Overview

overview

10

Static

static

gstabl72.exe

windows7_x64

10

gstabl72.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    gstabl72.exe

  • Size

    848KB

  • Sample

    200704-33pqfjx7dx

  • MD5

    3208a14c9bad334e331febe00f1e9734

  • SHA1

    809fbd450e1a484a5af4ec05c345b2a7072723e7

  • SHA256

    85f391ecd480711401f6da2f371156f995dd5cff7580f37791e79e62b91fd9eb

  • SHA512

    b1460826b0a15e9cf752f001426ae6c9fffe96d01d7ab2802d0843b2c51f3dc1590c9c1f80e26ed9a751e7ac59f584fde4cb937841d5b4ea51a1883302da4029

Score
10/10
wastedlockerdiscoveryexploitpersistenceransomware

Malware Config

Targets

    • Target

      gstabl72.exe

    • Size

      848KB

    • MD5

      3208a14c9bad334e331febe00f1e9734

    • SHA1

      809fbd450e1a484a5af4ec05c345b2a7072723e7

    • SHA256

      85f391ecd480711401f6da2f371156f995dd5cff7580f37791e79e62b91fd9eb

    • SHA512

      b1460826b0a15e9cf752f001426ae6c9fffe96d01d7ab2802d0843b2c51f3dc1590c9c1f80e26ed9a751e7ac59f584fde4cb937841d5b4ea51a1883302da4029

    Score
    10/10
    ransomwarepersistencediscoveryexploitwastedlocker

    • WastedLocker

      Ransomware family seen in the wild since May 2020.

      ransomwarewastedlocker

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Executes dropped EXE

    • Possible privilege escalation attempt

      exploit

    • Deletes itself

    • Loads dropped DLL

    • Modifies file permissions

      discovery

    • Drops file in System32 directory

    • Modifies service

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Hidden Files and Directories

1
T1158

Privilege Escalation

Defense Evasion

File Deletion

2
T1107

File Permissions Modification

1
T1222

Modify Registry

1
T1112

Hidden Files and Directories

1
T1158

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

2
T1490

Tasks