1. Home
  2. Software
  3. Prestige

Prestige

Prestige ransomware has been used by Sandworm Team since at least March 2022, including against transportation and related logistics industries in Ukraine and Poland in October 2022.[1]

ID: S1058
ⓘ
Type: MALWARE
ⓘ
Platforms: Windows
Contributors: Mindaugas Gudzis, BT Security
Version: 1.0
Created: 20 January 2023
Last Modified: 24 February 2023
Enterprise Layer
download view

Techniques Used

Domain ID Name Use
Enterprise T1112 修改注册表

Prestige has the ability to register new registry keys for a new extension handler via HKCR\.enc and HKCR\enc\shell\open\command.[1]
Enterprise T1059 .001 命令与脚本解释器: PowerShell

Prestige can use PowerShell for payload execution on targeted systems.[1]
Enterprise T1484 .001 域或租户策略修改: Group Policy Modification

Prestige has been deployed using the Default Domain Group Policy Object from an Active Directory Domain Controller.[1]
Enterprise T1486 数据加密以实现影响

Prestige has leveraged the CryptoPP C++ library to encrypt files on target systems using AES and appended filenames with .enc.[1]
Enterprise T1083 文件和目录发现

Prestige can traverse the file system to discover files to encrypt by identifying specific extensions defined in a hardcoded list.[1]
Enterprise T1489 服务停止

Prestige has attempted to stop the MSSQL Windows service to ensure successful encryption using C:\Windows\System32\net.exe stop MSSQLSERVER.[1]
Enterprise T1106 本机API

Prestige has used the Wow64DisableWow64FsRedirection() and Wow64RevertWow64FsRedirection() functions to disable and restore file system redirection.[1]

Enterprise T1490 系统恢复抑制

Prestige can delete the backup catalog from the target system using: c:\Windows\System32\wbadmin.exe delete catalog -quiet and can also delete volume shadow copies using: \Windows\System32\vssadmin.exe delete shadows /all /quiet.[1]
Enterprise T1053 .005 预定任务/作业: Scheduled Task

Prestige has been executed on a target system through a scheduled task created by Sandworm Team using Impacket.[1]

Groups That Use This Software

ID Name References
G0034 Sandworm Team

[1][2]

References

  1. MSTIC. (2022, October 14). New “Prestige” ransomware impacts organizations in Ukraine and Poland. Retrieved January 19, 2023.
  1. Roncone, G. et al. (n.d.). APT44: Unearthing Sandworm. Retrieved July 11, 2024.