General

  • Target

    5cd04805f9753ca08b82e88c27bf5426d1d356bb26b281885573051048911367

  • Size

    1.0MB

  • Sample

    200630-4c15pqp39n

  • MD5

    572fea5f025df78f2d316216fbeee52e

  • SHA1

    91b2bf44b1f9282c09f07f16631deaa3ad9d956d

  • SHA256

    5cd04805f9753ca08b82e88c27bf5426d1d356bb26b281885573051048911367

  • SHA512

    eb238272227c5825477ff1e37dc4f7e467665049d4db5649fff59c39d7745e88b06234d6d1218c05c802e33e21577f9d4a533cb9e23ebe6fb09654f97759c187

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\PushSend.aifc.txt

Family

wastedlocker

Ransom Note
RL Hudson YOUR NETWORK IS ENCRYPTED NOW USE 84550@PROTONMAIL.CH | 67146@ECLIPSO.CH TO GET THE PRICE FOR YOUR DATA DO NOT GIVE THIS EMAIL TO 3RD PARTIES DO NOT RENAME OR MOVE THE FILE THE FILE IS ENCRYPTED WITH THE FOLLOWING KEY: [begin_key]gwZBEAvEP2FqvUvL47sPJ45/yVBX4Yw3mjqRxsUH0eMigNwvIjy5CGS3jZvjAOCL 4qNHA6uQpH6xp7nlGPojecVwtbE0PQ0AzWqjLF+rhmBximG1pC3sSVp5otVCqnGf wLAA0ArD1ifoCS71IGZr6FKtP7z+pQj862fG9ev4IeRiLvRyjwCTp3ZbebV6i6qp 7Z9ICPUDH+Io9kKf1M+x4DMNFvobtTrDfG4OyvlSflIjOLMIKs7t797AYMPIQBXf IU8n6jN526XpohETzyhEzp/pnSTU7gm3Rewzo4Om6H47yqnpiqvi2dK5TZ46e4Hb geBNBiMp/+f9ym6TIPAHoaZ4v9HyxkyY4Dw2Pwx6zWkWs5A7+LvG3GfAetF1kgf+ 6/dMG7chAu9cfVVOTr2W5rSyncUW9mZiVc96hRIXbFB23DTIMXDU1lnp4b0E2stu mCcASWt4SvEAC6xmDNu4OZFyMJ9Y/hTCOniStc0b+V1zJAgPE0oOl34IX2O2mPxi rDQEp1KbGbjGkaIybaT+aN2i55FQpbxiRsKARv8XXJuQqe5kOuF1Avu+zRSgAEu3 fJPttM5dyIIm7QRUHJSb47GgIoEVbvHepw4RYtQugkWhJSsHg9yrmnugS+ezCWJM 8saesPbsb/xZSNpNI7/keZX0X6ZHCyfax8NvQiqPKo2=[end_key] KEEP IT
Emails

84550@PROTONMAIL.CH

67146@ECLIPSO.CH

Extracted

Path

C:\Users\Admin\Desktop\GetStep.vsdm.txt

Family

wastedlocker

Ransom Note
RL Hudson YOUR NETWORK IS ENCRYPTED NOW USE 84550@PROTONMAIL.CH | 67146@ECLIPSO.CH TO GET THE PRICE FOR YOUR DATA DO NOT GIVE THIS EMAIL TO 3RD PARTIES DO NOT RENAME OR MOVE THE FILE THE FILE IS ENCRYPTED WITH THE FOLLOWING KEY: [begin_key]AMMvvfBFxT/SglXwsLFjZfsgxAjEV7S7t5/+VLJYw1FBbOlJsOekbqf7oZ+5zjU+ CUpP2x0iyK7XixJd/mJ4lg2JeoEgCTsv/1gneuN4XxuHByhenCVYmso9x/ZV//el /gOj+1rfzvI1MwDu2fg2VlXiBJPb25Lr620RyEcmhUen/WIuhy2Wd11OT3M0Wvy5 yVi4jN1gjIiTnF/ctyNlcebIeouD4pUAKBZHWM1GfIXzjqPLiSnD/4hL/+kdXLO5 Q/aEWpsfvgdtVMysBVACIx9XMzbnFIAVGId4t72opfD/RSoSNlHIRzTxVWMdKrhO 4xzfpALd/WN2PaGrRK+eZYE5CVVnJ+pl9xWMuDyC0A48vJ2Lq2w+5ItQvMxNoX8U ZhfJOjt6SCJJ88g5fWy5Evhn/NxIlrIDZoIoy9FkGu6gv6euJooNWWm/DqbliB72 i8vdNJLrQKC1hVqi1Ofsecmb85XE+GRVpOFmQ6U1fvN6fjNpPONcs8KBCj396S98 auTiSjEbfNayu+LoMCeWglULtF4knXs5ZY8eNMr65PQol90eD4mx8KpD8AuZSyGy /BQirSkE/Ed2BzULpE1U0Bqnmryqeg31mu8Zg64MqoFOaGH8YngjdJ4qYROwzkmP +aaodiaPHV9dz3SJLyGwVVTymX7O88HUyn/dMAh/p4x=[end_key] KEEP IT
Emails

84550@PROTONMAIL.CH

67146@ECLIPSO.CH

Targets

    • Target

      5cd04805f9753ca08b82e88c27bf5426d1d356bb26b281885573051048911367

    • Size

      1.0MB

    • MD5

      572fea5f025df78f2d316216fbeee52e

    • SHA1

      91b2bf44b1f9282c09f07f16631deaa3ad9d956d

    • SHA256

      5cd04805f9753ca08b82e88c27bf5426d1d356bb26b281885573051048911367

    • SHA512

      eb238272227c5825477ff1e37dc4f7e467665049d4db5649fff59c39d7745e88b06234d6d1218c05c802e33e21577f9d4a533cb9e23ebe6fb09654f97759c187

    • WastedLocker

      Ransomware family seen in the wild since May 2020.

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Executes dropped EXE

    • Possible privilege escalation attempt

    • Deletes itself

    • Loads dropped DLL

    • Modifies file permissions

    • Drops file in System32 directory

    • Modifies service

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Modify Existing Service

1
T1031

Hidden Files and Directories

1
T1158

Defense Evasion

File Deletion

2
T1107

File Permissions Modification

1
T1222

Modify Registry

1
T1112

Hidden Files and Directories

1
T1158

Impact

Inhibit System Recovery

2
T1490

Tasks