wastedlocker | df35c3aa4105063cb41f093ba12a22d3cb1258f6c2fedd9c8a68f033170ae9fa

Analysis

max time kernel
151s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
03-05-2022 20:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

df35c3aa4105063cb41f093ba12a22d3cb1258f6c2fedd9c8a68f033170ae9fa.exe
Size

2.3MB
MD5

93d20353d7135a1086eac5855edafabf
SHA1

7dc81975c33c142aba3f1351c7bc066181a2a8c6
SHA256

df35c3aa4105063cb41f093ba12a22d3cb1258f6c2fedd9c8a68f033170ae9fa
SHA512

f2e8d4132b7d8fb5bce50468ef787e8708570373202c3a0cb626b192e0e0f7262718a9691453cacc49351a5e166677e3681dd387ef72c9dcb72e09257473726f

Score

10^/10

wastedlocker discovery evasion exploit ransomware themida trojan

Malware Config

Signatures

WastedLocker
Ransomware family seen in the wild since May 2020.
ransomware wastedlocker
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Executes dropped EXE 2 IoCs

pid	Process
3612	Assistance:bin
4176	Assistance.exe

Modifies extensions of user files 9 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

description	ioc	Process
File renamed	C:\Users\Admin\Pictures\ConfirmAssert.png => C:\Users\Admin\Pictures\ConfirmAssert.png.tcwwasted	Assistance.exe
File opened for modification	C:\Users\Admin\Pictures\StepCopy.tif.tcwwasted	Assistance.exe
File created	C:\Users\Admin\Pictures\UnregisterInitialize.tiff.tcwwasted_info	Assistance.exe
File renamed	C:\Users\Admin\Pictures\UnregisterInitialize.tiff => C:\Users\Admin\Pictures\UnregisterInitialize.tiff.tcwwasted	Assistance.exe
File created	C:\Users\Admin\Pictures\ConfirmAssert.png.tcwwasted_info	Assistance.exe
File opened for modification	C:\Users\Admin\Pictures\ConfirmAssert.png.tcwwasted	Assistance.exe
File created	C:\Users\Admin\Pictures\StepCopy.tif.tcwwasted_info	Assistance.exe
File renamed	C:\Users\Admin\Pictures\StepCopy.tif => C:\Users\Admin\Pictures\StepCopy.tif.tcwwasted	Assistance.exe
File opened for modification	C:\Users\Admin\Pictures\UnregisterInitialize.tiff.tcwwasted	Assistance.exe

Possible privilege escalation attempt 2 IoCs

exploit

pid	Process
3136	takeown.exe
4524	icacls.exe

Checks BIOS information in registry 2 TTPs 6 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Assistance:bin
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Assistance.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Assistance.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	df35c3aa4105063cb41f093ba12a22d3cb1258f6c2fedd9c8a68f033170ae9fa.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	df35c3aa4105063cb41f093ba12a22d3cb1258f6c2fedd9c8a68f033170ae9fa.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Assistance:bin

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3136	takeown.exe
4524	icacls.exe

Themida packer 7 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/memory/1864-131-0x0000000000400000-0x0000000000A09000-memory.dmp	themida
behavioral2/files/0x00060000000231c0-136.dat	themida
behavioral2/files/0x00060000000231c0-137.dat	themida
behavioral2/memory/3612-139-0x0000000000400000-0x0000000000A09000-memory.dmp	themida
behavioral2/files/0x000400000001db29-144.dat	themida
behavioral2/files/0x000400000001db29-146.dat	themida
behavioral2/memory/4176-148-0x0000000000400000-0x0000000000A09000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 3 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	df35c3aa4105063cb41f093ba12a22d3cb1258f6c2fedd9c8a68f033170ae9fa.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Assistance:bin
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Assistance.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Assistance.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Assistance.exe	Assistance:bin

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
1864	df35c3aa4105063cb41f093ba12a22d3cb1258f6c2fedd9c8a68f033170ae9fa.exe
3612	Assistance:bin
4176	Assistance.exe

Interacts with shadow copies 2 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1107

