SharpDecryptPwd

Reported Context (2)

Uses credential dumping tools such as Mimikatz and SharpDecryptPwd Qilin Ransomware Group Expands Cross-Platform Operations and Extortion Tactics
the batch file sequentially invoked netpass.exe, WebBrowserPassView.exe, BypassCredGuard.exe, SharpDecryptPwd, and ultimately Mimikatz. Within the script (see Figure 8), SharpDecryptPwd is configured to extract, Cisco Talos Details Qilin Ransomware Tactics, from VPN Access to Network Encryption

CVE (2)

Malware (5)

People (4)

Threat Actors (1)

MITRE ATT&CK (40)

Vendors (1)

Products (10)

Tools (19)

Industries (11)

Countries (7)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.