CrowdStrike IceApple May 2022

IceApple's Credential Dumper module can dump encrypted password hashes from SAM registry keys, including `HKLM\SAM\SAM\Domains\Account\F` and `HKLM\SAM\SAM\Domains\Account\Users\*\V`.

IceApple's Credential Dumper module can dump LSA secrets from registry keys, including: `HKLM\SECURITY\Policy\PolEKList\default`, `HKLM\SECURITY\Policy\Secrets\*\CurrVal`, and `HKLM\SECURITY\Policy\Secrets\*\OldVal`.

IceApple can collect files, passwords, and other data from a compromised host.

The IceApple ifconfig module can iterate over all network interfaces on the host and retrieve the name, description, MAC address, DNS suffix, DNS servers, gateways, IPv4 addresses, and subnet masks.

IceApple can use Base64 and "junk" JavaScript code to obfuscate information.

IceApple .NET assemblies have used `App_Web_` in their file names to appear legitimate.

IceApple's Multi File Exfiltrator module can exfiltrate multiple files from a compromised host as an HTTP response over C2.

The IceApple OWA credential logger can monitor for OWA authentication requests and log the credentials.

IceApple can delete files and directories from targeted systems.

IceApple can use HTTP GET to request and pull information from C2.

The IceApple Server Variable Dumper module iterates over all server variables present for the current request and returns them to the adversary.

The IceApple Directory Lister module can list information about files and directories including creation time, last write time, name, and size.

The IceApple Active Directory Querier module can perform authenticated requests against an Active Directory server.

IceApple can use a Base64-encoded AES key to decrypt tasking.

IceApple is an IIS post-exploitation framework, consisting of 18 modules that provide several functionalities.

IceApple can harvest credentials from local and remote host registries.

IceApple can encrypt and compress files using Gzip prior to exfiltration.

The IceApple Result Retriever module can AES encrypt C2 responses.

IceApple can use reflective code loading to load .NET assemblies into `MSExchangeOWAAppPool` on targeted Exchange servers.