wastedlocker | 30af561ec0b6d4a37654f9838750abde60d0d38e2370bb250007eb946425add0

Analysis

max time kernel
145s
max time network
60s
platform
windows10_x64
resource
win10v200722
submitted
29-07-2020 07:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

30af561ec0b6d4a37654f9838750abde60d0d38e2370bb250007eb946425add0.exe
Size

1.2MB
MD5

14e610e2acb5f15e72f528b385f3e20f
SHA1

749b5283028a6f2c9df529eb14e051a5bf620f25
SHA256

30af561ec0b6d4a37654f9838750abde60d0d38e2370bb250007eb946425add0
SHA512

6d8d42e65b5bb09aaaf3c0cf103e7b97ebdc593065f1ecd3e3cd7c5d0a289d93867d617ac3b69c126a754f6f37cfd1867e12822004169077e4eafeb40a79f90a

Score

10^/10

discovery exploit ransomware persistence wastedlocker

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeBackupPrivilege	1076	vssvc.exe
Token: SeRestorePrivilege	1076	vssvc.exe
Token: SeAuditPrivilege	1076	vssvc.exe

Interacts with shadow copies 2 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1107

Inhibit System Recovery

T1490

pid	Process
912	vssadmin.exe

WastedLocker
Ransomware family seen in the wild since May 2020.
ransomware wastedlocker

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
424	30af561ec0b6d4a37654f9838750abde60d0d38e2370bb250007eb946425add0.exe
672	Locker:bin
2324	Locker.exe

Executes dropped EXE 2 IoCs

pid	Process
672	Locker:bin
2324	Locker.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Locker.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Locker.exe	Locker:bin

Possible privilege escalation attempt 2 IoCs

exploit

pid	Process
1488	takeown.exe
1796	icacls.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs

pid	Process
424	30af561ec0b6d4a37654f9838750abde60d0d38e2370bb250007eb946425add0.exe
424	30af561ec0b6d4a37654f9838750abde60d0d38e2370bb250007eb946425add0.exe
672	Locker:bin
672	Locker:bin
2324	Locker.exe
424	30af561ec0b6d4a37654f9838750abde60d0d38e2370bb250007eb946425add0.exe
2324	Locker.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1488	takeown.exe
1796	icacls.exe

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 424 wrote to memory of 672	424	30af561ec0b6d4a37654f9838750abde60d0d38e2370bb250007eb946425add0.exe	66
PID 424 wrote to memory of 672	424	30af561ec0b6d4a37654f9838750abde60d0d38e2370bb250007eb946425add0.exe	66
PID 424 wrote to memory of 672	424	30af561ec0b6d4a37654f9838750abde60d0d38e2370bb250007eb946425add0.exe	66
PID 672 wrote to memory of 912	672	Locker:bin	67
PID 672 wrote to memory of 912	672	Locker:bin	67
PID 672 wrote to memory of 1488	672	Locker:bin	71
PID 672 wrote to memory of 1488	672	Locker:bin	71
PID 672 wrote to memory of 1488	672	Locker:bin	71
PID 672 wrote to memory of 1796	672	Locker:bin	73
PID 672 wrote to memory of 1796	672	Locker:bin	73
PID 672 wrote to memory of 1796	672	Locker:bin	73
PID 2324 wrote to memory of 764	2324	Locker.exe	79
PID 2324 wrote to memory of 764	2324	Locker.exe	79
PID 2324 wrote to memory of 764	2324	Locker.exe	79
PID 764 wrote to memory of 3564	764	cmd.exe	81
PID 764 wrote to memory of 3564	764	cmd.exe	81
PID 764 wrote to memory of 3564	764	cmd.exe	81
PID 672 wrote to memory of 3084	672	Locker:bin	83
PID 672 wrote to memory of 3084	672	Locker:bin	83
PID 672 wrote to memory of 3084	672	Locker:bin	83
PID 424 wrote to memory of 3104	424	30af561ec0b6d4a37654f9838750abde60d0d38e2370bb250007eb946425add0.exe	84
PID 424 wrote to memory of 3104	424	30af561ec0b6d4a37654f9838750abde60d0d38e2370bb250007eb946425add0.exe	84
PID 424 wrote to memory of 3104	424	30af561ec0b6d4a37654f9838750abde60d0d38e2370bb250007eb946425add0.exe	84
PID 3104 wrote to memory of 4016	3104	cmd.exe	88
PID 3104 wrote to memory of 4016	3104	cmd.exe	88
PID 3104 wrote to memory of 4016	3104	cmd.exe	88
PID 3084 wrote to memory of 3720	3084	cmd.exe	89
PID 3084 wrote to memory of 3720	3084	cmd.exe	89
PID 3084 wrote to memory of 3720	3084	cmd.exe	89
PID 764 wrote to memory of 492	764	cmd.exe	91
PID 764 wrote to memory of 492	764	cmd.exe	91
PID 764 wrote to memory of 492	764	cmd.exe	91
PID 3104 wrote to memory of 344	3104	cmd.exe	93
PID 3104 wrote to memory of 344	3104	cmd.exe	93
PID 3104 wrote to memory of 344	3104	cmd.exe	93
PID 3084 wrote to memory of 392	3084	cmd.exe	94
PID 3084 wrote to memory of 392	3084	cmd.exe	94
PID 3084 wrote to memory of 392	3084	cmd.exe	94

