↓ Skip to main content
bubka hacks stuff

MEGA

ELK-Black Basta

ELK SOC SIEM Log Analysis BlackBasta Ransomware Phishing LOLbins MEGA VBA PsExec
A finance employee opened a malicious Excel macro from a drive-by download, which executed a VBS dropper, loaded WindowsUpdaterFX.dll via regsvr32, established persistence, dropped Pancake.jpg.exe as a C2 backdoor, performed internal reconnaissance, laterally moved to a domain controller via PsExec using compromised credentials, exfiltrated client data to MEGA via rclone, deleted shadow copies, and deployed BlackBasta ransomware.