Access vector Ransonware

Hello,

If files have been encrypted a good place to start is to check the owner of one of the encrypted files. This can be a good indication of the user account used.

Thanks.

Hello Franco,

there's no ad hoc query that will give you this information.
As you said attack on our systems - was it successful? How did you become aware of it? How many computers have been affected, if files have been encrypted only local ones or on shares as well? Is Malicious Traffic Detection enabled?

Christian

Thanks very much for the replay

No file was encrypted, Sophos worked right well. Many computers have been infected and MTD is enable.

thanks

Franco

Hello Franco,

Many computers have been infected
so what alerted you to the attack? Detections reported by the SAV component? Something else? Could you post some alert or event details?

Christian

SAV - Copia.txt

ok i have posted the alert e sav file

thanks

Hello Franco,

the paths might give some hint where the threat came from, e.g. browsing or email (or HTML email with a link ...). Several users around the same time suggests email as the source.

Christian