wastedlocker | df35c3aa4105063cb41f093ba12a22d3cb1258f6c2fedd9c8a68f033170ae9fa

General

Target

df35c3aa4105063cb41f093ba12a22d3cb1258f6c2fedd9c8a68f033170ae9fa.exe
Size

2.3MB
MD5

93d20353d7135a1086eac5855edafabf
SHA1

7dc81975c33c142aba3f1351c7bc066181a2a8c6
SHA256

df35c3aa4105063cb41f093ba12a22d3cb1258f6c2fedd9c8a68f033170ae9fa
SHA512

f2e8d4132b7d8fb5bce50468ef787e8708570373202c3a0cb626b192e0e0f7262718a9691453cacc49351a5e166677e3681dd387ef72c9dcb72e09257473726f

Score

10^/10

wastedlocker discovery evasion exploit ransomware themida trojan

Malware Config

Signatures

WastedLocker
Ransomware family seen in the wild since May 2020.
ransomware wastedlocker
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497
Executes dropped EXE 2 IoCs

Processes:

Assistance:binAssistance.exe

pid process

3612 Assistance:bin
4176 Assistance.exe

pid	process
3612	Assistance:bin
4176	Assistance.exe

Modifies extensions of user files 9 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

Assistance.exe

description	ioc	process
File renamed	C:\Users\Admin\Pictures\ConfirmAssert.png => C:\Users\Admin\Pictures\ConfirmAssert.png.tcwwasted	Assistance.exe
File opened for modification	C:\Users\Admin\Pictures\StepCopy.tif.tcwwasted	Assistance.exe
File created	C:\Users\Admin\Pictures\UnregisterInitialize.tiff.tcwwasted_info	Assistance.exe
File renamed	C:\Users\Admin\Pictures\UnregisterInitialize.tiff => C:\Users\Admin\Pictures\UnregisterInitialize.tiff.tcwwasted	Assistance.exe
File created	C:\Users\Admin\Pictures\ConfirmAssert.png.tcwwasted_info	Assistance.exe
File opened for modification	C:\Users\Admin\Pictures\ConfirmAssert.png.tcwwasted	Assistance.exe
File created	C:\Users\Admin\Pictures\StepCopy.tif.tcwwasted_info	Assistance.exe
File renamed	C:\Users\Admin\Pictures\StepCopy.tif => C:\Users\Admin\Pictures\StepCopy.tif.tcwwasted	Assistance.exe
File opened for modification	C:\Users\Admin\Pictures\UnregisterInitialize.tiff.tcwwasted	Assistance.exe

Possible privilege escalation attempt 2 IoCs
exploit

Processes:

takeown.exeicacls.exe

pid process

3136 takeown.exe
4524 icacls.exe

pid	process
3136	takeown.exe
4524	icacls.exe

Checks BIOS information in registry 2 TTPs 6 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Assistance:binAssistance.exedf35c3aa4105063cb41f093ba12a22d3cb1258f6c2fedd9c8a68f033170ae9fa.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Assistance:bin
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Assistance.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Assistance.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	df35c3aa4105063cb41f093ba12a22d3cb1258f6c2fedd9c8a68f033170ae9fa.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	df35c3aa4105063cb41f093ba12a22d3cb1258f6c2fedd9c8a68f033170ae9fa.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Assistance:bin

Modifies file permissions 1 TTPs 2 IoCs
discovery

File Permissions Modification
T1222

Processes:

takeown.exeicacls.exe

pid process

3136 takeown.exe
4524 icacls.exe

pid	process
3136	takeown.exe
4524	icacls.exe

Themida packer 7 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
behavioral2/memory/1864-131-0x0000000000400000-0x0000000000A09000-memory.dmp	themida
C:\Users\Admin\AppData\Roaming\Assistance:bin	themida
C:\Users\Admin\AppData\Roaming\Assistance:bin	themida
behavioral2/memory/3612-139-0x0000000000400000-0x0000000000A09000-memory.dmp	themida
C:\Windows\SysWOW64\Assistance.exe	themida
C:\Windows\SysWOW64\Assistance.exe	themida
behavioral2/memory/4176-148-0x0000000000400000-0x0000000000A09000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 3 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

df35c3aa4105063cb41f093ba12a22d3cb1258f6c2fedd9c8a68f033170ae9fa.exeAssistance:binAssistance.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	df35c3aa4105063cb41f093ba12a22d3cb1258f6c2fedd9c8a68f033170ae9fa.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Assistance:bin
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Assistance.exe

Drops file in System32 directory 2 IoCs

Processes:

attrib.exeAssistance:bin

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\Assistance.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Assistance.exe	Assistance:bin

