Conti Local and Remote Discovery
Using the Jambi agent from the previous chain, discover local services and identify potential security products which may interfere with a successful attack. Check if the local machine is vulnerable to PrintNightmare. Identify the currently joined domain, if required, bypass controls by sideloading the RSAT-AD-PowerShell module from a remote github repository. Collect detailed domain information, groups (and associated users), identify possible NAS/Backup servers, and find domain computers that are hosting shared printers.

TTP Tuesday: Conti (Release 2)

Local and Remote Discovery

Theme Overview

We are continuing the Conti ransomware release this week and integrated some existing Conti TTPs along with some new ones. The Conti theme will contain the following kill-chains:

1. Recon and Initial Access
2. Local and Remote Discovery (Current Release)
3. Gain privileges and persist
4. Move to remote systems
5. Data collection and exfiltration
6. Deploy ransomware

Local and Remote Discovery

Conti is considered Ransomware-as-a-Service (RaaS) and has an elaborate chain of events from initial access to execution of the ransomware. For this week, we are focusing on the Local and Remote Discovery. Conti uses numerous techniques during the discovery phase. This chain starts with a Jambi agent from last week’s chain. For remote discovery, the chain will check whether RSAT-AD-PowerShell is present, if not it will attempt to side-load it via a GitHub repository. The chain then probes for domain information, printer shares, storage devices, groups, and users. For local discovery, the chain will check the machine’s services and attempt to identify any security services which may decrease the likelihood of successfully deploying the ransomware. Finally, the chain identifies patches and registry keys which may lead to successful exploitation of CVE-2021-34527 (PrintNightmare).

Check it out on the Prelude chains website.

Watch a demonstration: Conti Local & Remote Discovery

Staying up to date

Thanks for reading our latest TTP Tuesday release! Please subscribe and reach out with any feedback. We love to hear from our community!

There are several ways to follow us and learn more about Prelude and our team members:

Get our products

Download Prelude Operator: https://www.prelude.org/download/current
See the latest kill chain and TTP Releases: https://chains.prelude.org/
See our open-source repositories: https://github.com/preludeorg

Join our community

Discord: https://discord.gg/gzUv4XNquu
Reddit: https://www.reddit.com/r/preludeorg/
Twitter: https://twitter.com/preludeorg

Read, watch, and listen

Listen to our Podcast: https://anchor.fm/preludeorg
Read our blog: https://feed.prelude.org
Watch our live streams: https://www.twitch.tv/preludeorg
Watch our pre-recorded content: https://www.youtube.com/c/preludeorg

Follow our team

David: privateducky
Alex: khyberspache
Kris: Xanthonus
Octavia: VV_X_7
Sam: wasupwithuman

Source: https://feed.prelude.org
Read more

Execute this chain

Download Operator (1.7.0)
Learn about Operator

TTPs

Load Active Directory PowerShell Module
Discover Local Services
Get detailed Domain information
List Active Directory Shared Printers
Query registry for PrintNightmare vulnerable key
Discover initial domain information
Find Storage Servers
Get Active Directory Groups and Users
Check if specific patch is installed

User-Set Custom Variables

  • patch.HotFixID: KB5004945