Play

Known techniques

• T1003.001LSASS Memory
• T1016System Network Configuration Discovery
• T1018Remote System Discovery
• T1021.002SMB/Windows Admin Shares
• T1027.010Command Obfuscation
• T1030Data Transfer Size Limits
• T1048Exfiltration Over Alternative Protocol
• T1057Process Discovery
• T1059.001PowerShell
• T1059.003Windows Command Shell
• T1070.004File Deletion
• T1078Valid Accounts
• T1078.002Domain Accounts
• T1078.003Local Accounts
• T1082System Information Discovery
• T1083File and Directory Discovery
• T1105Ingress Tool Transfer
• T1133External Remote Services
• T1190Exploit Public-Facing Application
• T1518.001Security Software Discovery
• T1560.001Archive via Utility
• T1587.001Malware
• T1588.002Tool
• T1657Financial Theft
• T1685Disable or Modify Tools
• T1685.005Clear Windows Event Logs

Malware and tools used