NCC Group WastedLocker June 2020

WastedLocker checks for specific registry keys related to the UCOMIEnumConnections and IActiveScriptParseProcedure32 interfaces.

The WastedLocker payload includes encrypted strings stored within the .bss section of the binary file.

WastedLocker contains junk code to increase its entropy and hide the actual code.

WastedLocker has used cmd to execute commands on the system.

WastedLocker can enumerate files and directories just prior to encryption.

WastedLocker's custom crypter, CryptOne, leveraged the VirtualAlloc() API function to help execute the payload.

WastedLocker can modify registry values within the Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap registry key.

WastedLocker's custom cryptor, CryptOne, used an XOR based algorithm to decrypt the payload.

WastedLocker has a command to take ownership of a file and reset the ACL permissions using the takeown.exe /F filepath command.

WastedLocker can encrypt data and leave a ransom note.

WastedLocker can delete shadow volumes.

WastedLocker checked if UCOMIEnumConnections and IActiveScriptParseProcedure32 Registry keys were detected as part of its anti-analysis technique.

WastedLocker created and established a service that runs until the encryption process is complete.

WastedLocker can perform a UAC bypass if it is not executed with administrator rights or if the infected host runs Windows Vista or later.

WastedLocker has copied a random file from the Windows System32 folder to the %APPDATA% location under a different hidden filename.

WastedLocker can execute itself as a service.

WastedLocker has performed DLL hijacking before execution.