Overview

overview

10

Static

static

30af561ec0...d0.exe

windows7_x64

10

30af561ec0...d0.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    30af561ec0b6d4a37654f9838750abde60d0d38e2370bb250007eb946425add0

  • Size

    1.2MB

  • Sample

    200729-xd76xeexns

  • MD5

    14e610e2acb5f15e72f528b385f3e20f

  • SHA1

    749b5283028a6f2c9df529eb14e051a5bf620f25

  • SHA256

    30af561ec0b6d4a37654f9838750abde60d0d38e2370bb250007eb946425add0

  • SHA512

    6d8d42e65b5bb09aaaf3c0cf103e7b97ebdc593065f1ecd3e3cd7c5d0a289d93867d617ac3b69c126a754f6f37cfd1867e12822004169077e4eafeb40a79f90a

Score
10/10
wastedlockerdiscoveryexploitpersistenceransomware

Malware Config

Targets

    • Target

      30af561ec0b6d4a37654f9838750abde60d0d38e2370bb250007eb946425add0

    • Size

      1.2MB

    • MD5

      14e610e2acb5f15e72f528b385f3e20f

    • SHA1

      749b5283028a6f2c9df529eb14e051a5bf620f25

    • SHA256

      30af561ec0b6d4a37654f9838750abde60d0d38e2370bb250007eb946425add0

    • SHA512

      6d8d42e65b5bb09aaaf3c0cf103e7b97ebdc593065f1ecd3e3cd7c5d0a289d93867d617ac3b69c126a754f6f37cfd1867e12822004169077e4eafeb40a79f90a

    Score
    10/10
    ransomwarediscoveryexploitwastedlockerpersistence

    • WastedLocker

      Ransomware family seen in the wild since May 2020.

      ransomwarewastedlocker

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Executes dropped EXE

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Possible privilege escalation attempt

      exploit

    • Deletes itself

    • Loads dropped DLL

    • Modifies file permissions

      discovery

    • Drops file in System32 directory

    • Modifies service

      persistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks