Symantec WastedLocker June 2020

Indrik Spider used Cobalt Strike to carry out credential dumping using ProcDump.

Indrik Spider has used the win32_service WMI class to retrieve a list of services from the system.

Indrik Spider has used PowerView to enumerate all Windows Server, Windows Server 2003, and Windows 7 instances in the Active Directory database.

Indrik Spider has used WMIC to execute commands on remote computers.

Indrik Spider has used PowerShell Empire for execution of malware.

Indrik Spider has used malicious JavaScript files for several components of their attack.

Indrik Spider has stored collected data in a .tmp file.

Indrik Spider has downloaded additional scripts, malware, and tools onto a compromised host.

Indrik Spider used wmic.exe to add a new user to the system.

Indrik Spider has attempted to get users to click on a malicious zipped file.

WastedLocker can encrypt data and leave a ransom note.

Indrik Spider has used PsExec to stop services prior to the execution of ransomware.

WastedLocker can delete shadow volumes.

Indrik Spider used PsExec to leverage Windows Defender to disable scanning of all downloaded files and to restrict real-time monitoring. Indrik Spider has used `MpCmdRun` to revert the definitions in Microsoft Defender. Additionally, Indrik Spider has used WMI to stop or uninstall and reset anti-virus products and other defensive services.

Indrik Spider has used Cobalt Strike to empty log files. Additionally, Indrik Spider has cleared all event logs using `wevutil`.