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

Processes:

df35c3aa4105063cb41f093ba12a22d3cb1258f6c2fedd9c8a68f033170ae9fa.exeAssistance:binAssistance.exe

pid process

1864 df35c3aa4105063cb41f093ba12a22d3cb1258f6c2fedd9c8a68f033170ae9fa.exe
3612 Assistance:bin
4176 Assistance.exe
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

1920 vssadmin.exe

pid	process
1864	df35c3aa4105063cb41f093ba12a22d3cb1258f6c2fedd9c8a68f033170ae9fa.exe
3612	Assistance:bin
4176	Assistance.exe

pid	process
1920	vssadmin.exe

NTFS ADS 1 IoCs

Processes:

df35c3aa4105063cb41f093ba12a22d3cb1258f6c2fedd9c8a68f033170ae9fa.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Assistance:bin	df35c3aa4105063cb41f093ba12a22d3cb1258f6c2fedd9c8a68f033170ae9fa.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

vssvc.exe

description pid process

Token: SeBackupPrivilege 2556 vssvc.exe
Token: SeRestorePrivilege 2556 vssvc.exe
Token: SeAuditPrivilege 2556 vssvc.exe

description	pid	process
Token: SeBackupPrivilege	2556	vssvc.exe
Token: SeRestorePrivilege	2556	vssvc.exe
Token: SeAuditPrivilege	2556	vssvc.exe

Suspicious use of WriteProcessMemory 38 IoCs

Processes:

df35c3aa4105063cb41f093ba12a22d3cb1258f6c2fedd9c8a68f033170ae9fa.exeAssistance:binAssistance.execmd.execmd.execmd.exe

description	pid	process	target process
PID 1864 wrote to memory of 3612	1864	df35c3aa4105063cb41f093ba12a22d3cb1258f6c2fedd9c8a68f033170ae9fa.exe	Assistance:bin
PID 1864 wrote to memory of 3612	1864	df35c3aa4105063cb41f093ba12a22d3cb1258f6c2fedd9c8a68f033170ae9fa.exe	Assistance:bin
PID 1864 wrote to memory of 3612	1864	df35c3aa4105063cb41f093ba12a22d3cb1258f6c2fedd9c8a68f033170ae9fa.exe	Assistance:bin
PID 3612 wrote to memory of 1920	3612	Assistance:bin	vssadmin.exe
PID 3612 wrote to memory of 1920	3612	Assistance:bin	vssadmin.exe
PID 3612 wrote to memory of 3136	3612	Assistance:bin	takeown.exe
PID 3612 wrote to memory of 3136	3612	Assistance:bin	takeown.exe
PID 3612 wrote to memory of 3136	3612	Assistance:bin	takeown.exe
PID 3612 wrote to memory of 4524	3612	Assistance:bin	icacls.exe
PID 3612 wrote to memory of 4524	3612	Assistance:bin	icacls.exe
PID 3612 wrote to memory of 4524	3612	Assistance:bin	icacls.exe
PID 4176 wrote to memory of 216	4176	Assistance.exe	cmd.exe
PID 4176 wrote to memory of 216	4176	Assistance.exe	cmd.exe
PID 4176 wrote to memory of 216	4176	Assistance.exe	cmd.exe
PID 216 wrote to memory of 1732	216	cmd.exe	choice.exe
PID 216 wrote to memory of 1732	216	cmd.exe	choice.exe
PID 216 wrote to memory of 1732	216	cmd.exe	choice.exe
PID 3612 wrote to memory of 3952	3612	Assistance:bin	cmd.exe
PID 3612 wrote to memory of 3952	3612	Assistance:bin	cmd.exe
PID 3612 wrote to memory of 3952	3612	Assistance:bin	cmd.exe
PID 1864 wrote to memory of 2460	1864	df35c3aa4105063cb41f093ba12a22d3cb1258f6c2fedd9c8a68f033170ae9fa.exe	cmd.exe
PID 1864 wrote to memory of 2460	1864	df35c3aa4105063cb41f093ba12a22d3cb1258f6c2fedd9c8a68f033170ae9fa.exe	cmd.exe
PID 1864 wrote to memory of 2460	1864	df35c3aa4105063cb41f093ba12a22d3cb1258f6c2fedd9c8a68f033170ae9fa.exe	cmd.exe
PID 3952 wrote to memory of 2896	3952	cmd.exe	choice.exe
PID 3952 wrote to memory of 2896	3952	cmd.exe	choice.exe
PID 3952 wrote to memory of 2896	3952	cmd.exe	choice.exe
PID 2460 wrote to memory of 4580	2460	cmd.exe	choice.exe
PID 2460 wrote to memory of 4580	2460	cmd.exe	choice.exe
PID 2460 wrote to memory of 4580	2460	cmd.exe	choice.exe
PID 2460 wrote to memory of 1048	2460	cmd.exe	attrib.exe
PID 2460 wrote to memory of 1048	2460	cmd.exe	attrib.exe
PID 2460 wrote to memory of 1048	2460	cmd.exe	attrib.exe
PID 3952 wrote to memory of 1212	3952	cmd.exe	attrib.exe
PID 3952 wrote to memory of 1212	3952	cmd.exe	attrib.exe
PID 3952 wrote to memory of 1212	3952	cmd.exe	attrib.exe
PID 216 wrote to memory of 760	216	cmd.exe	attrib.exe
PID 216 wrote to memory of 760	216	cmd.exe	attrib.exe
PID 216 wrote to memory of 760	216	cmd.exe	attrib.exe

