wastedlocker | 905ea119ad8d3e54cd228c458a1b5681abc1f35df782977a23812ec4efa0288a

General

Target

905ea119ad8d3e54cd228c458a1b5681abc1f35df782977a23812ec4efa0288a.bin.exe
Size

1.2MB
MD5

2cc4534b0dd0e1c8d5b89644274a10c1
SHA1

735ee2c15c0b7172f65d39f0fd33b9186ee69653
SHA256

905ea119ad8d3e54cd228c458a1b5681abc1f35df782977a23812ec4efa0288a
SHA512

a842b2d171aa6efa1b391d5d0f84663e78021b485555e2bf10a5e589d8652057f5abbd88e1a5ec628b714692ec5d63c3172894aa7846d5897e87d99dad67e2b8

Score

10^/10

ransomware wastedlocker persistence exploit discovery

Malware Config

Signatures

Suspicious use of WriteProcessMemory 52 IoCs

Processes:

905ea119ad8d3e54cd228c458a1b5681abc1f35df782977a23812ec4efa0288a.bin.exeArbiter:binArbiter.execmd.execmd.execmd.exe

description	pid	process	target process
PID 1436 wrote to memory of 1504	1436	905ea119ad8d3e54cd228c458a1b5681abc1f35df782977a23812ec4efa0288a.bin.exe	Arbiter:bin
PID 1436 wrote to memory of 1504	1436	905ea119ad8d3e54cd228c458a1b5681abc1f35df782977a23812ec4efa0288a.bin.exe	Arbiter:bin
PID 1436 wrote to memory of 1504	1436	905ea119ad8d3e54cd228c458a1b5681abc1f35df782977a23812ec4efa0288a.bin.exe	Arbiter:bin
PID 1436 wrote to memory of 1504	1436	905ea119ad8d3e54cd228c458a1b5681abc1f35df782977a23812ec4efa0288a.bin.exe	Arbiter:bin
PID 1504 wrote to memory of 364	1504	Arbiter:bin	vssadmin.exe
PID 1504 wrote to memory of 364	1504	Arbiter:bin	vssadmin.exe
PID 1504 wrote to memory of 364	1504	Arbiter:bin	vssadmin.exe
PID 1504 wrote to memory of 364	1504	Arbiter:bin	vssadmin.exe
PID 1504 wrote to memory of 1272	1504	Arbiter:bin	takeown.exe
PID 1504 wrote to memory of 1272	1504	Arbiter:bin	takeown.exe
PID 1504 wrote to memory of 1272	1504	Arbiter:bin	takeown.exe
PID 1504 wrote to memory of 1272	1504	Arbiter:bin	takeown.exe
PID 1504 wrote to memory of 1832	1504	Arbiter:bin	icacls.exe
PID 1504 wrote to memory of 1832	1504	Arbiter:bin	icacls.exe
PID 1504 wrote to memory of 1832	1504	Arbiter:bin	icacls.exe
PID 1504 wrote to memory of 1832	1504	Arbiter:bin	icacls.exe
PID 1720 wrote to memory of 564	1720	Arbiter.exe	cmd.exe
PID 1720 wrote to memory of 564	1720	Arbiter.exe	cmd.exe