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Locker:bin	30af561ec0b6d4a37654f9838750abde60d0d38e2370bb250007eb946425add0.exe

Views/modifies file attributes 1 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1158

pid	Process
344	attrib.exe
392	attrib.exe
492	attrib.exe

Modifies service 2 TTPs 5 IoCs

persistence

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer	vssvc.exe

Modifies extensions of user files 24 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

description	ioc	Process
File renamed	C:\Users\Admin\Pictures\GetLimit.png => C:\Users\Admin\Pictures\GetLimit.png.garminwasted	Locker.exe
File opened for modification	C:\Users\Admin\Pictures\GetLimit.png.garminwasted	Locker.exe
File created	C:\Users\Admin\Pictures\InstallBackup.tiff.garminwasted_info	Locker.exe
File created	C:\Users\Admin\Pictures\RevokeBackup.tiff.garminwasted_info	Locker.exe
File opened for modification	C:\Users\Admin\Pictures\WatchLock.tiff.garminwasted	Locker.exe
File created	C:\Users\Admin\Pictures\JoinDisconnect.tif.garminwasted_info	Locker.exe
File renamed	C:\Users\Admin\Pictures\MountRead.tiff => C:\Users\Admin\Pictures\MountRead.tiff.garminwasted	Locker.exe
File renamed	C:\Users\Admin\Pictures\RedoUnprotect.tiff => C:\Users\Admin\Pictures\RedoUnprotect.tiff.garminwasted	Locker.exe
File opened for modification	C:\Users\Admin\Pictures\RevokeBackup.tiff.garminwasted	Locker.exe
File created	C:\Users\Admin\Pictures\WatchLock.tiff.garminwasted_info	Locker.exe
File renamed	C:\Users\Admin\Pictures\WatchLock.tiff => C:\Users\Admin\Pictures\WatchLock.tiff.garminwasted	Locker.exe
File opened for modification	C:\Users\Admin\Pictures\RedoUnprotect.tiff.garminwasted	Locker.exe
File created	C:\Users\Admin\Pictures\GetLimit.png.garminwasted_info	Locker.exe
File renamed	C:\Users\Admin\Pictures\JoinDisconnect.tif => C:\Users\Admin\Pictures\JoinDisconnect.tif.garminwasted	Locker.exe
File created	C:\Users\Admin\Pictures\MountRead.tiff.garminwasted_info	Locker.exe
File renamed	C:\Users\Admin\Pictures\PopSwitch.crw => C:\Users\Admin\Pictures\PopSwitch.crw.garminwasted	Locker.exe
File opened for modification	C:\Users\Admin\Pictures\PopSwitch.crw.garminwasted	Locker.exe
File created	C:\Users\Admin\Pictures\RedoUnprotect.tiff.garminwasted_info	Locker.exe
File renamed	C:\Users\Admin\Pictures\InstallBackup.tiff => C:\Users\Admin\Pictures\InstallBackup.tiff.garminwasted	Locker.exe
File opened for modification	C:\Users\Admin\Pictures\JoinDisconnect.tif.garminwasted	Locker.exe
File opened for modification	C:\Users\Admin\Pictures\InstallBackup.tiff.garminwasted	Locker.exe
File opened for modification	C:\Users\Admin\Pictures\MountRead.tiff.garminwasted	Locker.exe
File created	C:\Users\Admin\Pictures\PopSwitch.crw.garminwasted_info	Locker.exe
File renamed	C:\Users\Admin\Pictures\RevokeBackup.tiff => C:\Users\Admin\Pictures\RevokeBackup.tiff.garminwasted	Locker.exe