Inhibit System Recovery

T1490

pid	Process
1920	vssadmin.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Assistance:bin	df35c3aa4105063cb41f093ba12a22d3cb1258f6c2fedd9c8a68f033170ae9fa.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeBackupPrivilege	2556	vssvc.exe
Token: SeRestorePrivilege	2556	vssvc.exe
Token: SeAuditPrivilege	2556	vssvc.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 1864 wrote to memory of 3612	1864	df35c3aa4105063cb41f093ba12a22d3cb1258f6c2fedd9c8a68f033170ae9fa.exe	82
PID 1864 wrote to memory of 3612	1864	df35c3aa4105063cb41f093ba12a22d3cb1258f6c2fedd9c8a68f033170ae9fa.exe	82
PID 1864 wrote to memory of 3612	1864	df35c3aa4105063cb41f093ba12a22d3cb1258f6c2fedd9c8a68f033170ae9fa.exe	82
PID 3612 wrote to memory of 1920	3612	Assistance:bin	83
PID 3612 wrote to memory of 1920	3612	Assistance:bin	83
PID 3612 wrote to memory of 3136	3612	Assistance:bin	87
PID 3612 wrote to memory of 3136	3612	Assistance:bin	87
PID 3612 wrote to memory of 3136	3612	Assistance:bin	87
PID 3612 wrote to memory of 4524	3612	Assistance:bin	89
PID 3612 wrote to memory of 4524	3612	Assistance:bin	89
PID 3612 wrote to memory of 4524	3612	Assistance:bin	89
PID 4176 wrote to memory of 216	4176	Assistance.exe	93
PID 4176 wrote to memory of 216	4176	Assistance.exe	93
PID 4176 wrote to memory of 216	4176	Assistance.exe	93
PID 216 wrote to memory of 1732	216	cmd.exe	95
PID 216 wrote to memory of 1732	216	cmd.exe	95
PID 216 wrote to memory of 1732	216	cmd.exe	95
PID 3612 wrote to memory of 3952	3612	Assistance:bin	96
PID 3612 wrote to memory of 3952	3612	Assistance:bin	96
PID 3612 wrote to memory of 3952	3612	Assistance:bin	96
PID 1864 wrote to memory of 2460	1864	df35c3aa4105063cb41f093ba12a22d3cb1258f6c2fedd9c8a68f033170ae9fa.exe	98
PID 1864 wrote to memory of 2460	1864	df35c3aa4105063cb41f093ba12a22d3cb1258f6c2fedd9c8a68f033170ae9fa.exe	98
PID 1864 wrote to memory of 2460	1864	df35c3aa4105063cb41f093ba12a22d3cb1258f6c2fedd9c8a68f033170ae9fa.exe	98
PID 3952 wrote to memory of 2896	3952	cmd.exe	100
PID 3952 wrote to memory of 2896	3952	cmd.exe	100
PID 3952 wrote to memory of 2896	3952	cmd.exe	100
PID 2460 wrote to memory of 4580	2460	cmd.exe	101
PID 2460 wrote to memory of 4580	2460	cmd.exe	101
PID 2460 wrote to memory of 4580	2460	cmd.exe	101
PID 2460 wrote to memory of 1048	2460	cmd.exe	103
PID 2460 wrote to memory of 1048	2460	cmd.exe	103
PID 2460 wrote to memory of 1048	2460	cmd.exe	103
PID 3952 wrote to memory of 1212	3952	cmd.exe	102
PID 3952 wrote to memory of 1212	3952	cmd.exe	102
PID 3952 wrote to memory of 1212	3952	cmd.exe	102
PID 216 wrote to memory of 760	216	cmd.exe	104
PID 216 wrote to memory of 760	216	cmd.exe	104
PID 216 wrote to memory of 760	216	cmd.exe	104

Views/modifies file attributes 1 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1158

pid	Process
1212	attrib.exe
1048	attrib.exe
760	attrib.exe

C:\Users\Admin\AppData\Local\Temp\df35c3aa4105063cb41f093ba12a22d3cb1258f6c2fedd9c8a68f033170ae9fa.exe
"C:\Users\Admin\AppData\Local\Temp\df35c3aa4105063cb41f093ba12a22d3cb1258f6c2fedd9c8a68f033170ae9fa.exe"
1⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:1864
- C:\Users\Admin\AppData\Roaming\Assistance:bin
  C:\Users\Admin\AppData\Roaming\Assistance:bin -r
  2⤵
  - Executes dropped EXE
  - Checks BIOS information in registry
  - Checks whether UAC is enabled
  - Drops file in System32 directory
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of WriteProcessMemory
  PID:3612
- - C:\Windows\system32\vssadmin.exe
    C:\Windows\system32\vssadmin.exe Delete Shadows /All /Quiet
    3⤵
    - Interacts with shadow copies
    PID:1920
- - C:\Windows\SysWOW64\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\system32\Assistance.exe
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3136
- - C:\Windows\SysWOW64\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\system32\Assistance.exe /reset
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4524
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c choice /t 10 /d y & attrib -h "C:\Users\Admin\AppData\Roaming\Assistance" & del "C:\Users\Admin\AppData\Roaming\Assistance"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3952
  - - C:\Windows\SysWOW64\choice.exe
      choice /t 10 /d y
      4⤵
      PID:2896
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -h "C:\Users\Admin\AppData\Roaming\Assistance"
      4⤵
      Views/modifies file attributes
      PID:1212
- C:\Windows\SysWOW64\cmd.exe
  cmd /c choice /t 10 /d y & attrib -h "C:\Users\Admin\AppData\Local\Temp\df35c3aa4105063cb41f093ba12a22d3cb1258f6c2fedd9c8a68f033170ae9fa.exe" & del "C:\Users\Admin\AppData\Local\Temp\df35c3aa4105063cb41f093ba12a22d3cb1258f6c2fedd9c8a68f033170ae9fa.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2460
- - C:\Windows\SysWOW64\choice.exe
    choice /t 10 /d y
    3⤵
    PID:4580
- - C:\Windows\SysWOW64\attrib.exe
    attrib -h "C:\Users\Admin\AppData\Local\Temp\df35c3aa4105063cb41f093ba12a22d3cb1258f6c2fedd9c8a68f033170ae9fa.exe"
    3⤵
    - Views/modifies file attributes
    PID:1048

