FIN6 also moved laterally to servers in the environment using RDP and configured them as malware “distribution” servers. Mandiant identified a utility script named kill.bat that was run on systems in the environment. FIN6 automated the deployment of kill.bat and the LockerGoga ransomware using batch script files. FIN6 created a number of BAT files on the malware distribution servers with the naming convention xaa.bat, xab.bat, xac.bat, etc. FIN6 renamed the psexec service name to “mstdc” in order to masquerade as the legitimate Windows executable “msdtc. Domain administrators have complete control over Windows systems in an Active Directory environment