WastedLocker: technical analysis

[harlan4096]

The use of crypto-ransomware in targeted attacks has become an ordinary occurrence lately: new incidents are being reported every month, sometimes even more often.

On July 23, Garmin, a major manufacturer of navigation equipment and smart devices, including smart watches and bracelets, experienced a massive service outage. As confirmed by an official statement later, the cause of the downtime was a cybersecurity incident involving data encryption. The situation was so dire that at the time of writing of this post (7/29) the operation of the affected online services had not been fully restored.

According to currently available information, the attack saw the threat actors use a targeted build of the trojan WastedLocker. An increase in the activity of this malware was noticed in the first half of this year.

We have performed technical analysis of a WastedLocker sample.

Command line argumentsIt is worth noting that WastedLocker has a command line interface that allows it to process several arguments that control the way it operates.

 -p

Priority processing: the trojan will encrypt the specified directory first, and then add it to an internal exclusion list (to avoid processing it twice) and encrypt all the remaining directories on available drives.

 -f

Encrypt only the specified directory.

 -u username:password \\hostname

Encrypt files on the specified network resource using the provided credentials for authentication.

 -r

Launch the sequence of actions:

1. Delete ;
   
2. Copy to %WINDIR%\system32\.exe using a random substring from the list of subkeys of the registry key SYSTEM\CurrentControlSet\Control\;
   
3. Create a service with a name chosen similarly to the method described above. If a service with this name already exists, append the prefix “Ms” (e.g. if the service “Power” already exists, the malware will create a new one with the name “MsPower”). The command line for the new service will be set to “%WINDIR%\system32\.exe -s”;
   
4. Start this service and wait until it finishes working;
   
5. Delete the service.
   

 -s:

Start the created service. It will lead to the encryption of any files the malware can find.
...

Continue Reading