WEBVTT 00:00:01.140 --> 00:00:02.200 Until this point, 00:00:02.200 --> 00:00:06.320 we have discussed how this tool works and have configured all the 00:00:06.320 --> 00:00:09.260 prerequisite settings required to run this tool. 00:00:10.240 --> 00:00:13.660 We will now run this tool and see it in action. 00:00:14.640 --> 00:00:17.620 Remember to run PowerShell with admin privileges. 00:00:18.840 --> 00:00:23.430 I will now execute the Powershell‑RAT Python file after which we 00:00:23.430 --> 00:00:26.400 will be presented with options available to us. 00:00:27.740 --> 00:00:30.740 We have already seen what each option does, 00:00:30.740 --> 00:00:34.540 so we will now directly execute option 8, 00:00:34.540 --> 00:00:38.760 which will perform all the above mentioned tasks in a single go. 00:00:40.440 --> 00:00:41.310 Before that, 00:00:41.490 --> 00:00:45.740 we will see the flow of this tool so that we have a better idea of 00:00:45.750 --> 00:00:48.360 what our tasks are running in the background. 00:00:49.240 --> 00:00:51.360 As soon as the operation is successful, 00:00:51.740 --> 00:00:54.290 three different scheduled tasks will be created. 00:00:55.340 --> 00:00:59.260 The first one is Microsoft Antivirus Critical Updates Core. 00:01:00.940 --> 00:01:04.230 This will execute the script that will capture screenshots 00:01:04.330 --> 00:01:07.300 of the activities that the user performs. 00:01:07.300 --> 00:01:10.260 This task will run every 1 minute, 00:01:10.640 --> 00:01:13.820 and hence we will have screenshot files that will be 00:01:13.820 --> 00:01:16.460 captured at an interval of 1 minute. 00:01:17.740 --> 00:01:21.340 The files will be stored in a ScreenShot folder that will reside 00:01:21.350 --> 00:01:24.730 in a user's profile in the Documents directory. 00:01:24.730 --> 00:01:31.560 In my case, the username is JMac, so the files will be saved in JMac's profile. 00:01:33.540 --> 00:01:37.220 The second scheduled task that will be created will be named 00:01:37.220 --> 00:01:41.640 Microsoft Antivirus Critical Updates UA. 00:01:41.640 --> 00:01:46.080 This will trigger a script that will send screen capture 00:01:46.080 --> 00:01:48.660 files as an attachment in the email. 00:01:50.440 --> 00:01:52.390 This will run every 5 minutes, 00:01:52.750 --> 00:01:56.070 and all the files present in the ScreenShot folder during 00:01:56.070 --> 00:01:58.450 the execution of this task will be sent. 00:02:00.340 --> 00:02:02.800 The third task that will be created will be named 00:02:02.800 --> 00:02:06.250 Microsoft Antivirus Critical Updates DF. 00:02:08.039 --> 00:02:11.730 This will run once every 12 minutes and delete all the 00:02:11.730 --> 00:02:13.650 screenshots from the user's profile. 00:02:15.340 --> 00:02:18.020 The technique that will be used here in creating 00:02:18.020 --> 00:02:24.850 three scheduled tasks will be T1053, and the sub‑technique is 005. 00:02:26.140 --> 00:02:29.320 I will now enter option 8 and hit Enter. 00:02:29.320 --> 00:02:33.060 We can see a message, Backdoor successful. 00:02:34.740 --> 00:02:38.250 Also, the three scheduled tasks that will capture the screen, 00:02:38.640 --> 00:02:43.260 send email, and delete the screenshots has been successfully created. 00:02:44.540 --> 00:02:48.200 We will have to wait at least for a minute for the task to 00:02:48.200 --> 00:02:51.060 get triggered and scripts to get executed. 00:02:51.940 --> 00:02:57.050 Until then, we'll review the scheduled tasks that were created in the last step. 00:02:58.740 --> 00:03:01.980 This is the first task that will execute the script to capture 00:03:01.980 --> 00:03:04.860 the screen and save it in the user's profile. 00:03:06.340 --> 00:03:11.160 When I go to the Triggers tab, we can see that this will run once every minute. 00:03:12.740 --> 00:03:16.360 The next task is the one that will send email to the adversary. 00:03:17.840 --> 00:03:20.190 This will trigger once every 5 minutes. 00:03:21.940 --> 00:03:26.480 The third task that will delete the screenshots will run every 12 minutes. 00:03:27.840 --> 00:03:32.640 I'll now pause the video for a few minutes so that when we return we 00:03:32.640 --> 00:03:35.660 have screenshot files available in the user's profile, 00:03:36.440 --> 00:03:39.050 as well as multiple emails in our inbox. 00:03:40.740 --> 00:03:43.320 I will now go to the user's Documents folder, 00:03:43.320 --> 00:03:48.950 then we'll navigate to the ScreenShot folder, and here we can see multiple 00:03:48.950 --> 00:03:51.700 screenshots of user activity that has been captured. 00:03:53.010 --> 00:03:57.310 I'll open one of the files, and we can see that the screenshot 00:03:57.310 --> 00:04:03.070 was taken while we were in the Task Scheduler window. By managing 00:04:03.070 --> 00:04:07.750 to take screenshots, we were successfully able to demonstrate the 00:04:07.750 --> 00:04:08.860 screen capture technique. 00:04:10.340 --> 00:04:14.840 Now, the breach is not yet complete until the screen captures 00:04:14.850 --> 00:04:20.070 have been sent to the adversary; hence, we'll quickly have a 00:04:20.070 --> 00:04:21.610 look into our Gmail account. 00:04:22.840 --> 00:04:27.550 Since I am using the same email address for sending and receiving emails, 00:04:28.140 --> 00:04:33.630 we can either go into the Sent box or Inbox to view the emails. 00:04:33.630 --> 00:04:39.000 Here, you can see each email has multiple screenshots that were 00:04:39.000 --> 00:04:43.170 captured at an interval of 1 minute and the emails were 00:04:43.170 --> 00:04:45.090 triggered at every 5 minutes. 00:04:46.640 --> 00:04:50.390 This is how cyber teams can leverage Powershell‑RAT to carry 00:04:50.390 --> 00:04:54.490 out cyberattacks and backdoor a Windows machine to steal 00:04:54.500 --> 00:04:56.660 details about a user's activity.