Loading malware…
WastedLocker is a Windows ransomware family first observed in May 2020 and attributed to Evil Corp, also known as Indrik Spider. It is deployed in targeted, human-operated intrusions against enterprises, predominantly in the United States. Targets have included professional and legal services, energy, manufacturing, retail, technology, engineering, life sciences, and transportation organizations. Operators prioritize business-critical systems and backup infrastructure to maximize disruption and ransom leverage.
WastedLocker attack chains commonly begin with SocGholish fake software updates distributed through compromised websites. SocGholish establishes initial access and delivers Cobalt Strike, which operators use alongside Windows Management Instrumentation and PsExec for reconnaissance, lateral movement, and subsequent ransomware deployment. These preparatory activities are distinct from the ransomware payload's own functionality.
The ransomware enumerates accessible drives and encrypts files on fixed, removable, shared, and remote storage. Each file receives a newly generated AES-256-CBC key and initialization vector, protected with an embedded RSA-4096 public key. Large files are processed in blocks, while selected directories and file types are excluded. Encrypted files receive victim-specific naming changes and individual ransom notes containing protected key material.
WastedLocker can bypass User Account Control through DLL hijacking, conceal and execute its payload using NTFS alternate data streams, install itself as a Windows service, and modify registry settings associated with access to remote drives. It also deletes shadow copies and volume snapshots and attempts to disable Windows Defender monitoring. Samples have been protected with the CryptOne crypter, which uses multistage decryption and anti-analysis checks. Hades is a later variant with substantial WastedLocker code overlap.
3 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
EvilCorp decided to rename their ransomware operations, so sanctions could no longer be applied. Some of the ransomware names used are WastedLocker, Hades, and Phoenix.
WastedLocker — A ransomware family that has been used against a variety of targets worldwide.
"...shifted to using ransomware variants such as WastedLocker..."
47 distinct techniques documented for this family, organized by ATT&CK tactic.
Ransomware operators are using malicious fake ads for Microsoft Teams updates to infect systems with backdoors... Planting the malicious fake ads that lure unsuspecting users into clicking it to install an update was possible by poisoning search engine results or through malicious online advertisements.
SocGholish is an advanced delivery framework used in drive-by-download and watering hole attacks.
these ransomware attacks overwhelmingly relied on phishes delivering commodity trojan maldocs, such as Zloader, BazarLoader and IcedID
the most commonly observed initial infection mechanism for WastedLocker attacks are ZIP files (likely disguised as legitimate software updates) containing malicious SocGholish JavaScript framework loader components
WastedLocker attackers have also been observed using legitimate Windows utilities such as Windows Management Instrumentation [WMI] and PsExec to do this as well
Additional tools are used to manipulate the file system and suppress any requests for user input and/or confirmation. For example, choice.exe is leveraged to set file attributes as well as delete files. | PowerShell and WMIC are also sometimes utilized in profiling and tuning the environment.
Once executed, the HTA or JS file acts as a preliminary loader, collecting system information and performing anti-analysis checks before using cmd.exe or Powershell.exe to connect to a command and control server to retrieve any secondary payloads for deployment.
[WastedLocker](https://attack.mitre.org/software/S0612) has used [cmd](https://attack.mitre.org/software/S0106) to execute commands on the system.(Citation: NCC Group WastedLocker June 2020)
[WastedLocker](https://attack.mitre.org/software/S0612)'s custom crypter, CryptOne, leveraged the VirtualAlloc() API function to help execute the payload.(Citation: NCC Group WastedLocker June 2020)
These attacks uses sophisticated social engineering lures to convince target user to download and run malware, including ransomware and RATs.
When a user interacts with this content, a ZIP archive containing a heavily obsfuscated HTA or JS file is downloaded to their system. The file is then executed when the user opens the ZIP archive.
Persistence is achieved via system service. However, the service is removed once the encryption process has completed.
[WastedLocker](https://attack.mitre.org/software/S0612) can execute itself as a service.(Citation: NCC Group WastedLocker June 2020)
Denis exploits a security vulnerability to load a fake DLL and execute its code. Empire contains modules that can discover and exploit various DLL hijacking opportunities. PowerSploit contains a collection of Privesc-PowerUp modules that can discover and exploit DLL hijacking opportunities in services and processes.
[WastedLocker](https://attack.mitre.org/software/S0612) has performed DLL hijacking before execution.(Citation: NCC Group WastedLocker June 2020)
[WastedLocker](https://attack.mitre.org/software/S0612) can modify registry values within the <code>Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap</code> registry key.(Citation: NCC Group WastedLocker June 2020)
[WastedLocker](https://attack.mitre.org/software/S0612) created and established a service that runs until the encryption process is complete.(Citation: NCC Group WastedLocker June 2020)
The script converts the decrypted payload (a base64-encoded string) to bytes and allocates memory before executing it.
[WastedLocker](https://attack.mitre.org/software/S0612) created and established a service that runs until the encryption process is complete.(Citation: NCC Group WastedLocker June 2020)
If the payload is executed with non-administrative permissions, it will attempt to elevate privileges via UAC bypass (Mocking Trusted Directories).
[WastedLocker](https://attack.mitre.org/software/S0612) can perform a UAC bypass if it is not executed with administrator rights or if the infected host runs Windows Vista or later.(Citation: NCC Group WastedLocker June 2020)
Hades ransomware is a 64-bit compiled variant of WastedLocker upgraded with supplementary code obfuscation and a few minor feature changes.
One of the more creative ways to disguise threat activity comes in the form of packing software – a technique that applies a packing algorithm on malware to produce a file that is harder to detect, analyze, and prevent.
The [WastedLocker](https://attack.mitre.org/software/S0612) payload includes encrypted strings stored within the .bss section of the binary file.(Citation: NCC Group WastedLocker June 2020)
[WastedLocker](https://attack.mitre.org/software/S0612) contains junk code to increase its entropy and hide the actual code.(Citation: NCC Group WastedLocker June 2020)
The script converts the decrypted payload (a base64-encoded string) to bytes and allocates memory before executing it.
The service is deleted once the encryption process is completed.
[WastedLocker](https://attack.mitre.org/software/S0612)'s custom cryptor, CryptOne, used an XOR based algorithm to decrypt the payload.(Citation: NCC Group WastedLocker June 2020)
The malware finds a clean system file, copies itself to the clean file’s ADS, and then executes itself as a service component of the clean file. This makes it appear that the clean file is the source of the ransomware behavior.
Once executed, the HTA or JS file acts as a preliminary loader, collecting system information and performing anti-analysis checks...
[WastedLocker](https://attack.mitre.org/software/S0612) checked if UCOMIEnumConnections and IActiveScriptParseProcedure32 Registry keys were detected as part of its anti-analysis technique.(Citation: NCC Group WastedLocker June 2020)
This process allows for the ransomware to copy itself into the file by way of an alternate data stream (ADS). | MITRE ATT&CK Hide Artifacts: Hidden Files and Directories T1564
[WastedLocker](https://attack.mitre.org/software/S0612) has copied a random file from the Windows System32 folder to the <code>%APPDATA%</code> location under a different hidden filename.(Citation: NCC Group WastedLocker June 2020)
[WastedLocker](https://attack.mitre.org/software/S0612) has the ability to save and execute files as an alternate data stream (ADS).(Citation: Sentinel Labs WastedLocker July 2020)
Denis exploits a security vulnerability to load a fake DLL and execute its code. Empire contains modules that can discover and exploit various DLL hijacking opportunities. PowerSploit contains a collection of Privesc-PowerUp modules that can discover and exploit DLL hijacking opportunities in services and processes.
[WastedLocker](https://attack.mitre.org/software/S0612) has performed DLL hijacking before execution.(Citation: NCC Group WastedLocker June 2020)
WastedLocker appears to have adopted this technique and that adds an additional layer of obfuscation by doing the entire thing in memory, where it’s harder for a behavioral detection to catch it.
[WastedLocker](https://attack.mitre.org/software/S0612) can modify registry values within the <code>Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap</code> registry key.(Citation: NCC Group WastedLocker June 2020)
Upon launching, and as part of the -r parameter, the ransomware process has to take ownership of the copy of the payload dropped into SYSTEM32. This is achieved via commands similar to the following: takeown.exe /F C:\Windows\system32\Setup2.exe
[WastedLocker](https://attack.mitre.org/software/S0612) has a command to take ownership of a file and reset the ACL permissions using the <code>takeown.exe /F filepath</code> command.(Citation: NCC Group WastedLocker June 2020)
ensuring that they obtain the passwords to disable security tools on a network prior to deploying the ransomware.
[WastedLocker](https://attack.mitre.org/software/S0612) checks for specific registry keys related to the <code>UCOMIEnumConnections</code> and <code>IActiveScriptParseProcedure32</code> interfaces.(Citation: NCC Group WastedLocker June 2020)
facilitate the identification of additional systems on which attackers can deploy their main payloads
Once executed, the HTA or JS file acts as a preliminary loader, collecting system information and performing anti-analysis checks...
[WastedLocker](https://attack.mitre.org/software/S0612) can enumerate files and directories just prior to encryption.(Citation: NCC Group WastedLocker June 2020)
[WastedLocker](https://attack.mitre.org/software/S0612) can enumerate removable drives prior to the encryption process.(Citation: Sentinel Labs WastedLocker July 2020)
[WastedLocker](https://attack.mitre.org/software/S0612) can identify network adjacent and accessible drives.(Citation: Sentinel Labs WastedLocker July 2020)
Once executed, the HTA or JS file acts as a preliminary loader, collecting system information and performing anti-analysis checks...
[WastedLocker](https://attack.mitre.org/software/S0612) checked if UCOMIEnumConnections and IActiveScriptParseProcedure32 Registry keys were detected as part of its anti-analysis technique.(Citation: NCC Group WastedLocker June 2020)
the ransomware proceeds with the encryption but applies the following registry modifications... possibly done to ensure that the ransomware can access remote drives.
Socgholish ... is capable of performing reconnaissance activity and deploying secondary payloads including Cobalt Strike.
[WastedLocker](https://attack.mitre.org/software/S0612) can encrypt data and leave a ransom note.(Citation: Symantec WastedLocker June 2020)(Citation: NCC Group WastedLocker June 2020)(Citation: Sentinel Labs WastedLocker July 2020)
[WastedLocker](https://attack.mitre.org/software/S0612) can delete shadow volumes.(Citation: Symantec WastedLocker June 2020)(Citation: NCC Group WastedLocker June 2020)(Citation: Sentinel Labs WastedLocker July 2020)
BleepingComputer was told that the Garmin IT department had tried to remotely shut down all computers on the network as devices were being encrypted, including home computers connected via VPN.
53 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
93 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.