Overview

overview

10

Static

static

7

761fe7fde9...97.exe

windows7_x64

10

761fe7fde9...97.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    761fe7fde9899b8482bcd2a1800c442201cc866fb8e0e28969474d51fb412997

  • Size

    2.6MB

  • Sample

    220503-skw6xaaab5

  • MD5

    678c88c9fa4bd905d617530e3ed3f092

  • SHA1

    f2019598e111d8833fb0a7b663e5035a3db47eac

  • SHA256

    761fe7fde9899b8482bcd2a1800c442201cc866fb8e0e28969474d51fb412997

  • SHA512

    aa1b26d398f273a838d6623701ba84314cc691c4bbbc51703af34ad3d5f503a66dc42fb5838e66f4e84004aaf23e29caf6113a8b17891179b62fd3d7773cde5d

Score
10/10
wastedlockerdiscoveryevasionexploitransomwarethemidatrojan

Malware Config

Targets

    • Target

      761fe7fde9899b8482bcd2a1800c442201cc866fb8e0e28969474d51fb412997

    • Size

      2.6MB

    • MD5

      678c88c9fa4bd905d617530e3ed3f092

    • SHA1

      f2019598e111d8833fb0a7b663e5035a3db47eac

    • SHA256

      761fe7fde9899b8482bcd2a1800c442201cc866fb8e0e28969474d51fb412997

    • SHA512

      aa1b26d398f273a838d6623701ba84314cc691c4bbbc51703af34ad3d5f503a66dc42fb5838e66f4e84004aaf23e29caf6113a8b17891179b62fd3d7773cde5d

    Score
    10/10
    wastedlockerdiscoveryevasionexploitransomwarethemidatrojan

    • WastedLocker

      Ransomware family seen in the wild since May 2020.

      ransomwarewastedlocker

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Executes dropped EXE

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Possible privilege escalation attempt

      exploit

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Deletes itself

    • Loads dropped DLL

    • Modifies file permissions

      discovery

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1
T1158

Privilege Escalation

Defense Evasion

File Deletion

2
T1107

Virtualization/Sandbox Evasion

1
T1497

File Permissions Modification

1
T1222

Hidden Files and Directories

1
T1158

Credential Access

Discovery

Query Registry

2
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

2
T1490

Tasks