PID 1720 wrote to memory of 564	1720	Arbiter.exe	cmd.exe
PID 1720 wrote to memory of 564	1720	Arbiter.exe	cmd.exe
PID 564 wrote to memory of 956	564	cmd.exe	choice.exe
PID 564 wrote to memory of 956	564	cmd.exe	choice.exe
PID 564 wrote to memory of 956	564	cmd.exe	choice.exe
PID 564 wrote to memory of 956	564	cmd.exe	choice.exe
PID 1504 wrote to memory of 628	1504	Arbiter:bin	cmd.exe
PID 1504 wrote to memory of 628	1504	Arbiter:bin	cmd.exe
PID 1504 wrote to memory of 628	1504	Arbiter:bin	cmd.exe
PID 1504 wrote to memory of 628	1504	Arbiter:bin	cmd.exe
PID 1436 wrote to memory of 1892	1436	905ea119ad8d3e54cd228c458a1b5681abc1f35df782977a23812ec4efa0288a.bin.exe	cmd.exe
PID 1436 wrote to memory of 1892	1436	905ea119ad8d3e54cd228c458a1b5681abc1f35df782977a23812ec4efa0288a.bin.exe	cmd.exe
PID 1436 wrote to memory of 1892	1436	905ea119ad8d3e54cd228c458a1b5681abc1f35df782977a23812ec4efa0288a.bin.exe	cmd.exe
PID 1436 wrote to memory of 1892	1436	905ea119ad8d3e54cd228c458a1b5681abc1f35df782977a23812ec4efa0288a.bin.exe	cmd.exe
PID 628 wrote to memory of 1620	628	cmd.exe	choice.exe
PID 628 wrote to memory of 1620	628	cmd.exe	choice.exe
PID 628 wrote to memory of 1620	628	cmd.exe	choice.exe
PID 628 wrote to memory of 1620	628	cmd.exe	choice.exe
PID 1892 wrote to memory of 1604	1892	cmd.exe	choice.exe
PID 1892 wrote to memory of 1604	1892	cmd.exe	choice.exe
PID 1892 wrote to memory of 1604	1892	cmd.exe	choice.exe
PID 1892 wrote to memory of 1604	1892	cmd.exe	choice.exe
PID 564 wrote to memory of 1896	564	cmd.exe	attrib.exe
PID 564 wrote to memory of 1896	564	cmd.exe	attrib.exe
PID 564 wrote to memory of 1896	564	cmd.exe	attrib.exe
PID 564 wrote to memory of 1896	564	cmd.exe	attrib.exe
PID 628 wrote to memory of 2024	628	cmd.exe	attrib.exe
PID 628 wrote to memory of 2024	628	cmd.exe	attrib.exe
PID 628 wrote to memory of 2024	628	cmd.exe	attrib.exe
PID 628 wrote to memory of 2024	628	cmd.exe	attrib.exe
PID 1892 wrote to memory of 2008	1892	cmd.exe	attrib.exe
PID 1892 wrote to memory of 2008	1892	cmd.exe	attrib.exe
PID 1892 wrote to memory of 2008	1892	cmd.exe	attrib.exe
PID 1892 wrote to memory of 2008	1892	cmd.exe	attrib.exe

