Cybereason OperationCuckooBees May 2022

During Operation CuckooBees, the threat actors leveraged a custom tool to dump OS credentials and used following commands: `reg save HKLM\\SYSTEM system.hiv`, `reg save HKLM\\SAM sam.hiv`, and `reg save HKLM\\SECURITY security.hiv`, to dump SAM, SYSTEM and SECURITY hives.

During Operation CuckooBees, the threat actors collected data, files, and other information from compromised networks.

During Operation CuckooBees, the threat actors used the `net start` command as part of their initial reconnaissance.

During Operation CuckooBees, the threat actors used `ipconfig`, `nbtstat`, `tracert`, `route print`, and `cat /etc/hosts` commands.

During Operation CuckooBees, the threat actors used the `net view` and `ping` commands as part of their advanced reconnaissance.

During Operation CuckooBees, the threat actors executed an encoded VBScript file.

During Operation CuckooBees, the threat actors stroed payloads in Windows CLFS (Common Log File System) transactional logs.

During Operation CuckooBees, the threat actors used the `query user` and `whoami` commands as part of their advanced reconnaissance.

During Operation CuckooBees, the threat actors renamed a malicious executable to `rundll32.exe` to allow it to blend in with other Windows system files.

During Operation CuckooBees, the threat actors used the `net session`, `net use`, and `netstat` commands as part of their advanced reconnaissance.

During Operation CuckooBees, the threat actors used scheduled tasks to execute batch scripts for lateral movement with the following command: `SCHTASKS /Create /S <IP Address> /U <Username> /p <Password> /SC ONCE /TN test /TR <Path to a Batch File> /ST <Time> /RU SYSTEM.`

During Operation CuckooBees, the threat actors used the `tasklist` command as part of their advanced reconnaissance.

During Operation CuckooBees, the threat actors used batch scripts to perform reconnaissance.

During Operation CuckooBees, the threat actors executed an encoded VBScript file using `wscript` and wrote the decoded output to a text file.

During Operation CuckooBees, the threat actors used the `net group` command as part of their advanced reconnaissance.

During Operation CuckooBees, the threat actors enabled HTTP and HTTPS listeners.

During Operation CuckooBees, the threat actors used compromised domain administrator credentials as part of their lateral movement.

During Operation CuckooBees, the threat actors used the `systeminfo` command to gather details about a compromised system.

During Operation CuckooBees, the threat actors used `dir c:\\` to search for files.

During Operation CuckooBees, the threat actors used the `net user` command to gather account information.

During Operation CuckooBees, the threat actors used the `dsquery` and `dsget` commands to get domain environment information and to query users in administrative groups.

During Operation CuckooBees, the threat actors used the `fsutil fsinfo drives` command as part of their advanced reconnaissance.

During Operation CuckooBees, the threat actors used the `net time` command as part of their advanced reconnaissance.

During Operation CuckooBees, the threat actors enabled WinRM over HTTP/HTTPS as a backup persistence mechanism using the following command: `cscript //nologo "C:\Windows\System32\winrm.vbs" set winrm/config/service@{EnableCompatibilityHttpsListener="true"}`.

During Operation CuckooBees, the threat actors used the `net share` command as part of their advanced reconnaissance.

During Operation CuckooBees, the threat actors exploited multiple vulnerabilities in externally facing servers.

During Operation CuckooBees, the threat actors used the `net accounts` command as part of their advanced reconnaissance.

During Operation CuckooBees, the threat actors generated a web shell within a vulnerable Enterprise Resource Planning Web Application Server as a persistence mechanism.

During Operation CuckooBees, the threat actors modified the `IKEEXT` and `PrintNotify` Windows services for persistence.

During Operation CuckooBees, attackers used a signed kernel rootkit to establish additional persistence.

During Operation CuckooBees, the threat actors used the Makecab utility to compress and a version of WinRAR to create password-protected archives of stolen data prior to exfiltration.

During Operation CuckooBees, the threat actors used the legitimate Windows services `IKEEXT` and `PrintNotify` to side-load malicious DLLs.

For Operation CuckooBees, the threat actors obtained publicly-available JSP code that was used to deploy a webshell onto a compromised server.