Wizard Spider

Wizard Spider has used the Invoke-Inveigh PowerShell cmdlets, likely for name service poisoning.^[4]

Wizard Spider has used PowerShell cmdlet Invoke-WCMDump to enumerate Windows credentials in the Credential Manager in a compromised network.^[7]

Wizard Spider has used scheduled tasks to install TrickBot, using task names to appear legitimate such as WinDotNet, GoogleTask, or Sysnetsf.^[6] It has also used common document file names for other malware binaries.^[4]

Wizard Spider has used the Invoke-SMBExec PowerShell cmdlet to execute the pass-the-hash technique and utilized stolen password hashes to move laterally.^[7]

Wizard Spider has installed TrickBot as a service named ControlServiceA in order to establish persistence.^[6][7]

Wizard Spider has created local administrator accounts to maintain persistence in compromised networks.^[7]

Wizard Spider has established persistence via the Registry key HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run and a shortcut within the startup folder.^[2][4]

Wizard Spider has used macros to execute PowerShell scripts to download malware on victim's machines.^[6] It has also used PowerShell to execute commands and move laterally through a victim network.^{[2][4][11][7]}

Wizard Spider has shut down or uninstalled security applications on victim systems that might prevent ransomware from executing.^{[2][4][12][7]}

Wizard Spider has used HTTP for network communications.^[6]

Wizard Spider has leveraged ProtonMail email addresses in ransom notes when delivering Ryuk ransomware.^[7]

Wizard Spider has archived data into ZIP files on compromised machines.^[7]

Wizard Spider has dumped the lsass.exe memory to harvest credentials with the use of open-source tool LaZagne.^[7]

Wizard Spider has used the icacls command to modify access control to backup servers, providing them with full control of all the system folders.^[13]

Wizard Spider has exfiltrated victim information using FTP.^[12][14]

Wizard Spider has used PowerShell cmdlets Get-GPPPassword and Find-GPOPassword to find unsecured credentials in a compromised network group policy.^[7]

Wizard Spider used Base64 encoding to obfuscate an Empire service and PowerShell commands.^[5][12]

Wizard Spider has lured victims into clicking a malicious link delivered through spearphishing.^[2]

Wizard Spider has used file deletion to remove some modules and configurations from an infected host after use.^[6]

Wizard Spider has used Rubeus, MimiKatz Kerberos module, and the Invoke-Kerberoast cmdlet to steal AES hashes.^{[12][4][2][14][7]}

Wizard Spider has utilized rundll32.exe to deploy ransomware commands with the use of WebDAV.^[7]

Wizard Spider has used services.exe to execute scripts and executables during lateral movement within a victim's network. Wizard Spider has also used batch scripts that leverage PsExec to execute a previously transferred ransomware payload on a victim's network.^[12][15][7]

Wizard Spider has utilized tools such as Empire, Cobalt Strike, Cobalt Strike, Rubeus, AdFind, BloodHound, Metasploit, Advanced IP Scanner, Nirsoft PingInfoView, and SoftPerfect Network Scanner for targeting efforts.^[4][7]

Wizard Spider has identified domain admins through the use of net group "Domain admins" /DOMAIN. Wizard Spider has also leveraged the PowerShell cmdlet Get-ADComputer to collect account names from Active Directory data.^[12][7]

Wizard Spider has exfiltrated stolen victim data to various cloud storage providers.^[7]

Wizard Spider has used spearphishing attachments to deliver Microsoft documents containing macros or PDFs containing malicious links to download either Emotet, Bokbot, TrickBot, or Bazar.^[6][11][7]

Wizard Spider has used scheduled tasks to establish persistence for TrickBot and other malware.^{[6][2][4][14][7]}

Wizard Spider has used Digicert code-signing certificates for some of its malware.^[14]