Views/modifies file attributes 1 TTPs 3 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exeattrib.exeattrib.exe

pid process

1212 attrib.exe
1048 attrib.exe
760 attrib.exe

pid	process
1212	attrib.exe
1048	attrib.exe
760	attrib.exe

C:\Users\Admin\AppData\Local\Temp\df35c3aa4105063cb41f093ba12a22d3cb1258f6c2fedd9c8a68f033170ae9fa.exe
"C:\Users\Admin\AppData\Local\Temp\df35c3aa4105063cb41f093ba12a22d3cb1258f6c2fedd9c8a68f033170ae9fa.exe"
1⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:1864

C:\Users\Admin\AppData\Roaming\Assistance:bin
C:\Users\Admin\AppData\Roaming\Assistance:bin -r
2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:3612

C:\Windows\system32\vssadmin.exe
C:\Windows\system32\vssadmin.exe Delete Shadows /All /Quiet
3⤵
- Interacts with shadow copies
PID:1920

C:\Windows\SysWOW64\takeown.exe
C:\Windows\system32\takeown.exe /F C:\Windows\system32\Assistance.exe
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:3136

C:\Windows\SysWOW64\icacls.exe
C:\Windows\system32\icacls.exe C:\Windows\system32\Assistance.exe /reset
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:4524

C:\Windows\SysWOW64\cmd.exe
cmd /c choice /t 10 /d y & attrib -h "C:\Users\Admin\AppData\Roaming\Assistance" & del "C:\Users\Admin\AppData\Roaming\Assistance"
3⤵
- Suspicious use of WriteProcessMemory
PID:3952

C:\Windows\SysWOW64\choice.exe
choice /t 10 /d y
4⤵
PID:2896

C:\Windows\SysWOW64\attrib.exe
attrib -h "C:\Users\Admin\AppData\Roaming\Assistance"
4⤵
- Views/modifies file attributes
PID:1212

C:\Windows\SysWOW64\cmd.exe
cmd /c choice /t 10 /d y & attrib -h "C:\Users\Admin\AppData\Local\Temp\df35c3aa4105063cb41f093ba12a22d3cb1258f6c2fedd9c8a68f033170ae9fa.exe" & del "C:\Users\Admin\AppData\Local\Temp\df35c3aa4105063cb41f093ba12a22d3cb1258f6c2fedd9c8a68f033170ae9fa.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:2460

C:\Windows\SysWOW64\choice.exe
choice /t 10 /d y
3⤵
PID:4580

C:\Windows\SysWOW64\attrib.exe
attrib -h "C:\Users\Admin\AppData\Local\Temp\df35c3aa4105063cb41f093ba12a22d3cb1258f6c2fedd9c8a68f033170ae9fa.exe"
3⤵
- Views/modifies file attributes
PID:1048

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2556

C:\Windows\SysWOW64\Assistance.exe
C:\Windows\SysWOW64\Assistance.exe -s
1⤵
- Executes dropped EXE
- Modifies extensions of user files
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:4176

C:\Windows\SysWOW64\cmd.exe
cmd /c choice /t 10 /d y & attrib -h "C:\Windows\SysWOW64\Assistance.exe" & del "C:\Windows\SysWOW64\Assistance.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:216

C:\Windows\SysWOW64\choice.exe
choice /t 10 /d y
3⤵
PID:1732

C:\Windows\SysWOW64\attrib.exe
attrib -h "C:\Windows\SysWOW64\Assistance.exe"
3⤵
- Drops file in System32 directory
- Views/modifies file attributes
PID:760

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1

T1158

Privilege Escalation

Defense Evasion

File Deletion

2

T1107

Virtualization/Sandbox Evasion

1

T1497

File Permissions Modification

1

T1222

Hidden Files and Directories

1

T1158

Credential Access

Discovery

Query Registry

2

T1012

Virtualization/Sandbox Evasion

1

T1497

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

2

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Assistance:bin
Filesize
2.3MB

