MITRE ATT&CKsoftware (malware)
S0698 HermeticWizard
- Domain
- enterprise
- Platforms
- Windows
- Version
- 1.1
- Created
- 2022-03-25
Description
HermeticWizard is a worm that has been used to spread HermeticWiper in attacks against organizations in Ukraine since at least 2022.
Related
Uses · MITRE ATT&CK (16)
- T1685.005 Clear Windows Event Logs sub-technique
- T1027.013 Encrypted/Encoded File sub-technique
- T1570 Lateral Tool Transfer technique
- T1569.002 Service Execution sub-technique
- T1059.003 Windows Command Shell sub-technique
- T1559.001 Component Object Model sub-technique
- T1021.002 SMB/Windows Admin Shares sub-technique
- T1110.001 Password Guessing sub-technique
- T1036.005 Match Legitimate Resource Name or Location sub-technique
- T1553.002 Code Signing sub-technique
- T1218.010 Regsvr32 sub-technique
- T1218.011 Rundll32 sub-technique
- T1018 Remote System Discovery technique
- T1046 Network Service Discovery technique
- T1047 Windows Management Instrumentation technique
- T1106 Native API technique
References
- https://www.welivesecurity.com/2022/03/01/isaacwiper-hermeticwizard-wiper-worm-targeting-ukraine ESET Hermetic Wizard March 2022