Executes dropped EXE 2 IoCs

Processes:

Arbiter:binArbiter.exe

pid process

1504 Arbiter:bin
1720 Arbiter.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1892 cmd.exe
WastedLocker
Ransomware family seen in the wild since May 2020.
ransomware wastedlocker
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

364 vssadmin.exe

pid	process
1504	Arbiter:bin
1720	Arbiter.exe

pid	process
1892	cmd.exe

pid	process
364	vssadmin.exe

Modifies extensions of user files 24 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

Arbiter.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Pictures\MoveMeasure.png.garminwasted	Arbiter.exe
File opened for modification	C:\Users\Admin\Pictures\ResumeUninstall.png.garminwasted	Arbiter.exe
File created	C:\Users\Admin\Pictures\SearchShow.png.garminwasted_info	Arbiter.exe
File created	C:\Users\Admin\Pictures\StartComplete.tif.garminwasted_info	Arbiter.exe
File created	C:\Users\Admin\Pictures\UnblockRedo.tif.garminwasted_info	Arbiter.exe
File created	C:\Users\Admin\Pictures\MoveMeasure.png.garminwasted_info	Arbiter.exe
File renamed	C:\Users\Admin\Pictures\MoveMeasure.png => C:\Users\Admin\Pictures\MoveMeasure.png.garminwasted	Arbiter.exe
File renamed	C:\Users\Admin\Pictures\RepairConvert.raw => C:\Users\Admin\Pictures\RepairConvert.raw.garminwasted	Arbiter.exe
File renamed	C:\Users\Admin\Pictures\PopJoin.tif => C:\Users\Admin\Pictures\PopJoin.tif.garminwasted	Arbiter.exe
File created	C:\Users\Admin\Pictures\RepairConvert.raw.garminwasted_info	Arbiter.exe
File renamed	C:\Users\Admin\Pictures\SearchShow.png => C:\Users\Admin\Pictures\SearchShow.png.garminwasted	Arbiter.exe
File opened for modification	C:\Users\Admin\Pictures\SearchShow.png.garminwasted	Arbiter.exe
File renamed	C:\Users\Admin\Pictures\StartComplete.tif => C:\Users\Admin\Pictures\StartComplete.tif.garminwasted	Arbiter.exe
File opened for modification	C:\Users\Admin\Pictures\UnblockRedo.tif.garminwasted	Arbiter.exe
File opened for modification	C:\Users\Admin\Pictures\PopJoin.tif.garminwasted	Arbiter.exe
File opened for modification	C:\Users\Admin\Pictures\RepairConvert.raw.garminwasted	Arbiter.exe
File renamed	C:\Users\Admin\Pictures\ResumeUninstall.png => C:\Users\Admin\Pictures\ResumeUninstall.png.garminwasted	Arbiter.exe
File opened for modification	C:\Users\Admin\Pictures\StartComplete.tif.garminwasted	Arbiter.exe
File created	C:\Users\Admin\Pictures\TestReset.tiff.garminwasted_info	Arbiter.exe
File renamed	C:\Users\Admin\Pictures\TestReset.tiff => C:\Users\Admin\Pictures\TestReset.tiff.garminwasted	Arbiter.exe
File opened for modification	C:\Users\Admin\Pictures\TestReset.tiff.garminwasted	Arbiter.exe
File renamed	C:\Users\Admin\Pictures\UnblockRedo.tif => C:\Users\Admin\Pictures\UnblockRedo.tif.garminwasted	Arbiter.exe
File created	C:\Users\Admin\Pictures\PopJoin.tif.garminwasted_info	Arbiter.exe
File created	C:\Users\Admin\Pictures\ResumeUninstall.png.garminwasted_info	Arbiter.exe

Loads dropped DLL 2 IoCs

Processes:

905ea119ad8d3e54cd228c458a1b5681abc1f35df782977a23812ec4efa0288a.bin.exe

pid	process
1436	905ea119ad8d3e54cd228c458a1b5681abc1f35df782977a23812ec4efa0288a.bin.exe
1436	905ea119ad8d3e54cd228c458a1b5681abc1f35df782977a23812ec4efa0288a.bin.exe

Drops file in System32 directory 2 IoCs

Processes:

Arbiter:binattrib.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\Arbiter.exe	Arbiter:bin
File opened for modification	C:\Windows\SysWOW64\Arbiter.exe	attrib.exe

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

NTFS ADS 1 IoCs

Processes:

905ea119ad8d3e54cd228c458a1b5681abc1f35df782977a23812ec4efa0288a.bin.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Arbiter:bin	905ea119ad8d3e54cd228c458a1b5681abc1f35df782977a23812ec4efa0288a.bin.exe

Modifies service 2 TTPs 5 IoCs

persistence

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

vssvc.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer	vssvc.exe

Possible privilege escalation attempt 2 IoCs
exploit

Processes:

icacls.exetakeown.exe

pid process

1832 icacls.exe
1272 takeown.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

vssvc.exe

description pid process

Token: SeBackupPrivilege 752 vssvc.exe
Token: SeRestorePrivilege 752 vssvc.exe
Token: SeAuditPrivilege 752 vssvc.exe
Modifies file permissions 1 TTPs 2 IoCs
discovery