MD5
93d20353d7135a1086eac5855edafabf

SHA1
7dc81975c33c142aba3f1351c7bc066181a2a8c6

SHA256
df35c3aa4105063cb41f093ba12a22d3cb1258f6c2fedd9c8a68f033170ae9fa

SHA512
f2e8d4132b7d8fb5bce50468ef787e8708570373202c3a0cb626b192e0e0f7262718a9691453cacc49351a5e166677e3681dd387ef72c9dcb72e09257473726f

Download Submit
C:\Users\Admin\AppData\Roaming\Assistance:bin
Filesize
2.3MB

MD5
93d20353d7135a1086eac5855edafabf

SHA1
7dc81975c33c142aba3f1351c7bc066181a2a8c6

SHA256
df35c3aa4105063cb41f093ba12a22d3cb1258f6c2fedd9c8a68f033170ae9fa

SHA512
f2e8d4132b7d8fb5bce50468ef787e8708570373202c3a0cb626b192e0e0f7262718a9691453cacc49351a5e166677e3681dd387ef72c9dcb72e09257473726f

Download Submit
C:\Windows\SysWOW64\Assistance.exe
Filesize
2.3MB

MD5
93d20353d7135a1086eac5855edafabf

SHA1
7dc81975c33c142aba3f1351c7bc066181a2a8c6

SHA256
df35c3aa4105063cb41f093ba12a22d3cb1258f6c2fedd9c8a68f033170ae9fa

SHA512
f2e8d4132b7d8fb5bce50468ef787e8708570373202c3a0cb626b192e0e0f7262718a9691453cacc49351a5e166677e3681dd387ef72c9dcb72e09257473726f

Download Submit
C:\Windows\SysWOW64\Assistance.exe
Filesize
2.3MB

MD5
93d20353d7135a1086eac5855edafabf

SHA1
7dc81975c33c142aba3f1351c7bc066181a2a8c6

SHA256
df35c3aa4105063cb41f093ba12a22d3cb1258f6c2fedd9c8a68f033170ae9fa

SHA512
f2e8d4132b7d8fb5bce50468ef787e8708570373202c3a0cb626b192e0e0f7262718a9691453cacc49351a5e166677e3681dd387ef72c9dcb72e09257473726f

Download Submit
memory/216-151-0x0000000000000000-mapping.dmp

Download
memory/760-159-0x0000000000000000-mapping.dmp

Download
memory/1048-157-0x0000000000000000-mapping.dmp

Download
memory/1212-158-0x0000000000000000-mapping.dmp

Download
memory/1732-152-0x0000000000000000-mapping.dmp

Download
memory/1864-130-0x0000000000401000-0x0000000000403000-memory.dmp

Filesize
8KB

Download
memory/1864-134-0x0000000000400000-0x0000000000A09000-memory.dmp

Filesize
6.0MB

Download
memory/1864-133-0x0000000000B80000-0x0000000000B92000-memory.dmp

Filesize
72KB

Download
memory/1864-132-0x0000000077CB0000-0x0000000077E53000-memory.dmp

Filesize
1.6MB

Download
memory/1864-131-0x0000000000400000-0x0000000000A09000-memory.dmp

Filesize
6.0MB

Download
memory/1920-141-0x0000000000000000-mapping.dmp

Download
memory/2460-154-0x0000000000000000-mapping.dmp

Download
memory/2896-155-0x0000000000000000-mapping.dmp

Download
memory/3136-142-0x0000000000000000-mapping.dmp

Download
memory/3612-143-0x0000000000400000-0x0000000000A09000-memory.dmp

Filesize
6.0MB

Download
memory/3612-140-0x0000000077CB0000-0x0000000077E53000-memory.dmp

Filesize
1.6MB

Download
memory/3612-139-0x0000000000400000-0x0000000000A09000-memory.dmp

Filesize
6.0MB

Download
memory/3612-135-0x0000000000000000-mapping.dmp

Download
memory/3952-153-0x0000000000000000-mapping.dmp

Download
memory/4176-150-0x0000000000400000-0x0000000000A09000-memory.dmp

Filesize
6.0MB

Download
memory/4176-149-0x0000000077CB0000-0x0000000077E53000-memory.dmp

Filesize
1.6MB

Download
memory/4176-148-0x0000000000400000-0x0000000000A09000-memory.dmp

Filesize
6.0MB

Download
memory/4524-145-0x0000000000000000-mapping.dmp

Download
memory/4580-156-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads