WastedLocker

Ransomware family seen in the wild since May 2020.

CryptOne packer

Detects CryptOne packer defined in NCC blogpost.

Deletes shadow copies

Ransomware often targets backup files to inhibit system recovery.

Executes dropped EXE

Modifies extensions of user files

Ransomware generally changes the extension on encrypted files.

Possible privilege escalation attempt