March 30 2021

LockBitThreat Report
Authored by Bethany Cooper

Table of Contents
Executive Summary3Containment and Remediation

3

Cyber Attack Lifecycle

3

1. Reconnaissance

4

		

Scanning for Point of Entry

4

2. Weaponization

5

3. Delivery

6

4. Exploitation

6

5. Installation

6

6. Command and Control (C2)

7

7. Actions on objectives

7

Threat Intelligence
Originating Country
Malware Analysis

7
7
10

Embedded Data

10

Analysis

12		

Check For Language12

		

Check for Command Line Arguments

13

		

UAC Bypass

14

		

Set Session Registry

17		

Change Wallpaper

21		IOC List

23

3

Executive Summary
Gridware’s incident response team was notified that VICTIM ORG #1 (the victim organisation) wascompromised with LockBit ransomware. Staff found that files on the file server, SQL server anddomain controller were encrypted and appended with the ‘.lockbit’ extension. Ransom notes wereleft demanding payment in exchange for the decryption keys. Gridware was engaged to carry out
containment activities and conduct an investigation of the incident to assess both a) the original pointof entry into the network and b) the potential for data exfiltration to have occurred.
Because the threat actor deleted all of the backups, VICTIM #1 chose to pay the ransom to acquire
all three decryption keys in order to recover critical data from compromised systems. While Gridware
would not recommend that the ransom is paid, in this case, the data that was lost was critical toensuring that VICTIM #1 could continue to operate and minimise the business impact.

Containment and Remediation
Gridware’s first response to being notified of the incident was to schedule a triage call with VICTIM
ORG #1 and MSP #1 (VICTIM #1’s managed service provider). During the triage call, the incident
response team was able to obtain further information to verify an incident had occurred, determine
who was affected, and understand the level of support VICTIM ORG #1 and MSP #1 needed toaddress the incident. This information was integral in formulating a plan to achieve containment in
the environment and minimise the impact to normal business operations. Additionally, an evidence
acquisition request was sent to MSP #1 to ensure that Gridware could collect all required evidence
needed for the forensic investigation.
MSP #1 managed three servers on-premises at VICTIM ORG #1 under a service agreement. These
consisted of the following servers:

Table 1: VICTIM ORG #1
Server List

Endpoint Type

Full Hostname

Operating System

Description

Server

RDP #1

Windows Server 2008 R2 Standard

RDP server

ServerDC #1

Windows Server 2012 R2 Standard

Domain controller

ServerSQL #1

Windows Server 2012 R2 Standard

SQL server for clientand other critical data

500
Workstations

NA

Windows 10 Pro

Employee Laptops

Forensic images were acquired of both RDP #1 and DC #1. However, images could not be acquired of
the SQL server SQL #1 due to the large amount of data stored on this server. Memory dumps weretaken of all servers, however.
Once the evidence was acquired (images of the workstations were not acquired due to time
constraints), Carbon Black EDR sensors were deployed to all systems, beginning with the on-premservers that were encrypted. Carbon Black is a cloud endpoint security solution that is used for
detecting malicious behaviour and preventing further malicious activity when a system has been
compromised. It also includes capabilities for threat hunting and triage which were essential to acquire
data from SQL #1 considering that a forensic image of this system could not be acquired. Gridware’s
incident response team also coordinated with MSP #1 to send out sensor installation requests andinstallation instructions to all users employed by VICTIM ORG #1, both locally and overseas.

Cyber Attack Lifecycle
LockBit is known to operate as a ransomware-as-a-service (RaaS) and therefore, has many different
operator groups with differing methods of intrusion. This report details the operator’s modus operandi
for this incident specifically; this is described in a series of phases in the cyber kill-chain lifecycle, fromthe initial reconnaissance of the victim network to actions on objectives which accomplish the final
goal.

Gridware - LockBit Threat Report. Last Updated June 2021

4Open ports are probed using scanning tool sothat information is gathered about targets
and vulnerabilities are identiﬁed. If access has
been obtained, Advanced Port Scanner and5-NS new.exe are used to scan for additional
hosts within the internal network.

The ransomware drops
ransom note ﬁlesRestore-My-Files.txt and
LockBit-note.hta. These
contain onion links andransom IDs for the ransom
negotiation. The threat actor
demands payment in bitcoin
for decryption keys.

1
Reconnaissance7
Actions On
Objectives

Figure 1: LockBit Cyber
Kill Chain

Persiﬆency ismaintained using
compromised user
credentials. The threat
actor uses these tologin through RDP andissue commands tocompromised targets.

