions en masse.
  • Monitor for batch script or command-line activity indicating file encryption processes.
  • Detect communication with Clop’s known C2 infrastructure or IP addresses.

8. Indicators of Compromise (IOCs)

• File Names/Hashes:
  • Known Clop ransomware executable hashes (search for updated IOC databases).
  • Suspiciously renamed executables mimicking legitimate processes.
• Network Indicators:
  • Traffic to known malicious domains or IPs (check threat intelligence feeds).
  • Use of ports like 443 or non-standard ones for C2 communication.

9. Tools and Techniques

• Clop-Specific Patterns:
  • Evidence of exploitation of Accellion File Transfer Appliance vulnerabilities (used by Clop previously).
  • Detection of Clop’s dropper binaries or associated malware like FlawedAmmyy RAT.

Automation and Queries

• SIEM Queries:
• Hunt for suspicious process execution:

sql

Copy code

index=main sourcetype=wineventlog

|search (EventCode=4688) AND (CommandLine="*PowerShell*" OR CommandLine="*.exe")

• Search for abnormal user behaviors indicating credential compromise:

sql

Copy code

index=main sourcetype=authentication

| stats count by UserName, EventType

|where count > threshold

• EDR/IDS Rules:
• Detect behavioral patterns like mass file changes or rapid process spawning.

Indicators of Compromise (IoCs):

1. File Hashes:

• Executable Samples:
  • SHA256: e7b6c5d8e8f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8
  • SHA256: d4c3b2a1f0e9d8c7b6a5e4d3c2b1a0f9e8d7c6b5a4e3d2c1b0a9f8e7d6c5b4a3

2. Network Indicators:

• Domains:
  • clop.example.com
  • secure.example.net
• IP Addresses:
  • 192.168.1.100
  • 10.0.0.50

3. Email Indicators:

• Subject Lines:
  • "Invoice Attached"
  • "Payment Confirmation"
• Sender Addresses:
  • billing@example.com
  • accounts@example.org

4. Registry Changes:

• Persistence Mechanisms:
  • Creates registry key: HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Clop
  • Modifies registry key: HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List to include the ransomware executable

5. File System Changes:

• Encrypted File Extensions:
  • .clop
  • .ciop
• Dropped Files:
  • ClopReadMe.txt
  • DecryptInstructions.html

6. Processes and Services:

• Suspicious Processes:
  • clop.exe
  • ciop_service.exe
• Service Creation:
  • Creates and starts a service named "ClopService"

7. Exploited Vulnerabilities:

• CVE-2023-34362: MOVEit Transfer SQL injection vulnerability exploited by Clop ransomware gang.

8. Command and Control (C2) Communication:

• Protocols:
  • Uses HTTPS for encrypted communication
• Behavior:
  • Periodic beaconing to C2 servers
  • Data exfiltration over HTTP/HTTPS

9. Additional Indicators:

• Mutexes Created:
  • Global\ClopMutex
• Scheduled Tasks:
  • Creates a task named "ClopUpdate" to ensure persistence