Procedure examples

BabyShark has executed the reg query command for HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default.

BabyShark has executed the ipconfig /all command.

BabyShark has executed the whoami command.

BabyShark has used scheduled tasks to maintain persistence.

BabyShark has a PowerShell-based remote administration ability that can implement a PowerShell or C# based keylogger.

BabyShark has executed the tasklist command.

BabyShark has used cmd.exe to execute commands.

BabyShark can execute additional VisualBasic content.

BabyShark has cleaned up all files associated with the secondary payload execution.

BabyShark has executed the ver command.

BabyShark has used dir to search for "programfiles" and "appdata".

BabyShark has downloaded additional files from the C2.

BabyShark has encoded data using certutil before exfiltration.

BabyShark has the ability to decode downloaded files prior to execution.

BabyShark has used mshta.exe to download and execute applications from a remote server.

BabyShark has added a Registry key to ensure all future macros are enabled for Microsoft Word and Excel as well as for additional persistence.