Malware.View on attack.mitre.org
WastedLocker is a ransomware family attributed to Indrik Spider that has been used since at least May 2020. WastedLocker has been used against a broad variety of sectors, including manufacturing, information technology, and media.
| Technique | Procedure example |
|---|---|
| T1012 Query Registry |
WastedLocker checks for specific registry keys related to the |
| T1027.013 Encrypted/Encoded File |
The WastedLocker payload includes encrypted strings stored within the .bss section of the binary file. |
| T1027.016 Junk Code Insertion |
WastedLocker contains junk code to increase its entropy and hide the actual code. |
| T1059.003 Windows Command Shell |
WastedLocker has used cmd to execute commands on the system. |
| T1083 File and Directory Discovery |
WastedLocker can enumerate files and directories just prior to encryption. |
| T1106 Native API |
WastedLocker's custom crypter, CryptOne, leveraged the VirtualAlloc() API function to help execute the payload. |
| T1112 Modify Registry |
WastedLocker can modify registry values within the |
| T1120 Peripheral Device Discovery |
WastedLocker can enumerate removable drives prior to the encryption process. |
| T1135 Network Share Discovery |
WastedLocker can identify network adjacent and accessible drives. |
| T1140 Deobfuscate/Decode Files or Information |
WastedLocker's custom cryptor, CryptOne, used an XOR based algorithm to decrypt the payload. |
| T1222.001 Windows Permissions |
WastedLocker has a command to take ownership of a file and reset the ACL permissions using the |
| T1486 Data Encrypted for Impact |
WastedLocker can encrypt data and leave a ransom note. |
| T1490 Inhibit System Recovery |
WastedLocker can delete shadow volumes. |
| T1497.001 System Checks |
WastedLocker checked if UCOMIEnumConnections and IActiveScriptParseProcedure32 Registry keys were detected as part of its anti-analysis technique. |
| T1543.003 Windows Service |
WastedLocker created and established a service that runs until the encryption process is complete. |
None recorded.
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
