Conti
Can you identify the location of the ransomware?
What is the Sysmon event ID for the related file creation event?
Can you find the MD5 hash of the ransomware?
What file was saved to multiple folder locations?
What was the command the attacker used to add a new user to the compromised system?
Get Ehsanj’s stories in your inbox
Join Medium for free to get updates from this writer.
Windows ID for creating or adding user: 4720
The attacker migrated the process for better persistence. What is the migrated process image (executable), and what is the original process image (executable) when the attacker got on the system?
The attacker also retrieved the system hashes. What is the process image used for getting the system hashes?
What is the web shell the exploit deployed to the system?
What is the command line that executed this web shell?