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2556

C:\Windows\SysWOW64\Assistance.exe
C:\Windows\SysWOW64\Assistance.exe -s
1⤵
- Executes dropped EXE
- Modifies extensions of user files
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:4176
- C:\Windows\SysWOW64\cmd.exe
  cmd /c choice /t 10 /d y & attrib -h "C:\Windows\SysWOW64\Assistance.exe" & del "C:\Windows\SysWOW64\Assistance.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:216
- - C:\Windows\SysWOW64\choice.exe
    choice /t 10 /d y
    3⤵
    PID:1732
- - C:\Windows\SysWOW64\attrib.exe
    attrib -h "C:\Windows\SysWOW64\Assistance.exe"
    3⤵
    - Drops file in System32 directory
    - Views/modifies file attributes
    PID:760

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Privilege Escalation

Defense Evasion

File Deletion

T1107

File and Directory Permissions Modification

T1222

Hidden Files and Directories

T1158

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Assistance:bin

Filesize
2.3MB

MD5
93d20353d7135a1086eac5855edafabf

SHA1
7dc81975c33c142aba3f1351c7bc066181a2a8c6

SHA256
df35c3aa4105063cb41f093ba12a22d3cb1258f6c2fedd9c8a68f033170ae9fa

SHA512
f2e8d4132b7d8fb5bce50468ef787e8708570373202c3a0cb626b192e0e0f7262718a9691453cacc49351a5e166677e3681dd387ef72c9dcb72e09257473726f

Download Submit
C:\Users\Admin\AppData\Roaming\Assistance:bin

Filesize
2.3MB

MD5
93d20353d7135a1086eac5855edafabf

SHA1
7dc81975c33c142aba3f1351c7bc066181a2a8c6

SHA256
df35c3aa4105063cb41f093ba12a22d3cb1258f6c2fedd9c8a68f033170ae9fa

SHA512
f2e8d4132b7d8fb5bce50468ef787e8708570373202c3a0cb626b192e0e0f7262718a9691453cacc49351a5e166677e3681dd387ef72c9dcb72e09257473726f

Download Submit
C:\Windows\SysWOW64\Assistance.exe

Filesize
2.3MB

MD5
93d20353d7135a1086eac5855edafabf

SHA1
7dc81975c33c142aba3f1351c7bc066181a2a8c6

SHA256
df35c3aa4105063cb41f093ba12a22d3cb1258f6c2fedd9c8a68f033170ae9fa

SHA512
f2e8d4132b7d8fb5bce50468ef787e8708570373202c3a0cb626b192e0e0f7262718a9691453cacc49351a5e166677e3681dd387ef72c9dcb72e09257473726f

Download Submit
C:\Windows\SysWOW64\Assistance.exe

Filesize
2.3MB

MD5
93d20353d7135a1086eac5855edafabf

SHA1
7dc81975c33c142aba3f1351c7bc066181a2a8c6

SHA256
df35c3aa4105063cb41f093ba12a22d3cb1258f6c2fedd9c8a68f033170ae9fa

SHA512
f2e8d4132b7d8fb5bce50468ef787e8708570373202c3a0cb626b192e0e0f7262718a9691453cacc49351a5e166677e3681dd387ef72c9dcb72e09257473726f

Download Submit
memory/1864-130-0x0000000000401000-0x0000000000403000-memory.dmp

Filesize
8KB

Download
memory/1864-134-0x0000000000400000-0x0000000000A09000-memory.dmp

Filesize
6.0MB

Download
memory/1864-133-0x0000000000B80000-0x0000000000B92000-memory.dmp

Filesize
72KB

Download
memory/1864-132-0x0000000077CB0000-0x0000000077E53000-memory.dmp

Filesize
1.6MB

Download
memory/1864-131-0x0000000000400000-0x0000000000A09000-memory.dmp

Filesize
6.0MB

Download
memory/3612-143-0x0000000000400000-0x0000000000A09000-memory.dmp

Filesize
6.0MB

Download
memory/3612-140-0x0000000077CB0000-0x0000000077E53000-memory.dmp

Filesize
1.6MB

Download
memory/3612-139-0x0000000000400000-0x0000000000A09000-memory.dmp

Filesize
6.0MB

Download
memory/4176-150-0x0000000000400000-0x0000000000A09000-memory.dmp

Filesize
6.0MB

Download
memory/4176-149-0x0000000077CB0000-0x0000000077E53000-memory.dmp

Filesize
1.6MB

Download
memory/4176-148-0x0000000000400000-0x0000000000A09000-memory.dmp

Filesize
6.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads