Scenario 02 · Ransomware · E-crime
Most intrusions we replay stop at credential theft or discovery. Wizard Spider — the TrickBot-to-Ryuk crews behind some of the costliest ransomware on record — goes all the way to impact: wreck the backups, kill the defenses, encrypt the estate. We ran a non-destructive subset of that chain by hand on a Windows victim and watched THRONE catch every stage, up to and including the shadow-copy wipe that lands seconds before the encryptor would run.
Wizard Spider (MITRE ATT&CK G0102) is the financially-motivated, Russia-based e-crime group behind the TrickBot banking trojan and the Ryuk and Conti ransomware families — the operators who turned "big game hunting" into an industry. This report replays a deliberately non-destructive slice of their playbook and shows exactly what THRONE saw.
On the Windows victim WIN-J50RP1JBGD4 (204.168.192.149 · internal
10.0.0.5) we hand-executed a credential-access-through-impact chain: dump the SAM
and SYSTEM hives, flip RDP on for lateral movement, plant two persistence footholds, then run the
ransomware finale — stop backup and search services, delete every volume shadow copy, wipe the backup catalog,
disable boot recovery, and simulate the Ryuk encryptor. No production data was ever encrypted.
THRONE detected every stage that generated host telemetry, raised the alert wave as it happened, and — the part that matters in ransomware — ONYX grouped the destructive finale into a single IMPACT incident, INC-55834, reconstructed as a 20-node process tree, before a single file would have been lost. The headline is not that we caught a wiper after the fact; it is that the shadow-copy deletion and the service kills surfaced as one scored incident during the brief window when a SOC can still act.
Seven named detections across four ATT&CK tactics, converging on one impact incident (INC-55834) — zero files encrypted, and the recovery-destruction stage caught first, not last.
To read the telemetry, it helps to know the crew. Wizard Spider is not a nation-state intelligence service — it is a for-profit ransomware enterprise, and its tradecraft is shaped end to end by one goal: get paid.
Attribution. Wizard Spider is the CrowdStrike designation for a Russia-based, financially-motivated e-crime group tracked by MITRE ATT&CK as G0102. It is widely reported to operate as a set of cooperating cells — the TrickBot developers themselves, and the ransomware operators often tracked separately as "Grim Spider" (Ryuk) and under the Mandiant cluster UNC1878 for the 2020 healthcare campaign. The group is credited with the TrickBot botnet, the BazarLoader/Bazar backdoor, the Ryuk ransomware (first observed in 2018) and its successor Conti.
Notable real-world campaigns. This is one of the most consequential e-crime operations on record. Ryuk alone was tied to hundreds of intrusions across 2018–2020. In September 2020 the Ryuk operators hit hospital operator Universal Health Services; in October 2020 a wave of TrickBot/BazarLoader-to-Ryuk intrusions against the US healthcare sector prompted a joint CISA/FBI/HHS advisory (AA20-302A), issued the same month Microsoft and partners moved to disrupt the TrickBot infrastructure. The group's Conti ransomware went on to cripple the Irish Health Service Executive (HSE) in May 2021 and the government of Costa Rica in 2022 — the latter severe enough to trigger a national emergency declaration. When Conti's internal chats and operator playbooks leaked in early 2022, they confirmed in the group's own words the hands-on, LOLBin-heavy tradecraft replayed below.
The pattern is consistent across intrusions and maps cleanly onto ATT&CK. Initial access arrives by phishing (T1566) delivering TrickBot or BazarLoader, which pulls down Cobalt Strike for hands-on-keyboard control. Operators then live off the land: built-in Windows tooling for discovery (T1018 remote system discovery, T1482 domain-trust discovery, T1069.002 domain-group enumeration), Kerberoasting (T1558.003) and hive dumping (T1003) for credentials, and RDP or SMB with PsExec/WMI (T1021.001, T1569.002) to spread. The closing move is always the same: impair the defenses (T1562.001), inhibit recovery (T1490), stop backup and security services (T1489), and only then encrypt for impact (T1486).
Two properties make the group dangerous to defenders, and both drove how we scoped this run. First, speed:
documented Ryuk intrusions have gone from initial foothold to estate-wide encryption in a matter of hours, so detection
has to be near-real-time to matter. Second, living off the land: the destructive finale uses nothing exotic
— reg.exe, vssadmin, wmic, wbadmin, bcdedit,
net.exe, sc.exe — legitimate administrative binaries that no allow-list will block. There
is no novel malware to signature; the signal is in the behavior.
Nothing below is embellished. This section states exactly what we ran, what was simulated, what was left broken on purpose, and the pipeline that turned host activity into a scored incident. IDs, hostnames and severities are shown as captured in a lab environment.
This was a direct-execution run — commands issued by hand on the Windows victim WIN-J50RP1JBGD4 (204.168.192.149 · internal 10.0.0.5), a non-destructive subset of the TrickBot → Ryuk chain. We did not use a real TrickBot implant or a Cobalt Strike beacon; we ran the equivalent on-host techniques directly, because the aim was to exercise the detections, not to rebuild the malware.
The encryption stage was simulated: it dropped dummy files (Q3-report.docx,
payroll.xlsx, customers.mdb), re-encoded them to .ryuk copies with
certutil, and wrote a RyukReadMe.txt ransom note — no real files were encrypted.
We restored the host afterwards: the Run-key and sethc.exe persistence were removed, boot recovery was
re-enabled, and the stopped services were restarted. By design we left exactly one thing broken — the deleted
volume shadow copies — just as a real Ryuk hit would, so the evidence trail stays honest.
The telemetry path was unchanged from every other scenario. Sysmon on the victim emits process-creation, registry and
image-load events; a tenant-tagged syslog stream carries them to THRONE, where they are queued through Kafka, parsed by
ch_pump, and landed in ClickHouse. Detection runs in two layers over that data: a Sigma sweep of
3,148 rules spanning 389 ATT&CK techniques, plus a behavioral engine for sequences no single rule captures.
Matches become alerts; ONYX auto-triages and scores them, correlates related alerts into an incident, and rebuilds that
incident as a causality tree from the Sysmon process GUIDs.
No analyst touched any of it until there was a scored, grouped impact incident with a 20-node process tree waiting.
The subset we executed on WIN-J50RP1JBGD4, by tactic. Each stage generated Windows telemetry that THRONE matched against its Sigma and behavioral detections — and every stage was caught.
The run opens by saving the registry hives that hold Windows credential material to disk, where they can be carried off
and cracked offline — the SAM hive holds the local account password hashes, and the
SYSTEM hive holds the boot key needed to decrypt them.
For a ransomware crew this is the fuel for lateral movement: harvest local hashes, reuse or crack them, and spread to the file servers and backup hosts that make an encryption event estate-wide rather than local.
Next, the chain flips Remote Desktop on by clearing the fDenyTSConnections policy value. Wizard Spider
operators routinely pivot over RDP using the credentials harvested a moment earlier, because interactive RDP looks far
more like a busy administrator than a stream of remote-execution calls.
sethc.exe debugger T1547.001 · T1546.008Two footholds get planted so a reboot or a lost beacon does not cost the operator their access. The first is a classic
HKCU Run-key autostart — here named TrickBot, a nod to the loader the group is known for. The second is
a quieter accessibility-feature backdoor: an Image-File-Execution-Options Debugger value on
sethc.exe (Sticky Keys), so that pressing Shift five times at the lock screen launches
cmd.exe as SYSTEM — a pre-authentication shell on the console.
This is what makes the chain ransomware rather than ordinary intrusion. Before any encryptor runs, the crew destroys the victim's ability to recover and silences anything that might interrupt. Services that lock files or restore data are stopped (T1489); every volume shadow copy, the backup catalog, and the Windows boot recovery options are wiped (T1490); and only then does the encryptor — here simulated — run and drop its note (T1486).
The shadow-copy deletion is the single most important event in the whole run. It is the moment the victim loses the cheap path to recovery, and it happens before the files are gone — which is precisely why it is the signal a SOC must act on.
For completeness: the full emulation also ran Wizard Spider's slower domain-reconnaissance tail — domain
controller discovery with nltest (T1018), Kerberoast SPN enumeration with
setspn (T1558.003), Domain Admins enumeration with net group
(T1069.002), and an unsecured-credentials file search with findstr
(T1552.001). This report concentrates on the credential-access-to-impact spine that built the
incident; the recon tail is noted here so the picture stays honest, not padded with claims.
The alert wave from this one run, all on WIN-J50RP1JBGD4. Severity and ATT&CK mapping are shown exactly as THRONE assigned them.
| Alert | Detection | Sev | ATT&CK |
|---|---|---|---|
| ALR-175431 | Shadow Copies Deletion Using OS Utilities | HIGH | T1490 |
| ALR-175429 | Suspicious Debugger Registration (sethc backdoor) | HIGH | T1546.008 |
| ALR-175434 | Tampering With RDP Registry Keys Via Reg.EXE | HIGH | T1021.001 |
| ALR-175428 | Dumping of Sensitive Hives Via Reg.EXE | HIGH | T1003.002 |
| ALR-175437 | AV Signature Keywords in App Log (Defender caught the ransomware) | HIGH | — |
| ALR-175433/5 | Stop Windows Service Via Net.EXE / Sc.EXE | LOW | T1489 |
| ALR-175427 | Persistence Attempt Via Run Keys Using Reg.EXE | MED | T1547.001 |
The alert stream named the exact tooling: reg.exe saving the SAM and SYSTEM
hives, reg.exe writes to the RDP and Run keys, the sethc.exe Image-File-Execution-Options
debugger trick, vssadmin shadow-copy deletion, and net.exe / sc.exe stopping
backup and AV services — the Wizard Spider pre-encryption routine, caught step by step. Below, the detections that
carry the most defensive weight, and how ONYX handled each.
The Sigma rule keys on OS recovery-inhibition utilities invoked with their destructive arguments —
vssadmin delete shadows, wmic shadowcopy delete, wbadmin delete catalog, and
bcdedit turning recovery off. It maps to T1490 (Inhibit System Recovery). ONYX
scored it HIGH and treated it as the anchor of the impact incident: in a ransomware context this is the detection that
most reliably precedes encryption, so it is weighted to surface immediately rather than wait for correlation.
