Procedure examples

HermeticWizard can find machines on the local network by gathering known local IP addresses through `DNSGetCacheDataTable`, `GetIpNetTable`,`WNetOpenEnumW(RESOURCE_GLOBALNET, RESOURCETYPE_ANY)`,`NetServerEnum`,`GetTcpTable`, and `GetAdaptersAddresses.`

HermeticWizard can use a list of hardcoded credentials to to authenticate via NTLMSSP to the SMB shares on remote systems.

HermeticWizard has the ability to encrypt PE files with a reverse XOR loop.

HermeticWizard has been named `exec_32.dll` to mimic a legitimate MS Outlook .dll.

HermeticWizard has the ability to scan ports on a compromised network.

HermeticWizard can use WMI to create a new process on a remote machine via `C:\windows\system32\cmd.exe /c start C:\windows\system32\\regsvr32.exe /s /iC:\windows\<filename>.dll`.

HermeticWizard can use `cmd.exe` for execution on compromised hosts.

HermeticWizard can connect to remote shares using `WNetAddConnection2W`.

HermeticWizard can use a list of hardcoded credentials in attempt to authenticate to SMB shares.

HermeticWizard has used `regsvr32.exe /s /i` to execute malicious payloads.

HermeticWizard has the ability to create a new process using `rundll32`.

HermeticWizard has been signed by valid certificates assigned to Hermetica Digital.

HermeticWizard can execute files on remote machines using DCOM.

HermeticWizard can use `OpenRemoteServiceManager` to create a service.

HermeticWizard can copy files to other machines on a compromised network.

HermeticWizard has the ability to use `wevtutil cl system` to clear event logs.