Hide Navigation Hide TOC

MegaCortex - S0576 (909617c3-6d87-4330-8f32-bd3af38c3b92)

MegaCortex is ransomware that first appeared in May 2019. (Citation: IBM MegaCortex) MegaCortex has mainly targeted industrial organizations. (Citation: FireEye Ransomware Disrupt Industrial Production)(Citation: FireEye Financial Actors Moving into OT)

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
Account Access Removal - T1531 (b24e2a20-3b3d-4bf0-823b-1ed765398fb0)	Attack Pattern	MegaCortex - S0576 (909617c3-6d87-4330-8f32-bd3af38c3b92)	Malware	1
Code Signing Certificates - T1588.003 (e7cbc1de-1f79-48ee-abfd-da1241c65a15)	Attack Pattern	MegaCortex - S0576 (909617c3-6d87-4330-8f32-bd3af38c3b92)	Malware	1
Inhibit System Recovery - T1490 (f5d8eed6-48a9-4cdf-a3d7-d1ffa99c3d2a)	Attack Pattern	MegaCortex - S0576 (909617c3-6d87-4330-8f32-bd3af38c3b92)	Malware	1
Dynamic-link Library Injection - T1055.001 (f4599aa0-4f85-4a32-80ea-fc39dc965945)	Attack Pattern	MegaCortex - S0576 (909617c3-6d87-4330-8f32-bd3af38c3b92)	Malware	1
Rundll32 - T1218.011 (045d0922-2310-4e60-b5e4-3302302cb3c5)	Attack Pattern	MegaCortex - S0576 (909617c3-6d87-4330-8f32-bd3af38c3b92)	Malware	1
Deobfuscate/Decode Files or Information - T1140 (3ccef7ae-cb5e-48f6-8302-897105fbf55c)	Attack Pattern	MegaCortex - S0576 (909617c3-6d87-4330-8f32-bd3af38c3b92)	Malware	1
Modify Registry - T1112 (57340c81-c025-4189-8fa0-fc7ede51bae4)	Attack Pattern	MegaCortex - S0576 (909617c3-6d87-4330-8f32-bd3af38c3b92)	Malware	1
File and Directory Discovery - T1083 (7bc57495-ea59-4380-be31-a64af124ef18)	Attack Pattern	MegaCortex - S0576 (909617c3-6d87-4330-8f32-bd3af38c3b92)	Malware	1
Disable or Modify Tools - T1562.001 (ac08589e-ee59-4935-8667-d845e38fe579)	Attack Pattern	MegaCortex - S0576 (909617c3-6d87-4330-8f32-bd3af38c3b92)	Malware	1
Disk Content Wipe - T1561.001 (fb640c43-aa6b-431e-a961-a279010424ac)	Attack Pattern	MegaCortex - S0576 (909617c3-6d87-4330-8f32-bd3af38c3b92)	Malware	1
Native API - T1106 (391d824f-0ef1-47a0-b0ee-c59a75e27670)	Attack Pattern	MegaCortex - S0576 (909617c3-6d87-4330-8f32-bd3af38c3b92)	Malware	1
Windows Command Shell - T1059.003 (d1fcf083-a721-4223-aedf-bf8960798d62)	Attack Pattern	MegaCortex - S0576 (909617c3-6d87-4330-8f32-bd3af38c3b92)	Malware	1
Data Encrypted for Impact - T1486 (b80d107d-fa0d-4b60-9684-b0433e8bdba0)	Attack Pattern	MegaCortex - S0576 (909617c3-6d87-4330-8f32-bd3af38c3b92)	Malware	1
System Checks - T1497.001 (29be378d-262d-4e99-b00d-852d573628e6)	Attack Pattern	MegaCortex - S0576 (909617c3-6d87-4330-8f32-bd3af38c3b92)	Malware	1
Access Token Manipulation - T1134 (dcaa092b-7de9-4a21-977f-7fcb77e89c48)	Attack Pattern	MegaCortex - S0576 (909617c3-6d87-4330-8f32-bd3af38c3b92)	Malware	1
Service Stop - T1489 (20fb2507-d71c-455d-9b6d-6104461cf26b)	Attack Pattern	MegaCortex - S0576 (909617c3-6d87-4330-8f32-bd3af38c3b92)	Malware	1
Obtain Capabilities - T1588 (ce0687a0-e692-4b77-964a-0784a8e54ff1)	Attack Pattern	Code Signing Certificates - T1588.003 (e7cbc1de-1f79-48ee-abfd-da1241c65a15)	Attack Pattern	2
Process Injection - T1055 (43e7dc91-05b2-474c-b9ac-2ed4fe101f4d)	Attack Pattern	Dynamic-link Library Injection - T1055.001 (f4599aa0-4f85-4a32-80ea-fc39dc965945)	Attack Pattern	2
System Binary Proxy Execution - T1218 (457c7820-d331-465a-915e-42f85500ccc4)	Attack Pattern	Rundll32 - T1218.011 (045d0922-2310-4e60-b5e4-3302302cb3c5)	Attack Pattern	2
Disable or Modify Tools - T1562.001 (ac08589e-ee59-4935-8667-d845e38fe579)	Attack Pattern	Impair Defenses - T1562 (3d333250-30e4-4a82-9edc-756c68afc529)	Attack Pattern	2
Disk Content Wipe - T1561.001 (fb640c43-aa6b-431e-a961-a279010424ac)	Attack Pattern	Disk Wipe - T1561 (1988cc35-ced8-4dad-b2d1-7628488fa967)	Attack Pattern	2
Windows Command Shell - T1059.003 (d1fcf083-a721-4223-aedf-bf8960798d62)	Attack Pattern	Command and Scripting Interpreter - T1059 (7385dfaf-6886-4229-9ecd-6fd678040830)	Attack Pattern	2
Virtualization/Sandbox Evasion - T1497 (82caa33e-d11a-433a-94ea-9b5a5fbef81d)	Attack Pattern	System Checks - T1497.001 (29be378d-262d-4e99-b00d-852d573628e6)	Attack Pattern	2