A chain that is configured to focus on Cuba ransomware's recent post-exploitation activities first by dumping user credentials using Mimikatz and then attempting to initiate a Remote Desktop Protocol (RDP) connection before attempting to exploit the ZeroLogon vulnerability to gain Domain Administrator privileges and ending with capturing and staging a series of screenshots prior to exfiltration.


Is my host protected against Cuba Ransomware?

Capture a series of desktop screenshots to a staging directory. A user may see a permission prompt or hear the snapshots.


Grab a series of desktop screenshots

Authors

Tactic

Test this TTP