wastedlocker | 85f391ecd480711401f6da2f371156f995dd5cff7580f37791e79e62b91fd9eb

General

Target

gstabl72.exe
Size

848KB
MD5

3208a14c9bad334e331febe00f1e9734
SHA1

809fbd450e1a484a5af4ec05c345b2a7072723e7
SHA256

85f391ecd480711401f6da2f371156f995dd5cff7580f37791e79e62b91fd9eb
SHA512

b1460826b0a15e9cf752f001426ae6c9fffe96d01d7ab2802d0843b2c51f3dc1590c9c1f80e26ed9a751e7ac59f584fde4cb937841d5b4ea51a1883302da4029

Score

10^/10

ransomware wastedlocker persistence discovery exploit

Malware Config

Signatures

NTFS ADS 1 IoCs

Processes:

gstabl72.exe

description ioc process

File opened for modification C:\Users\Admin\AppData\Roaming\Installers:bin gstabl72.exe
WastedLocker
Ransomware family seen in the wild since May 2020.
ransomware wastedlocker

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Installers:bin	gstabl72.exe

Modifies service 2 TTPs 5 IoCs

persistence

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

vssvc.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer	vssvc.exe

Modifies file permissions 1 TTPs 2 IoCs
discovery

File Permissions Modification
T1222

Processes:

takeown.exeicacls.exe

pid process

2680 takeown.exe
3720 icacls.exe
Possible privilege escalation attempt 2 IoCs
exploit

Processes:

takeown.exeicacls.exe

pid process

2680 takeown.exe
3720 icacls.exe

pid	process
2680	takeown.exe
3720	icacls.exe

pid	process
2680	takeown.exe
3720	icacls.exe

Suspicious use of WriteProcessMemory 38 IoCs

Processes:

gstabl72.exeInstallers:binInstallers.execmd.execmd.execmd.exe

description	pid	process	target process
PID 992 wrote to memory of 1796	992	gstabl72.exe	Installers:bin
PID 992 wrote to memory of 1796	992	gstabl72.exe	Installers:bin
PID 992 wrote to memory of 1796	992	gstabl72.exe	Installers:bin
PID 1796 wrote to memory of 1808	1796	Installers:bin	vssadmin.exe
PID 1796 wrote to memory of 1808	1796	Installers:bin	vssadmin.exe
PID 1796 wrote to memory of 2680	1796	Installers:bin	takeown.exe
PID 1796 wrote to memory of 2680	1796	Installers:bin	takeown.exe
PID 1796 wrote to memory of 2680	1796	Installers:bin	takeown.exe
PID 1796 wrote to memory of 3720	1796	Installers:bin	icacls.exe
PID 1796 wrote to memory of 3720	1796	Installers:bin	icacls.exe
PID 1796 wrote to memory of 3720	1796	Installers:bin	icacls.exe
PID 4064 wrote to memory of 1732	4064	Installers.exe	cmd.exe
PID 4064 wrote to memory of 1732	4064	Installers.exe	cmd.exe
PID 4064 wrote to memory of 1732	4064	Installers.exe	cmd.exe
PID 1732 wrote to memory of 2988	1732	cmd.exe	choice.exe
PID 1732 wrote to memory of 2988	1732	cmd.exe	choice.exe
PID 1732 wrote to memory of 2988	1732	cmd.exe	choice.exe
PID 1796 wrote to memory of 3520	1796	Installers:bin	cmd.exe
PID 1796 wrote to memory of 3520	1796	Installers:bin	cmd.exe
PID 1796 wrote to memory of 3520	1796	Installers:bin	cmd.exe
PID 992 wrote to memory of 3740	992	gstabl72.exe	cmd.exe
PID 992 wrote to memory of 3740	992	gstabl72.exe	cmd.exe
PID 992 wrote to memory of 3740	992	gstabl72.exe	cmd.exe
PID 3520 wrote to memory of 3616	3520	cmd.exe	choice.exe
PID 3520 wrote to memory of 3616	3520	cmd.exe	choice.exe
PID 3520 wrote to memory of 3616	3520	cmd.exe	choice.exe
PID 3740 wrote to memory of 1916	3740	cmd.exe	choice.exe
PID 3740 wrote to memory of 1916	3740	cmd.exe	choice.exe
PID 3740 wrote to memory of 1916	3740	cmd.exe	choice.exe
PID 1732 wrote to memory of 796	1732	cmd.exe	attrib.exe
PID 1732 wrote to memory of 796	1732	cmd.exe	attrib.exe
PID 1732 wrote to memory of 796	1732	cmd.exe	attrib.exe
PID 3520 wrote to memory of 2040	3520	cmd.exe	attrib.exe
PID 3520 wrote to memory of 2040	3520	cmd.exe	attrib.exe
PID 3520 wrote to memory of 2040	3520	cmd.exe	attrib.exe
PID 3740 wrote to memory of 4004	3740	cmd.exe	attrib.exe
PID 3740 wrote to memory of 4004	3740	cmd.exe	attrib.exe
PID 3740 wrote to memory of 4004	3740	cmd.exe	attrib.exe

