How Falcon Complete Disrupts eCrime Operators (WIZARD SPIDER)
Tags
cmtmf-attack-pattern: Process Injection
maec-delivery-vectors: Watering Hole
attack-pattern: Data Credentials - T1589.001 Domains - T1583.001 Domains - T1584.001 Exploits - T1587.004 Exploits - T1588.005 Malvertising - T1583.008 Malware - T1587.001 Malware - T1588.001 Phishing - T1660 Phishing - T1566 Powershell - T1059.001 Process Injection - T1631 Remote Desktop Protocol - T1021.001 Rundll32 - T1218.011 Server - T1583.004 Server - T1584.004 Visual Basic - T1059.005 External Remote Services - T1133 Powershell - T1086 Process Injection - T1055 Remote Desktop Protocol - T1076 Remote Services - T1021 Rundll32 - T1085 External Remote Services
Show in Graph
Common Information
Type Value
UUID f343a41b-d46b-4f07-81d0-e204982181c4
Fingerprint 34398bfe6ae4b3c5
Analysis status DONE
Considered CTI value 0
Text language
Published June 22, 2021, 8:20 a.m.
Added to db Sept. 26, 2022, 9:30 a.m.
Last updated Nov. 17, 2024, 6:55 p.m.
Headline Response When Minutes Matter: Falcon Complete Disrupts WIZARD SPIDER eCrime Operators
Title How Falcon Complete Disrupts eCrime Operators (WIZARD SPIDER)
Detected Hints/Tags/Attributes 79/3/7
Source URLs
Redirection Url
Details Source https://www.crowdstrike.com/blog/how-falcon-complete-disrupts-ecrime-operators-wizard-spider/
URL Provider
Details Provider Source level domain
Details crowdstrike.com www.crowdstrike.com
Attributes
Details Type #Events CTI Value
Details Domain 1 
serviapd.com
Details File 1260 
explorer.exe
Details File 1018 
rundll32.exe
Details File 137 
conhost.exe
Details File 10 
document.docx
Details File 2 
worksheet.xlsx
Details File 23 
test.dll