CrowdStrike Wizard Spider October 2020

Conti has the ability to discover hosts on a target network.

Ryuk can use anti-disassembly and code transformation obfuscation techniques.

Conti can use compiler-based obfuscation for its code, encrypt DLLs, and hide Windows API calls.

Bazar has used XOR, RSA2, and RC4 encrypted files.

The Bazar loader has named malicious shortcuts "adobe" and mimicked communications software.

Bazar can execute a PowerShell script received from C2.

Bazar can download and deploy additional payloads, including ransomware and post-exploitation frameworks such as Cobalt Strike.

Conti can enumerate remote open SMB network shares using NetShareEnum().

Bazar can gain execution after a user clicks on a malicious link to decoy landing pages hosted on Google Docs.

Wizard Spider has lured victims to execute malware with spearphishing attachments containing macros to download either Emotet, Bokbot, TrickBot, or Bazar.

Conti can use CreateIoCompletionPort(), PostQueuedCompletionStatus(), and GetQueuedCompletionPort() to rapidly encrypt files, excluding those with the extensions of .exe, .dll, and .lnk. It has used a different AES-256 encryption key per file with a bundled RAS-4096 public encryption key that is unique for each victim. Conti can use “Windows Restart Manager” to ensure files are unlocked and open for encryption.

Ryuk has used a combination of symmetric (AES) and asymmetric (RSA) encryption to encrypt files. Files have been encrypted with their own AES key and given a file extension of .RYK. Encrypted directories have had a ransom note of RyukReadMe.txt written to the directory.

Bazar has been spread via emails with embedded malicious links.