1. Home
  2. Software
  3. Pysa

Pysa

Pysa is a ransomware that was first used in October 2018 and has been seen to target particularly high-value finance, government and healthcare organizations.[1]

ID: S0583
ⓘ
Associated Software: Mespinoza
ⓘ
Type: MALWARE
ⓘ
Platforms: Windows
Contributors: Daniyal Naeem, BT Security
Version: 1.0
Created: 01 March 2021
Last Modified: 27 April 2021

Associated Software Descriptions

Name Description
Mespinoza

[1][2][3]
Enterprise Layer
download view

Techniques Used

Domain ID Name Use
Enterprise T1036 .005 伪装: Match Legitimate Name or Location

Pysa has executed a malicious executable by naming it svchost.exe.[1]
Enterprise T1112 修改注册表

Pysa has modified the registry key "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" and added the ransom note.[1]

Enterprise T1059 .001 命令与脚本解释器: PowerShell

Pysa has used Powershell scripts to deploy its ransomware.[1]

.006 命令与脚本解释器: Python

Pysa has used Python scripts to deploy ransomware.[1]
Enterprise T1562 .001 妨碍防御: Disable or Modify Tools

Pysa has the capability to stop antivirus services and disable Windows Defender.[1]

Enterprise T1003 .001 操作系统凭证转储: LSASS Memory

Pysa can perform OS credential dumping using Mimikatz.[1]
Enterprise T1486 数据加密以实现影响

Pysa has used RSA and AES-CBC encryption algorithm to encrypt a list of targeted file extensions.[1]

Enterprise T1110 暴力破解

Pysa has used brute force attempts against a central management console, as well as some Active Directory accounts.[1]
Enterprise T1489 服务停止

Pysa can stop services and processes.[1]

Enterprise T1552 .001 未加密凭证: Credentials In Files

Pysa has extracted credentials from the password database before encrypting the files.[1]

Enterprise T1070 .004 移除指标: File Deletion

Pysa has deleted batch files after execution. [1]

Enterprise T1490 系统恢复抑制

Pysa has the functionality to delete shadow copies.[1]

Enterprise T1569 .002 系统服务: Service Execution

Pysa has used PsExec to copy and execute the ransomware.[1]
Enterprise T1016 系统网络配置发现

Pysa can perform network reconnaissance using the Advanced IP Scanner tool.[1]
Enterprise T1046 网络服务发现

Pysa can perform network reconnaissance using the Advanced Port Scanner tool.[1]
Enterprise T1021 .001 远程服务: Remote Desktop Protocol

Pysa has laterally moved using RDP connections.[1]

References

  1. CERT-FR. (2020, April 1). ATTACKS INVOLVING THE MESPINOZA/PYSA RANSOMWARE. Retrieved March 1, 2021.
  2. THe DFIR Report. (2020, November 23). PYSA/Mespinoza Ransomware. Retrieved March 17, 2021.
  1. NHS Digital. (2020, October 10). Pysa Ransomware: Another 'big-game hunter' ransomware. Retrieved March 17, 2021.