Overview

overview

10

Static

static

8897db8765...le.exe

windows7_x64

10

8897db8765...le.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8897db876553f942b2eb4005f8475a232bafb82a50ca7761a621842e894a3d80.sample

  • Size

    56KB

  • Sample

    210726-efcm7mx35s

  • MD5

    ecb00e9a61f99a7d4c90723294986bbc

  • SHA1

    be59c867da75e2a66b8c2519e950254f817cd4ad

  • SHA256

    8897db876553f942b2eb4005f8475a232bafb82a50ca7761a621842e894a3d80

  • SHA512

    9dee79827d865de41a63962b419eed7e1f9610ff27f00f8b7b2b9f51e905d5db907d310da590d8f1a11ac88e549373edf39bffdb44d1b205728f1b5e0a43aa5e

Score
10/10
wastedlockerdiscoveryexploitransomware

Malware Config

Targets

    • Target

      8897db876553f942b2eb4005f8475a232bafb82a50ca7761a621842e894a3d80.sample

    • Size

      56KB

    • MD5

      ecb00e9a61f99a7d4c90723294986bbc

    • SHA1

      be59c867da75e2a66b8c2519e950254f817cd4ad

    • SHA256

      8897db876553f942b2eb4005f8475a232bafb82a50ca7761a621842e894a3d80

    • SHA512

      9dee79827d865de41a63962b419eed7e1f9610ff27f00f8b7b2b9f51e905d5db907d310da590d8f1a11ac88e549373edf39bffdb44d1b205728f1b5e0a43aa5e

    Score
    10/10
    wastedlockerdiscoveryexploitransomware

    • WastedLocker

      Ransomware family seen in the wild since May 2020.

      ransomwarewastedlocker

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Executes dropped EXE

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Possible privilege escalation attempt

      exploit

    • Deletes itself

    • Loads dropped DLL

    • Modifies file permissions

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1
T1158

Privilege Escalation

Defense Evasion

File Deletion

2
T1107

File Permissions Modification

1
T1222

Hidden Files and Directories

1
T1158

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

2
T1490

Tasks