KnightMalware

“…ames and passwords and also usernames and password hashes (T1550.002) which are usually retrieved by threat actors through LSASS Dump (T1003.001) during the intrusions.”

“…tep involved the upload of a tool known as PCHunter, a small all-in-one toolkit utility developed to spot and remove malware, including rootkits, which allows access to various system settings such as kernels and kernel modules, processes, network, startup and a whole lot more.”

“In the following image, there can be seen two procedures: the first guides the threat actors to create a scheduled task to execute the ransomware in the Netlogon folder by using Windows cmd; whereas the second guides the threat actors to place the ransomware in the Netlogon folde…”

“The software requires a password to run and uses the vulnerable driver TfSysMon.sys (T1068) to terminate around 96 processes related to AV and EDR solutions.”

“Forced to pivot, they resorted to a different approach: a tried-and-true brute force attack based on an enriched dictionary, against the VPN service provided by the vulnerable Palo Alto firewall.”

“The credentials can be usernames and passwords and also usernames and password hashes (T1550.002) which are usually retrieved by threat actors through LSASS Dump (T1003.001) during the intrusions.”