CrowdStrike Grim Spider May 2019

Wizard Spider has used networkdll for network discovery and psfin specifically for financial and point of sale indicators. Wizard Spider has also used AdFind, nltest/dclist, and PowerShell script Get-DataInfo.ps1 to enumerate domain computers, including the domain controller.

Wizard Spider has used RDP for lateral movement and to deploy ransomware interactively.

Wizard Spider has used scheduled tasks to install TrickBot, using task names to appear legitimate such as WinDotNet, GoogleTask, or Sysnetsf. It has also used common document file names for other malware binaries.

Wizard Spider has exfiltrated domain credentials and network enumeration information over command and control (C2) channels.

Wizard Spider has used WMI and LDAP queries for network discovery and to move laterally. Wizard Spider has also used batch scripts to leverage WMIC to deploy ransomware.

Wizard Spider has used scheduled tasks to establish persistence for TrickBot and other malware.

Wizard Spider has used macros to execute PowerShell scripts to download malware on victim's machines. It has also used PowerShell to execute commands and move laterally through a victim network.

Wizard Spider has used file deletion to remove some modules and configurations from an infected host after use.

Wizard Spider has used HTTP for network communications.

Wizard Spider has collected and staged credentials and network enumeration information, using the networkdll and psfin TrickBot modules.

Wizard Spider has used valid credentials for privileged accounts with the goal of accessing domain controllers.

Wizard Spider has modified the Registry key HKLM\System\CurrentControlSet\Control\SecurityProviders\WDigest by setting the UseLogonCredential registry value to 1 in order to force credentials to be stored in clear text in memory. Wizard Spider has also modified the WDigest registry key to allow plaintext credentials to be cached in memory.

Wizard Spider has lured victims to execute malware with spearphishing attachments containing macros to download either Emotet, Bokbot, TrickBot, or Bazar.

Wizard Spider has installed TrickBot as a service named ControlServiceA in order to establish persistence.

Wizard Spider has used spearphishing attachments to deliver Microsoft documents containing macros or PDFs containing malicious links to download either Emotet, Bokbot, TrickBot, or Bazar.

Wizard Spider has used stolen credentials to copy tools into the %TEMP% directory of domain controllers.