the tools that real hackers use

Inc ransomware was deployed via RDP from a domain controller, exploiting lack of EDR on the connecting host to gain full network access 2:30. Attackers used batch scripts to erase volume shadow copies, clear Windows credentials, and remove RDP history to conceal their activities 8:00-10:00. The ransomware executable (win.exe) and its ZIP archive share the same SHA-256 hash, indicating a self-clobbering tactic to hide the payload 23:20. An NS.exe tool was used to scan networks and mount shared drives, demonstrating lateral movement capabilities 26:50. The ransom note, displayed on the victim’s desktop, threatens to publish data on the dark web and includes a Twitter/X account, showing active threat actor communication 29:30.

Proactive threat hunting and EDR solutions are essential for detecting and responding to such attacks by analyzing forensic artifacts like jump lists, registry keys, and event logs.

Sources:

• 2:30 Discussion of RDP access and domain controller compromise.
• 8:00-10:00 Analysis of batch scripts used to delete backups and credentials.
• 23:20 Hash comparison between win.exe and windows.zip, confirming ransomware origin.
• 26:50 NS.exe functionality for network scanning and shared drive mounting.
• 29:30 Ransom note content and threat actor communication via Twitter/X.