This rule keys on reg.exe save (or reg export) targeting HKLM\SAM,
HKLM\SYSTEM or HKLM\SECURITY — the hives that together yield local credential material.
It maps to T1003.002 (OS Credential Dumping: Security Account Manager). ONYX scored it HIGH as a
credential-access event and tied it to the same actor process lineage, establishing early intent before the destructive
stage even began.
The rule fires on a write to an Image File Execution Options\...\Debugger value for an accessibility
binary such as sethc.exe, utilman.exe or osk.exe — a hijack that grants a
SYSTEM shell from the lock screen. It maps to T1546.008 (Event Triggered Execution:
Accessibility Features). Because a legitimate reason to set this value is almost non-existent, ONYX scored it HIGH on
sight rather than deferring to behavioral context.
This detection keys on reg.exe clearing fDenyTSConnections under the Terminal Server policy
key — programmatically enabling inbound RDP. It maps to T1021.001 (Remote Services: Remote
Desktop Protocol). ONYX scored it HIGH as lateral-movement preparation; combined with the hive dump moments earlier, it
reads as an operator setting up to pivot with freshly stolen credentials.
The last detection is the defender's own corroboration: Windows Defender quarantined the dropped Ryuk-style artifacts and recorded signature keywords in the Application event log, which THRONE picked up as a HIGH alert. It has no single clean ATT&CK technique — it is the security product reacting rather than the adversary acting — but it independently confirms that the simulated encryptor's files looked malicious enough to trip endpoint AV, strengthening the case built by the behavioral detections.
In ransomware, the detections that count are the ones that fire before encryption completes.
THRONE rebuilds causality from the Sysmon process GUIDs on every event — stitching each child process back to its
parent through the ProcessGuid/ParentProcessGuid pair — so related alerts are not a flat
list but a tree that shows how the attack actually unfolded.
INC-55834 is the result: a 20-node process tree that captures the pre-encryption window
in full. Three destructive binaries sit at the roots — vssadmin.exe, net.exe and
sc.exe — each traced back through the cmd.exe session that launched it, and alongside them
the registry and recovery children the same session spawned: reg.exe writing the persistence and RDP keys,
wmic.exe and wbadmin.exe and bcdedit.exe finishing off recovery, and
certutil.exe standing in for the encryptor. Read top to bottom, the tree is the attack: the moment
the adversary destroys the backups and clears the defenses so the encryptor can run unopposed. A SOC that acts on
INC-55834 acts before the files are lost.
Because the whole incident is one causality tree rather than seven disconnected alerts, an analyst opening INC-55834 sees the lineage at a glance — which process issued the shadow-copy deletion, what it did immediately before, and what it did next — instead of reassembling the story from a scrolling alert feed while the clock runs.
Everything about ransomware response comes down to one question: did you see the destructive stage while you could still act on it, or did you learn about it from the ransom note?
Wizard Spider exercised the impact tactic that discovery-and-evasion intrusions never reach. Impact is where ransomware does its damage — deleting shadow copies, killing backup and AV services, then encrypting. It is exactly the ransomware-specific destruction a SOC has to catch before files are encrypted, and it is the stage THRONE surfaced first.
Three things make this adversary genuinely hard to defend against, and this run exercised all of them. The first is speed: the finale is a handful of commands that execute in seconds, so any detection that depends on a human noticing a trend will lose the race. The second is legitimacy: every destructive step uses a signed, built-in Windows binary that administrators also use, so blocking the tools is not an option — only the behavior distinguishes an admin clearing disk space from an operator wiping recovery. The third is sequencing: the group deliberately impairs defenses and destroys backups first, so by the time the obvious symptom (encrypted files) appears, the cheap path to recovery is already gone. Detection therefore has to land on the quiet, early, recovery-inhibition steps — which is exactly where THRONE anchored INC-55834.
Four concrete recommendations that fall directly out of the run — applicable whether or not you run THRONE.
Alert on the recovery-destruction LOLBins — vssadmin delete shadows,
wmic shadowcopy delete, wbadmin delete catalog, and bcdedit disabling recovery
— and route them as incidents, not informational events. Shadow-copy deletion on a normal endpoint is almost never
legitimate, and it is the most reliable early warning you will get.
Monitor reg.exe saving the SAM/SYSTEM hives, writes to
fDenyTSConnections, and any Image File Execution Options\...\Debugger value on an accessibility
binary. These edits have crisp, rarely-legitimate signatures and together cover credential theft, lateral-movement prep,
and persistence.
One reconstructed process tree beats a feed of disconnected alerts. Group related detections into a single incident by process lineage so the analyst inherits the story rather than rebuilding it, and measure your response time against the pre-encryption window — the minutes between the first shadow-copy deletion and the encryptor — not against mean-time-to-acknowledge.
Because the shadow copies and backup catalog are deleted by design, on-box recovery is the first thing a competent crew destroys. Keep offline or immutable backups, constrain RDP with least privilege and network segmentation, and rehearse restoring from a copy the attacker could not reach from the victim host.