ESET Hermetic Wizard March 2022

HermeticWizard can find machines on the local network by gathering known local IP addresses through `DNSGetCacheDataTable`, `GetIpNetTable`,`WNetOpenEnumW(RESOURCE_GLOBALNET, RESOURCETYPE_ANY)`,`NetServerEnum`,`GetTcpTable`, and `GetAdaptersAddresses.`

HermeticWizard can use a list of hardcoded credentials to to authenticate via NTLMSSP to the SMB shares on remote systems.

HermeticWizard has the ability to encrypt PE files with a reverse XOR loop.

HermeticWiper has used the name `postgressql.exe` to mask a malicious payload.

HermeticWizard has been named `exec_32.dll` to mimic a legitimate MS Outlook .dll.

HermeticWizard has the ability to scan ports on a compromised network.

HermeticWizard can use WMI to create a new process on a remote machine via `C:\windows\system32\cmd.exe /c start C:\windows\system32\\regsvr32.exe /s /iC:\windows\<filename>.dll`.

HermeticWizard can use `cmd.exe` for execution on compromised hosts.

HermeticWiper can use `cmd.exe /Q/c move CSIDL_SYSTEM_DRIVE\temp\sys.tmp1 CSIDL_WINDOWS\policydefinitions\postgresql.exe 1> \\127.0.0.1\ADMIN$\_1636727589.6007507 2>&1` to deploy on an infected system.

HermeticWiper can disable pop-up information about folders and desktop items and delete Registry keys to hide malicious services.

HermeticWiper has the ability to overwrite its own file with random bites.

HermeticWiper can determine the OS version and bitness on a targeted host.

HermeticWizard can connect to remote shares using `WNetAddConnection2W`.

HermeticWiper can call multiple Windows API functions used for privilege escalation, service execution, and to overwrite random bites of data.

HermeticWizard can use a list of hardcoded credentials in attempt to authenticate to SMB shares.

HermeticWizard has used `regsvr32.exe /s /i` to execute malicious payloads.

HermeticWizard has the ability to create a new process using `rundll32`.

HermeticWiper has the ability to deploy through an infected system's default domain policy.

HermeticWiper can recursively wipe folders and files in `Windows`, `Program Files`, `Program Files(x86)`, `PerfLogs`, `Boot, System`, `Volume Information`, and `AppData` folders using `FSCTL_MOVE_FILE`. HermeticWiper can also overwrite symbolic links and big files in `My Documents` and on the Desktop with random bytes.

HermeticWiper can disable the VSS service on a compromised host using the service control manager.

HermeticWizard has been signed by valid certificates assigned to Hermetica Digital.

HermeticWizard can execute files on remote machines using DCOM.

HermeticWizard can use `OpenRemoteServiceManager` to create a service.

HermeticWizard can copy files to other machines on a compromised network.

HermeticWiper can enumerate physical drives on a targeted host.

HermeticWiper can overwrite the `C:\Windows\System32\winevt\Logs` file on a targeted system.

HermeticWizard has the ability to use `wevtutil cl system` to clear event logs.