Malware Evolution – Analyzing LockBit 2.0

LockBit Around the Globe

The latest and most publicized LockBit 2.0 attack is on the global consulting company Accenture, along with other companies from the United States, China, Italy, Africa, Japan, Australia, and several European countries.

Each LockBit victim has a limited time to pay the ransom to prevent their stolen files from being published:

Technical Analysis

The LockBit gang has implemented several measures to slow down analysis in the newest version of their notorious ransomware. One method used is to obfuscate the binary itself. LockBit uses an FNV hashing algorithm to decrypt the API which is dynamically resolving.

The dynamic function resolution procedure starts by decrypting the pointer of the desired function using the decryption tool, storing the pointer in a register, and invoking it directly from the register:

The decryption function is invoked and then the API is invoked from the register

Part of the FNV (Fowler-Noll-Vo) decryption function

Once the decryption is completed, the pointer to the API function is stored at the EAX (or ECX) register for execution:

Another tricky method used by LockBit is the termination of Process Hacker, Process Monitor, and other processes that analyze and monitor utilities to to prevent them from detecting it among other running applications and processes:

Once it gets started, LockBit deletes important records and backups from the host to prevent victims from recovering from the attack. The rarnsomware then transfers its execution through a COM before continuing its anti-recovery activities.

– “vssadmin delete shadows /all /quiet” – deletes all the shadows copies from the host.

– “bcdedit /set {default} bootstatuspolicy ignoreallfailures” – Ignores failures in the boot time (LockBit is executed on boot as part of the persistence).

– “bcdedit /set {default} recoveryenabled no” – prevents from the user to enter Windows 10 recovery boot option.

LockBit generates SID, and uses it to set a persistence in the Run key at the registry which allows execution each time the host boots up:

LockBit 2.0 comes with an icon for encrypted files. The ransomware associates the icon with every “.lockbit” file in the registry:

Setting registry key associated with default icons

Setting value in the created key with the icon path

The ransomware sets two more registry entries which include additional data for the encryption process:

As part of the spreading process, LockBit enumerates additional hosts within the network:

and tries to establish SMB connection (port 445) to spread the malicious file across the host network:

Initiate SMB connection with host found in the network

In addition to spreading via SMB, LockBit utilizes Powershell to publish group-policy updates within the domain to further spread the ransomware file:

The ransomware disables the security software on the host through the registry by setting values related to enabling/disabling the software:

After finishing the encryption procedure, the ransomware drops a file containing details for the victim of how to restore their files and send them for printing.

The module that contains the API for printing is resolved and loaded through the FNV decryption performed at the beginning of the execution:

EAX contains the module name after decryption, ECX contains the location of “LoadLibrary”

As described earlier, when the encryption procedure is finished, the command for printing the documents is executed:

Printing commands

File’s path: C:\Users\[USERNAME]\AppData\Local\Microsoft\Windows\INetCache

LockBit drops an HTA file called “LockBit_Ransomware.hta” which contains the page presented to the user in the application window opened by the ransomware:

LockBit 2.0 Attack-Chain

MITRE Techniques Map

Cynet VS LockBit 2.0

LockBit 2.0’s techniques allow it not only to stay hidden from the user/analyst’s eye but also to prevent recovery and set up persistence.

Cynet is able to detect and block LockBit and the encryption process itself using the following detection mechanisms:

Detection Engine – Malicious Binary – Infected File- File Dumped on the Disk / Attempt to run

This alert triggers when Cynet’s AV/AI engine detects a malicious file that was dumped on the disk.

LockBit 2.0 executable dropped on the host

LockBit 2.0 executable executed on the host

Ransomware Heuristic

This alert triggers when Cynet detects suspicious behavior which can be associated with Ransomware (such as changing file extensions to “.Lock”).

LockBit 2.0 encrypting files and blocked by Cynet

Malicious Process Command

This alert triggers when Cynet detects a CMD process which executes a command that contains suspicious arguments or is associated with malicious patterns.

LockBit 2.0 and other ransomware in the wild delete the backups used to recover the system to prevent data loss. Cynet is able to detect and block those operation:

VSSADMIN used to delete all shadows copies from the host

Memory Pattern

This alert will trigger when a file is loaded to the memory and will run on its memory unique strings related to a malware.

Conclusions

The LockBit gang has utilized not only digital approaches for spreading the ransomware, but also attempts to attack through the human vector.

The ransomware evolution to version 2.0 is interesting, from the obfuscation in the code and the termination of monitoring applications or security products to behaviors observed during the analysis, it is important to have security products that are able to detect similar behaviors and block them before sensitive data is lost.

IOCs