Paradise Ransomware Distributed Through AweSun Vulnerability Exploitation – ASEC BLOG

MITRE Techniques

• [T1203] Exploitation for Client Execution – The AweSun vulnerability exploitation is used to drop Paradise;
  “Paradise, which is installed through an AweSun vulnerability exploitation, … installed by the cmd and PowerShell generated by AweSun.”
• [T1059.001] PowerShell – PowerShell is used to execute the drop/install payload via AweSun, enabling Paradise installation;
  “PowerShell generated by AweSun.”
• [T1059.003] Command-Line Interface – Cmd.exe is used to run commands for installation and artifact creation;
  “cmd.exe” /C sc delete VSS
• [T1060] Registry Run Keys / Startup Folder – Paradise registers the RUN key to achieve persistence;
  “register it to the run key.”
• [T1490] Inhibit System Recovery – The ransomware deletes the volume shadow service to hamper recovery;
  “Deletes volume shadow service.”
• [T1486] Data Encrypted for Impact – Paradise encrypts files using a 1024-bit RSA key and applies an extension;
  “Paradise generates a 1024-bit RSA key and uses it to encrypt files.”
• [T1041] Exfiltration Over C2 Channel – Basic infection data is sent to the C2 server after encryption;
  “transfers basic information… to the C&C server.”