Executes dropped EXE 2 IoCs

Processes:

Installers:binInstallers.exe

pid process

1796 Installers:bin
4064 Installers.exe
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

1808 vssadmin.exe

pid	process
1796	Installers:bin
4064	Installers.exe

pid	process
1808	vssadmin.exe

Drops file in System32 directory 2 IoCs

Processes:

Installers:binattrib.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\Installers.exe	Installers:bin
File opened for modification	C:\Windows\SysWOW64\Installers.exe	attrib.exe

Views/modifies file attributes 1 TTPs 3 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exeattrib.exeattrib.exe

pid process

4004 attrib.exe
796 attrib.exe
2040 attrib.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

vssvc.exe

description pid process

Token: SeBackupPrivilege 1632 vssvc.exe
Token: SeRestorePrivilege 1632 vssvc.exe
Token: SeAuditPrivilege 1632 vssvc.exe
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

pid	process
4004	attrib.exe
796	attrib.exe
2040	attrib.exe

description	pid	process
Token: SeBackupPrivilege	1632	vssvc.exe
Token: SeRestorePrivilege	1632	vssvc.exe
Token: SeAuditPrivilege	1632	vssvc.exe

C:\Users\Admin\AppData\Local\Temp\gstabl72.exe
"C:\Users\Admin\AppData\Local\Temp\gstabl72.exe"
1⤵
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:992

C:\Users\Admin\AppData\Roaming\Installers:bin
C:\Users\Admin\AppData\Roaming\Installers:bin -r
2⤵
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
- Drops file in System32 directory
PID:1796

C:\Windows\system32\vssadmin.exe
C:\Windows\system32\vssadmin.exe Delete Shadows /All /Quiet
3⤵
- Interacts with shadow copies
PID:1808

C:\Windows\SysWOW64\takeown.exe
C:\Windows\system32\takeown.exe /F C:\Windows\system32\Installers.exe
3⤵
- Modifies file permissions
- Possible privilege escalation attempt
PID:2680

C:\Windows\SysWOW64\icacls.exe
C:\Windows\system32\icacls.exe C:\Windows\system32\Installers.exe /reset
3⤵
- Modifies file permissions
- Possible privilege escalation attempt
PID:3720

C:\Windows\SysWOW64\cmd.exe
cmd /c choice /t 10 /d y & attrib -h "C:\Users\Admin\AppData\Roaming\Installers" & del "C:\Users\Admin\AppData\Roaming\Installers"
3⤵
- Suspicious use of WriteProcessMemory
PID:3520

C:\Windows\SysWOW64\choice.exe
choice /t 10 /d y
4⤵
PID:3616

C:\Windows\SysWOW64\attrib.exe
attrib -h "C:\Users\Admin\AppData\Roaming\Installers"
4⤵
- Views/modifies file attributes
PID:2040

C:\Windows\SysWOW64\cmd.exe
cmd /c choice /t 10 /d y & attrib -h "C:\Users\Admin\AppData\Local\Temp\gstabl72.exe" & del "C:\Users\Admin\AppData\Local\Temp\gstabl72.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:3740

C:\Windows\SysWOW64\choice.exe
choice /t 10 /d y
3⤵
PID:1916

C:\Windows\SysWOW64\attrib.exe
attrib -h "C:\Users\Admin\AppData\Local\Temp\gstabl72.exe"
3⤵
- Views/modifies file attributes
PID:4004

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Modifies service
- Suspicious use of AdjustPrivilegeToken
PID:1632

C:\Windows\SysWOW64\Installers.exe
C:\Windows\SysWOW64\Installers.exe -s
1⤵
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
PID:4064

C:\Windows\SysWOW64\cmd.exe
cmd /c choice /t 10 /d y & attrib -h "C:\Windows\SysWOW64\Installers.exe" & del "C:\Windows\SysWOW64\Installers.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1732

C:\Windows\SysWOW64\choice.exe
choice /t 10 /d y
3⤵
PID:2988

C:\Windows\SysWOW64\attrib.exe
attrib -h "C:\Windows\SysWOW64\Installers.exe"
3⤵
- Drops file in System32 directory
- Views/modifies file attributes
PID:796