Until this point,
we have discussed how this tool works and have configured all the
prerequisite settings required to run this tool.
We will now run this tool and see it in action.
Remember to run PowerShell with admin privileges.
I will now execute the Powershell‑RAT Python file after which we
will be presented with options available to us.
We have already seen what each option does,
so we will now directly execute option 8,
which will perform all the above mentioned tasks in a single go.
Before that,
we will see the flow of this tool so that we have a better idea of
what our tasks are running in the background.
As soon as the operation is successful,
three different scheduled tasks will be created.
The first one is Microsoft Antivirus Critical Updates Core.
This will execute the script that will capture screenshots
of the activities that the user performs.
This task will run every 1 minute,
and hence we will have screenshot files that will be
captured at an interval of 1 minute.
The files will be stored in a ScreenShot folder that will reside
in a user's profile in the Documents directory.
In my case, the username is JMac, so the files will be saved in JMac's profile.
The second scheduled task that will be created will be named
Microsoft Antivirus Critical Updates UA.
This will trigger a script that will send screen capture
files as an attachment in the email.
This will run every 5 minutes,
and all the files present in the ScreenShot folder during
the execution of this task will be sent.
The third task that will be created will be named
Microsoft Antivirus Critical Updates DF.
This will run once every 12 minutes and delete all the
screenshots from the user's profile.
The technique that will be used here in creating
three scheduled tasks will be T1053, and the sub‑technique is 005.
I will now enter option 8 and hit Enter.
We can see a message, Backdoor successful.
Also, the three scheduled tasks that will capture the screen,
send email, and delete the screenshots has been successfully created.
We will have to wait at least for a minute for the task to
get triggered and scripts to get executed.
Until then, we'll review the scheduled tasks that were created in the last step.
This is the first task that will execute the script to capture
the screen and save it in the user's profile.
When I go to the Triggers tab, we can see that this will run once every minute.
The next task is the one that will send email to the adversary.
This will trigger once every 5 minutes.
The third task that will delete the screenshots will run every 12 minutes.
I'll now pause the video for a few minutes so that when we return we
have screenshot files available in the user's profile,
as well as multiple emails in our inbox.
I will now go to the user's Documents folder,
then we'll navigate to the ScreenShot folder, and here we can see multiple
screenshots of user activity that has been captured.
I'll open one of the files, and we can see that the screenshot
was taken while we were in the Task Scheduler window. By managing
to take screenshots, we were successfully able to demonstrate the
screen capture technique.
Now, the breach is not yet complete until the screen captures
have been sent to the adversary; hence, we'll quickly have a
look into our Gmail account.
Since I am using the same email address for sending and receiving emails,
we can either go into the Sent box or Inbox to view the emails.
Here, you can see each email has multiple screenshots that were
captured at an interval of 1 minute and the emails were
triggered at every 5 minutes.
This is how cyber teams can leverage Powershell‑RAT to carry
out cyberattacks and backdoor a Windows machine to steal
details about a user's activity.