Procedure examples

During Operation Wocao, threat actors encrypted IP addresses used for "Agent" proxy hops with RC4.

During Operation Wocao, threat actors used ProcDump to dump credentials from memory.

During Operation Wocao, threat actors used Mimikatz's DCSync to dump credentials from the memory of the targeted system.

During Operation Wocao, threat actors exfiltrated files and directories of interest from the targeted system.

During Operation Wocao, threat actors used the `tasklist` command to search for one of its backdoors.

During Operation Wocao, the threat actors executed `/c cd /d c:\windows\temp\ & reg query HKEY_CURRENT_USER\Software\<username>\PuTTY\Sessions\` to detect recent PuTTY sessions, likely to further lateral movement.

During Operation Wocao, threat actors discovered the local network configuration with `ipconfig`.

During Operation Wocao, threat actors used a Visual Basic script that checked for internet connectivity.

During Operation Wocao, threat actors used `nbtscan` and `ping` to discover remote systems, as well as `dsquery subnet` on a domain controller to retrieve all subnets in the Active Directory.

During Operation Wocao, threat actors used Impacket's smbexec.py as well as accessing the C$ and IPC$ shares to move laterally.

During Operation Wocao, threat actors edited variable names within the Impacket suite to avoid automated detection.

During Operation Wocao, threat actors executed PowerShell commands which were encoded or compressed using Base64, zlib, and XOR.

During Operation Wocao, threat actors enumerated sessions and users on a remote host, and identified privileged users logged into a targeted system.

During Operation Wocao, the threat actors renamed some tools and executables to appear as legitimate programs.

During Operation Wocao, threat actors used the XServer backdoor to exfiltrate data.

During Operation Wocao, threat actors scanned for open ports and used nbtscan to find NETBIOS nameservers.

During Operation Wocao, threat actors has used WMI to execute commands.

During Operation Wocao, threat actors collected a list of open connections on the infected system using `netstat` and checks whether it has an internet connection.

During Operation Wocao, threat actors used scheduled tasks to execute malicious PowerShell code on remote systems.

During Operation Wocao, threat actors injected code into a selected process, which in turn launches a command as a child process of the original.

During Operation Wocao, threat actors obtained the password for the victim's password manager via a custom keylogger.

During Operation Wocao, the threat actors used `tasklist` to collect a list of running processes on an infected system.

During Operation Wocao, threat actors used PowerShell on compromised systems.

During Operation Wocao, threat actors spawned a new `cmd.exe` process to execute commands.

During Operation Wocao, threat actors used VBScript to conduct reconnaissance on targeted systems.

During Operation Wocao, threat actors' backdoors were written in Python and compiled with py2exe.

During Operation Wocao, threat actors used the command `net localgroup administrators` to list all administrators part of a local group.

During Operation Wocao, the threat actors consistently removed traces of their activity by first overwriting a file using `/c cd /d c:\windows\temp\ & copy \\<IP ADDRESS>\c$\windows\system32\devmgr.dll \\<IP ADDRESS>\c$\windows\temp\LMAKSW.ps1 /y` and then deleting the overwritten file using `/c cd /d c:\windows\temp\ & del \\<IP ADDRESS>\c$\windows\temp\LMAKSW.ps1`.

During Operation Wocao, threat actors’ XServer tool communicated using HTTP and HTTPS.

During Operation Wocao, threat actors staged archived files in a temporary directory prior to exfiltration.

During Operation Wocao, threat actors used valid VPN credentials to gain initial access.

During Operation Wocao, threat actors used domain credentials, including domain admin, for lateral movement and privilege escalation.

During Operation Wocao, threat actors used local account credentials found during the intrusion for lateral movement and privilege escalation.

During Operation Wocao, threat actors discovered the OS versions of systems connected to a targeted network.

During Operation Wocao, threat actors gathered a recursive directory listing to find files and directories of interest.

During Operation Wocao, threat actors used the `net` command to retrieve information about domain accounts.

During Operation Wocao, threat actors used a custom proxy tool called "Agent" which has support for multiple hops.

During Operation Wocao, threat actors proxied traffic through multiple infected systems.

During Operation Wocao, threat actors executed commands through the installed web shell via Tor exit nodes.

During Operation Wocao, threat actors used a custom protocol for command and control.

During Operation Wocao, threat actors downloaded additional files to the infected system.

During Operation Wocao, threat actors used the `CreateProcessA` and `ShellExecute` API functions to launch commands after being injected into a selected process.

During Operation Wocao, threat actors used a custom collection method to intercept two-factor authentication soft tokens.

During Operation Wocao, the threat actors enabled Wdigest by changing the `HKLM\SYSTEM\\ControlSet001\\Control\\SecurityProviders\\WDigest` registry value from 0 (disabled) to 1 (enabled).

During Operation Wocao, threat actors collected clipboard data in plaintext.

During Operation Wocao, threat actors used a script to collect information about the infected system.

During Operation Wocao, threat actors discovered removable disks attached to a system.

During Operation Wocao, threat actors used the `time` command to retrieve the current time of a compromised system.

During Operation Wocao, threat actors used stolen credentials to connect to the victim's network via VPN.

During Operation Wocao, threat actors discovered network disks mounted to the system using netstat.