C:\Users\Admin\AppData\Local\Temp\30af561ec0b6d4a37654f9838750abde60d0d38e2370bb250007eb946425add0.exe
"C:\Users\Admin\AppData\Local\Temp\30af561ec0b6d4a37654f9838750abde60d0d38e2370bb250007eb946425add0.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
- NTFS ADS
PID:424
- C:\Users\Admin\AppData\Roaming\Locker:bin
  C:\Users\Admin\AppData\Roaming\Locker:bin -r
  2⤵
  - Suspicious use of SetWindowsHookEx
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of WriteProcessMemory
  PID:672
- - C:\Windows\system32\vssadmin.exe
    C:\Windows\system32\vssadmin.exe Delete Shadows /All /Quiet
    3⤵
    - Interacts with shadow copies
    PID:912
- - C:\Windows\SysWOW64\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\system32\Locker.exe
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1488
- - C:\Windows\SysWOW64\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\system32\Locker.exe /reset
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1796
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c choice /t 10 /d y & attrib -h "C:\Users\Admin\AppData\Roaming\Locker" & del "C:\Users\Admin\AppData\Roaming\Locker"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3084
  - - C:\Windows\SysWOW64\choice.exe
      choice /t 10 /d y
      4⤵
      PID:3720
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -h "C:\Users\Admin\AppData\Roaming\Locker"
      4⤵
      Views/modifies file attributes
      PID:392
- C:\Windows\SysWOW64\cmd.exe
  cmd /c choice /t 10 /d y & attrib -h "C:\Users\Admin\AppData\Local\Temp\30af561ec0b6d4a37654f9838750abde60d0d38e2370bb250007eb946425add0.exe" & del "C:\Users\Admin\AppData\Local\Temp\30af561ec0b6d4a37654f9838750abde60d0d38e2370bb250007eb946425add0.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3104
- - C:\Windows\SysWOW64\choice.exe
    choice /t 10 /d y
    3⤵
    PID:4016
- - C:\Windows\SysWOW64\attrib.exe
    attrib -h "C:\Users\Admin\AppData\Local\Temp\30af561ec0b6d4a37654f9838750abde60d0d38e2370bb250007eb946425add0.exe"
    3⤵
    - Views/modifies file attributes
    PID:344

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
- Modifies service
PID:1076

C:\Windows\SysWOW64\Locker.exe
C:\Windows\SysWOW64\Locker.exe -s
1⤵
- Suspicious use of SetWindowsHookEx
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
- Modifies extensions of user files
PID:2324
- C:\Windows\SysWOW64\cmd.exe
  cmd /c choice /t 10 /d y & attrib -h "C:\Windows\SysWOW64\Locker.exe" & del "C:\Windows\SysWOW64\Locker.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:764
- - C:\Windows\SysWOW64\choice.exe
    choice /t 10 /d y
    3⤵
    PID:3564
- - C:\Windows\SysWOW64\attrib.exe
    attrib -h "C:\Windows\SysWOW64\Locker.exe"
    3⤵
    - Drops file in System32 directory
    - Views/modifies file attributes
    PID:492

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

File Deletion

T1107

File and Directory Permissions Modification

T1222

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

memory/424-1-0x0000000003100000-0x0000000003101000-memory.dmp

Filesize
4KB

Download
memory/424-0-0x0000000003000000-0x0000000003001000-memory.dmp

Filesize
4KB

Download
memory/672-5-0x0000000002F40000-0x0000000002F41000-memory.dmp

Filesize
4KB

Download
memory/2324-12-0x0000000001AD0000-0x0000000001AD1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads