Crowdstrike HuntReport 2022

Aquatic Panda captured local Windows security event log data from victim machines using the wevtutil utility to extract contents to an evtx output file.

Aquatic Panda used remote scheduled tasks to install malicious software on victim systems during lateral movement actions.

Aquatic Panda leveraged stolen credentials to move laterally via RDP in victim environments.

Aquatic Panda used remote shares to enable lateral movement in victim environments.

Aquatic Panda used SSH with captured user credentials to move laterally in victim environments.

Aquatic Panda gathers information on recently logged-in users on victim devices.

Aquatic Panda created new, malicious services using names such as Windows User Service to attempt to blend in with legitimate items on victim systems.

Aquatic Panda renamed or moved malicious binaries to legitimate locations to evade defenses and blend into victim environments.

Aquatic Panda used WMI for lateral movement in victim environments.

Aquatic Panda used malicious shell scripts in Linux environments following access via SSH to install Linux versions of Winnti malware.

Aquatic Panda cleared command history in Linux environments to remove traces of activity after operations.

Aquatic Panda has deleted malicious executables from compromised machines.

Aquatic Panda used multiple mechanisms to capture valid user accounts for victim domains to enable lateral movement and access to additional hosts in victim environments.

Aquatic Panda used the last command in Linux environments to identify recently logged-in users on victim machines.

Aquatic Panda modified the victim registry to enable the `RestrictedAdmin` mode feature, allowing for pass the hash behaviors to function via RDP.

Aquatic Panda used rundll32.exe to proxy execution of a malicious DLL file identified as a keylogging binary.

Aquatic Panda created new Windows services for persistence that masqueraded as legitimate Windows services via name change.

Aquatic Panda used a registry edit to enable a Windows feature called RestrictedAdmin in victim environments. This change allowed Aquatic Panda to leverage "pass the hash" mechanisms as the alteration allows for RDP connections with a valid account name and hash only, without possessing a cleartext password value.

Aquatic Panda has used several publicly available tools, including WinRAR and 7zip, to compress collected files and memory dumps prior to exfiltration.

Aquatic Panda has used DLL search-order hijacking to load `exe`, `dll`, and `dat` files into memory. Aquatic Panda loaded a malicious DLL into the legitimate Windows Security Health Service executable (SecurityHealthService.exe) to execute malicious code on victim systems.

Aquatic Panda modified the ld.so preload file in Linux environments to enable persistence for Winnti malware.

Aquatic Panda enumerated logs related to authentication in Linux environments prior to deleting selective entries for defense evasion purposes.

Aquatic Panda clears Windows Event Logs following activity to evade defenses.