File Permissions Modification
T1222

Processes:

takeown.exeicacls.exe

pid process

1272 takeown.exe
1832 icacls.exe
Views/modifies file attributes 1 TTPs 3 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exeattrib.exeattrib.exe

pid process

2008 attrib.exe
2024 attrib.exe
1896 attrib.exe

pid	process
1832	icacls.exe
1272	takeown.exe

description	pid	process
Token: SeBackupPrivilege	752	vssvc.exe
Token: SeRestorePrivilege	752	vssvc.exe
Token: SeAuditPrivilege	752	vssvc.exe

pid	process
1272	takeown.exe
1832	icacls.exe

pid	process
2008	attrib.exe
2024	attrib.exe
1896	attrib.exe

C:\Users\Admin\AppData\Local\Temp\905ea119ad8d3e54cd228c458a1b5681abc1f35df782977a23812ec4efa0288a.bin.exe
"C:\Users\Admin\AppData\Local\Temp\905ea119ad8d3e54cd228c458a1b5681abc1f35df782977a23812ec4efa0288a.bin.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Loads dropped DLL
- NTFS ADS
PID:1436

C:\Users\Admin\AppData\Roaming\Arbiter:bin
C:\Users\Admin\AppData\Roaming\Arbiter:bin -r
2⤵
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
- Drops file in System32 directory
PID:1504

C:\Windows\system32\vssadmin.exe
C:\Windows\system32\vssadmin.exe Delete Shadows /All /Quiet
3⤵
- Interacts with shadow copies
PID:364

C:\Windows\SysWOW64\takeown.exe
C:\Windows\system32\takeown.exe /F C:\Windows\system32\Arbiter.exe
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1272

C:\Windows\SysWOW64\icacls.exe
C:\Windows\system32\icacls.exe C:\Windows\system32\Arbiter.exe /reset
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1832

C:\Windows\SysWOW64\cmd.exe
cmd /c choice /t 10 /d y & attrib -h "C:\Users\Admin\AppData\Roaming\Arbiter" & del "C:\Users\Admin\AppData\Roaming\Arbiter"
3⤵
- Suspicious use of WriteProcessMemory
PID:628

C:\Windows\SysWOW64\choice.exe
choice /t 10 /d y
4⤵
PID:1620

C:\Windows\SysWOW64\attrib.exe
attrib -h "C:\Users\Admin\AppData\Roaming\Arbiter"
4⤵
- Views/modifies file attributes
PID:2024

C:\Windows\SysWOW64\cmd.exe
cmd /c choice /t 10 /d y & attrib -h "C:\Users\Admin\AppData\Local\Temp\905ea119ad8d3e54cd228c458a1b5681abc1f35df782977a23812ec4efa0288a.bin.exe" & del "C:\Users\Admin\AppData\Local\Temp\905ea119ad8d3e54cd228c458a1b5681abc1f35df782977a23812ec4efa0288a.bin.exe"
2⤵
- Suspicious use of WriteProcessMemory
- Deletes itself
PID:1892

C:\Windows\SysWOW64\choice.exe
choice /t 10 /d y
3⤵
PID:1604

C:\Windows\SysWOW64\attrib.exe
attrib -h "C:\Users\Admin\AppData\Local\Temp\905ea119ad8d3e54cd228c458a1b5681abc1f35df782977a23812ec4efa0288a.bin.exe"
3⤵
- Views/modifies file attributes
PID:2008

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Modifies service
- Suspicious use of AdjustPrivilegeToken
PID:752

C:\Windows\SysWOW64\Arbiter.exe
C:\Windows\SysWOW64\Arbiter.exe -s
1⤵
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
- Modifies extensions of user files
PID:1720

C:\Windows\SysWOW64\cmd.exe
cmd /c choice /t 10 /d y & attrib -h "C:\Windows\SysWOW64\Arbiter.exe" & del "C:\Windows\SysWOW64\Arbiter.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:564

C:\Windows\SysWOW64\choice.exe
choice /t 10 /d y
3⤵
PID:956

C:\Windows\SysWOW64\attrib.exe
attrib -h "C:\Windows\SysWOW64\Arbiter.exe"
3⤵
- Drops file in System32 directory
- Views/modifies file attributes
PID:1896