wastedlocker | 8da6f4f580f376263368a17ec45ca905574f1929b153439a0e5f1cd0e759fa41

General

Target
2026-08-30_39886e46851c9960061bfca04fdba2d1_elex_wastedlocker.exe
Size 53KB
Sample260901-dj75fsscje
SHA256 8da6f4f580f376263368a17ec45ca905574f1929b153439a0e5f1cd0e759fa41
MD5 39886e46851c9960061bfca04fdba2d1
SHA1 1bc4e5dfb5593786f75669e2629efe4f1939f83b
SHA512 5339fdc1a846a325d117e2e6c2514683ff2513d08237deaf926fafab2b4b36f7de416499e7e70c90bb370c8494bc65e2b10ef0f270cd7cedece8b1ccc38e9450
SSDEEP 1536:s2SYM6dDF+WO8Rh51yXjk2JqdT8LONUeWC0eW:sLYndDg8v51coUH
TLSH
T1C1338D86B90CD173EE9006727E339FA1D7E92C21226CE34773506C11E951DEAD32BE16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution exploit wastedlocker impact ransomware

Malware Config

Signatures

Family: WastedLocker
Ransomware family seen in the wild since May 2020.
ransomware wastedlocker
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (165) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Possible privilege escalation attempt 2 IoCs

exploit

pid	Process
2812	takeown.exe
2260	icacls.exe

Executes dropped EXE 2 IoCs

pid	Process
5884	Readiness:bin
712	Readiness.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2812	takeown.exe
2260	icacls.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Readiness.exe	Readiness:bin
File opened for modification	C:\Windows\SysWOW64\Readiness.exe	attrib.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4956	cmd.exe
2140	cmd.exe
3928	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Readiness:bin
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Readiness.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-30_39886e46851c9960061bfca04fdba2d1_elex_wastedlocker.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
3004	vssadmin.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Readiness:bin	2026-08-30_39886e46851c9960061bfca04fdba2d1_elex_wastedlocker.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeBackupPrivilege	1100	vssvc.exe
Token: SeRestorePrivilege	1100	vssvc.exe
Token: SeAuditPrivilege	1100	vssvc.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 928 wrote to memory of 5884	928	2026-08-30_39886e46851c9960061bfca04fdba2d1_elex_wastedlocker.exe	89
PID 5884 wrote to memory of 3004	5884	Readiness:bin	90
PID 5884 wrote to memory of 2812	5884	Readiness:bin	94
PID 5884 wrote to memory of 2260	5884	Readiness:bin	96
PID 712 wrote to memory of 4956	712	Readiness.exe	100
PID 4956 wrote to memory of 2636	4956	cmd.exe	102
PID 5884 wrote to memory of 2140	5884	Readiness:bin	103
PID 928 wrote to memory of 3928	928	2026-08-30_39886e46851c9960061bfca04fdba2d1_elex_wastedlocker.exe	105
PID 2140 wrote to memory of 5656	2140	cmd.exe	107
PID 3928 wrote to memory of 3368	3928	cmd.exe	108
PID 4956 wrote to memory of 4872	4956	cmd.exe	110
PID 3928 wrote to memory of 3736	3928	cmd.exe	111
PID 2140 wrote to memory of 1760	2140	cmd.exe	112

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

Views/modifies file attributes 1 TTPs 3 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4872	attrib.exe
3736	attrib.exe
1760	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-30_39886e46851c9960061bfca04fdba2d1_elex_wastedlocker.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-30_39886e46851c9960061bfca04fdba2d1_elex_wastedlocker.exe"
1⤵
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:928
- C:\Users\Admin\AppData\Roaming\Readiness:bin
  C:\Users\Admin\AppData\Roaming\Readiness:bin -r
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5884
- - C:\Windows\system32\vssadmin.exe
    C:\Windows\system32\vssadmin.exe Delete Shadows /All /Quiet
    3⤵
    - Interacts with shadow copies
    PID:3004
- - C:\Windows\SysWOW64\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\system32\Readiness.exe
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:2812
- - C:\Windows\SysWOW64\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\system32\Readiness.exe /reset
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:2260
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c choice /t 10 /d y & attrib -h "C:\Users\Admin\AppData\Roaming\Readiness" & del "C:\Users\Admin\AppData\Roaming\Readiness"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2140
  - - C:\Windows\SysWOW64\choice.exe
      choice /t 10 /d y
      4⤵
      System Location Discovery: System Language Discovery
      PID:5656
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -h "C:\Users\Admin\AppData\Roaming\Readiness"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:1760
- C:\Windows\SysWOW64\cmd.exe
  cmd /c choice /t 10 /d y & attrib -h "C:\Users\Admin\AppData\Local\Temp\2026-08-30_39886e46851c9960061bfca04fdba2d1_elex_wastedlocker.exe" & del "C:\Users\Admin\AppData\Local\Temp\2026-08-30_39886e46851c9960061bfca04fdba2d1_elex_wastedlocker.exe"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3928
- - C:\Windows\SysWOW64\choice.exe
    choice /t 10 /d y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3368
- - C:\Windows\SysWOW64\attrib.exe
    attrib -h "C:\Users\Admin\AppData\Local\Temp\2026-08-30_39886e46851c9960061bfca04fdba2d1_elex_wastedlocker.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:3736

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1100

C:\Windows\SysWOW64\Readiness.exe
C:\Windows\SysWOW64\Readiness.exe -s
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:712
- C:\Windows\SysWOW64\cmd.exe
  cmd /c choice /t 10 /d y & attrib -h "C:\Windows\SysWOW64\Readiness.exe" & del "C:\Windows\SysWOW64\Readiness.exe"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4956
- - C:\Windows\SysWOW64\choice.exe
    choice /t 10 /d y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2636
- - C:\Windows\SysWOW64\attrib.exe
    attrib -h "C:\Windows\SysWOW64\Readiness.exe"
    3⤵
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:4872

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Windows Management Instrumentation

1

T1047

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

1

T1006

File and Directory Permissions Modification

1

T1222

Hide Artifacts

1

T1564

Hidden Files and Directories

1

T1564.001

Indicator Removal

2

T1070

File Deletion

2

T1070.004

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

2

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

Readiness:bin

Path C:\Users\Admin\AppData\Roaming\Readiness:bin
Size 53KB
SHA256 8da6f4f580f376263368a17ec45ca905574f1929b153439a0e5f1cd0e759fa41
MD5 39886e46851c9960061bfca04fdba2d1
SHA1 1bc4e5dfb5593786f75669e2629efe4f1939f83b
SHA512 5339fdc1a846a325d117e2e6c2514683ff2513d08237deaf926fafab2b4b36f7de416499e7e70c90bb370c8494bc65e2b10ef0f270cd7cedece8b1ccc38e9450
SSDEEP 1536:s2SYM6dDF+WO8Rh51yXjk2JqdT8LONUeWC0eW:sLYndDg8v51coUH
TLSH
T1C1338D86B90CD173EE9006727E339FA1D7E92C21226CE34773506C11E951DEAD32BE16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing