Abuse Melding

Je hebt een klacht over de onderstaande posting:

13-11-2017, 13:20 door Anoniem

Los van het feit dat WannaCry geen gebruik maakte van mimikatz, ... WannaCry & MimiKatz The attackers left behind several tools on the victim’s network that provided substantial evidence into how WannaCry spread. Two files, mks.exe and hptasks.exe (see Appendix C: Indicators of Compromise), were found on one affected computer. The file mks.exe is a variant of Mimikatz (Hacktool.Mimikatz), a password-dumping tool that is widely used in targeted attacks. The latter file, hptasks.exe, was used to then copy and execute WannaCry on other network computers using the passwords stolen by mks.exe. The spread of WannaCry by hptasks.exe was a two-stage process. In stage one, when run, hptasks can be passed a target list of IP addresses as an argument. When given this command, hptasks reads previously stolen credentials from a file called cg.wry and uses them to connect to every computer in the set of IP address ranges. All connection attempts are logged into the log.dat file. If a successful connection is made to ...

Beschrijf je klacht (Optioneel):

captcha
Nieuwe code
Klacht Versturen
Zoeken
search
Certified Secure Happy Holidays