3Am

Tactics and techniques attributed to 3AM by ransomware.live's curated TTP catalog. Identifiers link to the canonical MITRE ATT&CK reference for each tactic or sub-technique.

• TA0003Persistence
  • T1136Create Account

    The threat actor using the 3AM ransomware performed account creation to ensure persistence.

• TA0004Privilege Escalation
  • T1543.003Service Execution

    The threat actor used PsExec to take advantage of a Windows service to escalate from administrator privileges to SYSTEM.

  • T1548.002Bypass User Account Control

    The threat actor may use Cobalt Strike for a series of known techniques to bypass Windows UAC.

• TA0005Defense Evasion
  • T1070.001Clear Windows Event Logs

    The executable clears Windows event logs after its execution.

  • T1562.004Disable or Modify System Firewall Settings

    The threat actor uses commands to set the discovery policy of other hosts on the network, altering the Firewall policy.

• TA0007Discovery
  • T1018Remote System Discovery

    Utilizes Advanced IP Scanner and MASSCAN to discover remote systems.

  • T1135Network Share Discovery

    The threat actor executed reconnaissance commands like 'whoami, netstat, quser, net view, and net share' to enumerate other servers.

  • T1615Group Policy Discovery

    The threat actor used commands like 'gpresult' to dump applied policy settings on the computer for a user (Group Policy).

• TA0010Exfiltration
  • T1048Exfiltration Over Alternative Protocol

    The threat actor used the 'Wput' tool to exfiltrate files from the victim to their own server via FTP.

• TA0040Impact
  • T1486Data Encrypted for Impact

    The ransomware encrypts files and appends the '.threeamtime' extension after encryption.

  • T1490Inhibit System Recovery

    The 3AM ransomware deletes volume shadow copies on the disk and backups through the commands presented in the analysis.