Overview

overview

10

Static

static

7de4252387...in.exe

windows7_x64

10

7de4252387...in.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7de425238719622bf2b2150591631b0a71d6a5dade419a4e67b9bdbfa272b559.bin

  • Size

    58KB

  • Sample

    201103-6xk2xkf61j

  • MD5

    432a1dd2d40e5b0f6385096847efd3b2

  • SHA1

    f5735932baf8b04a8e1ca622ff06d37a9db29d9f

  • SHA256

    7de425238719622bf2b2150591631b0a71d6a5dade419a4e67b9bdbfa272b559

  • SHA512

    0d713fa5ca52322ea2295d305adbcecc83aaf6b46024987a483112fbbc4c47db6695d0e019b7e68f1a8fe53ff4cbbb4010a981a3fa91eb9be42ebccc75118c1e

Score
10/10
wastedlockerdiscoveryexploitpersistenceransomware

Malware Config

Targets

    • Target

      7de425238719622bf2b2150591631b0a71d6a5dade419a4e67b9bdbfa272b559.bin

    • Size

      58KB

    • MD5

      432a1dd2d40e5b0f6385096847efd3b2

    • SHA1

      f5735932baf8b04a8e1ca622ff06d37a9db29d9f

    • SHA256

      7de425238719622bf2b2150591631b0a71d6a5dade419a4e67b9bdbfa272b559

    • SHA512

      0d713fa5ca52322ea2295d305adbcecc83aaf6b46024987a483112fbbc4c47db6695d0e019b7e68f1a8fe53ff4cbbb4010a981a3fa91eb9be42ebccc75118c1e

    Score
    10/10
    wastedlockerdiscoveryexploitpersistenceransomware

    • WastedLocker

      Ransomware family seen in the wild since May 2020.

      ransomwarewastedlocker

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Executes dropped EXE

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Possible privilege escalation attempt

      exploit

    • Deletes itself

    • Loads dropped DLL

    • Modifies file permissions

      discovery

    • Drops file in System32 directory

    • Modifies service

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Hidden Files and Directories

1
T1158

Privilege Escalation

Defense Evasion

File Deletion

2
T1107

File Permissions Modification

1
T1222

Modify Registry

1
T1112

Hidden Files and Directories

1
T1158

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

2
T1490

Tasks