6
Command& Control (C2)2
Weaponization

LockBit Cyber
Kill Chain

5
Installation

3
Delivery4
Exploitation

Threat actor creates a toolset with: mimikatz• batch scripts• Mouse Lock_v22.exe• Everything.ex• Advanced Port Scanner• 5-NS new.exe• the ransomware executable
This custom exploit kit is preparedfor vulnerabilities identiﬁed on thetarget(s). Encryption keys are
generated and bundled with theransomware.

The payload is delivered to thetarget(s).
For the ﬁrst point of entry into
the network RDP01, credentials
for USER-01 are breached orbrute-forced to gain accessthrough open RDP ports.
For delivering payloads laterally
to other systems, credentials
dumped using mimikatz are used
to login to other systems throughRDP from RDP01.

Mimikatz is used to exploit
vulnerabilities in Windows systems
to extract plain-text passwords andhashes from memory.
When the ransomware is executed,
it will delete volume shadow copies
and event log ﬁles to prevent
recovery and obscure evidence.

Registry keys are added to ensure
the ransomware will persist even if
the machine is rebooted.
The ransomware will also propogate
and encrypt network shares it
discovers.
Mouse Lock v22.exe is run to lock themouse cursor, preventing a userfrom interfering with installed tools
and the ransomware.

1. Reconnaissance
SCANNING FOR POINT OF ENTRY
The threat actor used compromised user credentials to log into each target through RDP. How
these credentials were acquired during the reconnaissance phase is unclear. Generally, methods forreconnaissance are either active or passive. Essentially, active methods involve direct interaction withthe target while passive methods do not. Because of this, active reconnaissance is harder to hide andcan be more easily detected by intrusion detection systems (IDS) and blocked by firewalls.
The following are examples of activate reconnaissance methods:• Port scanning using tools such as Nmap, Advanced IP Scanner, etc.
• OS fingerprinting, which tools such as Nmap can carry out. This method is useful for finding
vulnerabilities in systems that have outdated versions of software. In some incidents, we haveeven seen that the source of compromise was a single Windows 7 machine that had not received
critical security updates. Because of these oversights, these systems can be readily exploited bya threat actor who can then move laterally to other systems in the network.
• Brute-forcing passwords to guess credentials
On the other hand, passive reconnaissance is much harder to detect due to minimal interaction
with target systems that result in no footsteps left. The primary mitigation tactic against passive
reconnaissance is pro-active; performing regular vulnerability testing, hardening systems and checking
websites such as Have I Been Pwned1 to ensure sensitive credentials have not been breached.
For example, credentials can be sourced using the following methods:• Shodan• Purchased from black markets on the dark web.
• Extracted from other sources, such as a compromised workstation or an account using the same
credentials that was breached.
1.

Have I Been Pwned: https://haveibeenpwned.com/

Gridware - LockBit Threat Report. Last Updated June 2021

5

Although unrelated to this incident, an example of RDP access being sold on a popular Russian
speaking forum is included in figure 2 below. This is included as an example to demonstrate the risk ofsystem information being sold on the dark web to other threat groups for nefarious purposes.

Figure 2: RDP AccessSold on the Dark Web(unrelated to LockBit)

One of the limitations of this investigation involving LockBit was the difficulty in establishing how thethreat actor obtained credentials for the initial point of entry. The evidence indicates that the threat
actor first accessed RDP #1 using account USER01. It is possible that the credentials for this accountwere obtained using passive methods such as from a phishing email that targeted the user or fromdark web sellers similar to figure 2. However, the system in question had Windows 7 installed, which nolonger receives security updates and therefore is vulnerable to exploitation.

2. Weaponization
On compromised servers, a malicious toolset was deployed. This consisted primarily of tools to scan
for additional hosts in the network, dump credentials for Windows user accounts on compromised
systems, and prevent tampering with the encryption process when the ransomware is executed.
This toolset was deployed to each system compromised by the threat actor and used to carry out
objectives in the latter phases of the incident.
Tool

Description

Mimikatz

Mimikatz is a credential stealing tool used to dump plain-text passwords, NTLM
hashes, tokens, and other details for Windows accounts. This tool was used to dump
plain-text passwords and NTLM hashes on compromised targets

Batch scripts

Batch scripts are used to run Mimikatz to dump credentials and save the output, thendelete Mimikatz executable files

Mouse Lock v2.2

Mouse Lock V2.2 is a program available for download at SourceForge[1] that whenrun, locks the mouse cursor on the screen. A password set when it is run is required to
unlock it and regain access to the system.

Everything (voidtools)

Everything is a tool primarily used to list files and directories recursively on a system.
It can also perform file copy and move operations as well.

Advanced Port Scanner

Advanced Port Scanner is a legitimate network scanning tool used by systemadministrators and IT staff. This tool is used to scan for open ports, services and hosts
residing on a network.

5-NS new.exe

5-NS new.exe is a malicious network scanning tool that was present on compromised
targets. This is an illegitimate tool created by threat actor groups to scan and map
network shares for reconnaissance purposes.

Table 2: LockBit
Operator Toolset

2

3

4

5

6

2.
3.
4.
5.
6.

https://github.com/gentilkiwi/mimikatz
https://sourceforge.net/projects/mouselock/https://www.voidtools.com/
https://www.advanced-port-scanner.com/
https://www.virustotal.com/gui/file/f47e3555461472f23ab4766e4d5b6f6fd260e335a6abc31b860e569a720a5446

Gridware - LockBit Threat Report. Last Updated June 2021

6

3. Delivery
It was found that the threat actor delivered the malicious toolset to compromised systems directly
through RDP. The RDP server RDP #1 was the first system compromised, and the threat actor was able
to use this server as a vantage point within the network. From this, the threat actor could move to otherservers to deliver similar payloads, thereby encrypting as many systems as possible.

4. Exploitation
The batch script files used to run Mimikatz are no longer present and have been deleted by the threat
actor. However, evidence of these was acquired from file carving which shows the contents of scripts
used to run the Mimikatz executable then delete Mimikatz files and the batch file itself. Analysis ofcarved files from unallocated space has uncovered these commands.
@echo offcls
color 03title #3389
cd /d %~dp0

Fast Dump:64
mimikatz.exe “privilege::debug” “log Result.txt” “sekurlsa::logonPasswords”“token::elevate” “lsadump::sam” exit
del kiwi.exe /F /Q
del mimidrv.sys /F /Q
del mimilib.dll /F /Q
del %0

When run, this script will create a command prompt window, clear the command prompt screen (cls),
change the text colour to cyan (color 03) and change the window title to “#3389 Fast Dump”. Then, the
cd command is used to change the working directory to the drive letter and path of the location for thebatch file. The executable mimikatz.exe is then called with the following arguments:• “privilege::debug” - get debug privileges that allow a user to access processes that would
normally be disallowed. Debug privilege is a legitimate security policy setting included to allow
users to attach a debugger to processes or kernel objects. However, this is exploited in Mimikatz
to escalate privileges and dump sensitive credentials from memory.
• “log Result.txt” – use a file named “Result.txt” as a log file that stores everything input/output
using Mimikatz.
• “sekurlsa::logonPasswords” – dump plaintext passwords and hashes from the memory of lsass.
exe for recently logged in and current users. Lsass (Local Security Authority Subsystem Service)
manages the security policy in Windows, including logon events. However, in recent versions ofWindows plaintext passwords are not stored in memory.
• “token::elevate” - elevate privileges to the SYSTEM account by impersonating a token.
• “lsadump::sam” - dump local credentials from the SAM registry hive (requires SYSTEM
privileges).
After mimikatz.exe is executed, the del command is used to delete the Mimikatz files kiwi.exe, mimidrv.
sys and mimilib.dll; the parameters /F and /Q are specified to force deletion of files and specify quiet
mode without any confirmation prompts, respectively. Once it has finished executing, the del commandis invoked to delete the current batch file.
Evidence was acquired from file carving which shows that the file Results.txt contained the output from
the Mimikatz tool used to extract credentials. Analysis of carved files from unallocated space on RDP #1
has uncovered text containing these commands that were run and their output.

5. Installation
Once executed, the ransomware adds itself to the SOFTWARE\Microsoft\Windows\CurrentVersion\Runregistry key and will remove itself from this key once execution has completed. This is so that if thesystem is shutdown or restarted while the ransomware is encrypting files, it will resume execution oncethe system boots again.
To run itself with escalated privileges without being detected, the Lockbit ransomware implements UAC

Gridware - LockBit Threat Report. Last Updated June 2021

7

bypass using the ICMLuaUtil COM interface and the ColorDataProxy COM object. This is so that theransomware can obtain elevated privileges without a UAC prompt being displayed to the user, thereby
alerting them to the threat actor’s presence.

6. Command and Control (C2)
The threat actor maintains persistency on systems using compromised user credentials. Because RDP
ports on the compromised RDP server RDP #1 were forwarded to the external internet, the threat actor
could use this server as an entry point and move laterally to other servers using compromised domain
administrator account USER #1.

7. Actions on Objectives
The previous phases of the incident were carried out to accomplish the threat actors main goal – toextort funds from the victim for financial gain. Threat intelligence on the LockBit group indicatesthat the developers of the ransomware offer LockBit as a ransomware as a service (RaaS) offering tobuyers. This is a business model that offers a subscription type of service to affiliates who operateransomware7. These affiliates receive a portion of each successful ransomware payment that is madewhich is split with the LockBit developers. Based on this information, it can be concluded that theoperators of LockBit are financially motivated with the main goal being to force the victim into paying
the ransom to decrypt their files.
For each directory of files encrypted, the LockBit ransomware will drop a ransom note text file that
contains the steps for paying the ransom and the URLs for the LockBit website that facilitates this. A
ransom note in the form of a HTML application file is placed on the desktop with similar contents. The
desktop wallpaper is also altered, directing the victim to see the ransom note text file that has been
dropped in each directory.
In some cases, the threat actor behind LockBit has also been known to threaten to leak data publicallyif the ransom is not paid. Previously, LockBit had banded together with the now-disbanded Maze groupto leak stolen data on the Maze “public-shaming” site. The LockBit developers eventually separated andstarted their own data leak site8; however, the website has been down as of writing this.

Threat Intelligence
ORIGINATING COUNTRY
Further analysis was undertaken to determine the background and nationality of the LockBit
developers and affiliates. One of the key pieces of evidence was present in the ransomware code,
where it was found that the ransomware will cease execution if it detects that the default language ofthe system indicates the user is within one of the Commonwealth of Independent States (CIS).
Table 3: Language
Localities Checked with
Timezones

Language

Location (ortype)

Timezone

Azerbaijani (Cyrillic)Azerbaijan

UTC +4

Azerbaijani (Latin)

Azerbaijan

UTC +4

Armenian

Armenia

UTC +4Belarusian

Belarus

UTC +3

GeorgianGeorgia

UTC -5

KazakhKazakhstan

UTC +6 (East) or
UTC +5 (West)

KyrgyzKyrgyzstan

UTC +6

Russian

Moldova

UTC +27.
8.

Language

Location (ortype)

Timezone

RussianRussiaRange fromUTC +2 to UTC+12

Tajik (Cyrillic)

Tajikistan

UTC +5

TurkmenTurkmenistan

UTC +5

Uzbek (Cyrillic)

Uzbekistan

UTC +5

Uzbek (Latin)

Uzbekistan

UTC +5

Ukrainian

UkraineUTC +2

Crowdstrike - Ransomware as a Service (RaaS) Explained: https://www.crowdstrike.com/cybersecurity-101/ransomware/ransomware-as-a-service-raas/
Bleeping Computer - LockBit ransomware launches data leak site to double-extort victims: https://www.bleepingcomputer.com/news/security/lockbit-ransomware-launches-data-leak-site-to-double-extort-victims/

Gridware - LockBit Threat Report. Last Updated June 2021

8

To acquire all three decryption keys, this required negotiation with the threat actor on the LockBit
website. A record of approximate times was kept to determine approximately what time zone thethreat actor is based in based on their working hours.
Based on the below times, the threat actor is likely least active from approximately 5 PM to 6 AM (UTC).
If it is assumed that the threat actor follows a typical working day, then these working hours best alignwith Russian time zones, particularly Moscow Time at UTC+3. Additionally, threat intelligence currently
indicates that the LockBit developers are Russian based, especially because they choose not to target
CIS countries much like other Russian threat groups. However, further evidence is needed to determine
this with certainty and this is not likely to be uncovered while the threat actor is still at large.
Table 4: Record of
Messages Between
Threat Actor and
Gridware/Victim

SenderTimestamp (UTC)

Message

Key

VT

Day 1 at 3 am

Hey, I was just curious as to how I can recover my files?

SQL_
KEY

VT

Day 1 at 4 am

Hello, is anyone there?

SQL_
KEY

TA

Day 1 at 7 am

Hello sir

SQL_
KEY

TA

Day 1 at 7 am

Please answer the questions: 1) How many computers
do you need to decrypt? 2) How many gigabytes of
information were on these computers?

SQL_
KEY

VT

Day 3 at 10 am

No, I need 2 computers decrypted

DC_KEYTA

Day 3 at 11 amSir, the cost of decrypting 2 computers is 19,000 BTC.
And you only sent 15,000 BTC. You need to pay another
4,000 BTC I think I understand what the mistake is.
Apparently you decided that the cost of 2 computerswill be 15,000 BTC because for three computers I
announced the price of 19,000 BTC. I apologize, thecost of decrypting two servers is 17,000 BTC You needto pay an additional 2,000 BTC so that I can decrypt 2
computers for you

DC_KEYVT

Day 3 at 12 pm

Decrypting two computers is 16,000 BTC

DC_KEYVT

Day 3 at 12 pm

You wanted 8,000 BTC per computer?

DC_KEYTA

Day 3 at 12 pm

okay. You're right. I was wrong in counting

DC_KEYTA

Day 3 at 12 pm

So you need to send another 1,000 BTC. The wallet isthe same

DC_KEYTA

Day 3 at 12 pm

In order to prepare the correct decryption keys, I needto know the id of the computers you want to decrypt.
The IDs are indicated in the links in the TXT files onthese computers. Each computer has an individual link

DC_KEYTA

Day 3 at 5 pm

please give me the IDs of computers that you want todecrypt

DC_KEYTA

Day 4 at 7 am

I would like to decrypt your first computer. Tell me thecomputer with which ID you want to decrypt

DC_KEYVTDay 4 at 8 am

Do you mean the numbers and letters after the link?
It has {REDACTED DC_KEY} and we want to decrypt
the sql server SQL #1 and then we will send 1,000 BTC
tomorrow for the domain controller if it works

DC_KEYTA

Day 4 at 9 am

So you need the decryptor key from this computer,right?

DC_KEYTA

Day 4 at 9 am

What is the ID specified in the TXT files of the SQL
server?

DC_KEYTA

Day 4 at 9 am

Now I send you the decryption key for this computer.
You must download and run it with a double click.
Computer decryption time takes no more than 2 hours
on average

DC_KEYVTDay 4 at 9 am

ok where are you sending it? is that the right id?

DC_KEY

Gridware - LockBit Threat Report. Last Updated June 2021

9

SenderTimestamp (UTC)

MessageKeyTA

Day 4 at 10 am

the download link is at the bottom of this page. Turn
off your antivirus to download the file. ID is right

DC_KEYTA

Day 4 at 10 am

I sent the key for the id that you specified

DC_KEYVTDay 4 at 3 am

We paid 1,000 BTC, can we get the key for ID{REDACTED SQL_KEY} please?

DC_KEYTADay 5 at 6 am

You need to open the link for this id, then decrypt thetest file and write to me

DC_KEYVT

Day 6 at 3 am

Hey, can we please get the key for ID {REDACTED SQL_
KEY}? We have paid the amount you requested.

SQL_
KEY

TA

Day 6 at 8 am

You need to decrypt the test file so that I can send you
the correct key

SQL_
KEY

VT

Day 7 at 3 am

There isn't any place to upload the test file like on theother site

SQL_
KEY

VT

Day 7 at 3 am

Is there any way I can send it to you or upload it?

SQL_
KEY

VT

Day 8 at 1 am

Hey, could we please get the decryption key for{REDACTED SQL_KEY}?

SQL_
KEY

TA

Day 8 at 7 am

In order for me to submit the correct key for this ID,
you need to upload a test file. Apparently you cannot
upload the file due to an error on the site. Give mesome time. I'll fix the error so you can upload the test
file

SQL_
KEY

VT

Day 9 at 12 am

Thanks - Please let me know when this is fixed.

SQL_
KEY

VT

Day 9 at 5 am

Hi again, could you please let me know how can I get
the encryption key for {REDACTED RDP_KEY}?

RDP_
KEY

VT

Day 9 at 6 am

Hello. What would we need to do to get you thesample file? We would really like to get the decryption
key for {REDACTED SQL_KEY}.

SQL_
KEY

TA

Day 9 at 6 am

The cost of decrypting key for {REDACTED RDP_KEY} is
5,000 BTC

RDP_
KEY

TA

Day 9 at 6 am

You need to send 5,000 in BTC to the wallet
1KsiEH5ZrfS3XhLVUU758rMKnP65kz2GYz

RDP_
KEY

TA

Day 9 at 7 am

I need some more time to fix the error loading the test
file. Please wait some more

SQL_
KEY

VT

Day 9 at 8 am

Thanks, please let me know when it is ready

SQL_
KEY

VT

Day 9 at 11 am

Hey, I have uploaded the correct file. Will you send me
the decryptor now? Thanks for fixing the error.

SQL_
KEY

TA

Day 9 at 1 pm

Sending a key

SQL_
KEY

VT

Day 11 at 9 am

Hey, we will organise payment for tomorrow, will you
send us the key then?

RDP_
KEY

TA

Day 11 at 11 am

I will send you the key immediately after payment

RDP_
KEY

VT

Day 15 at 1 am

We have sent the payment to that wallet, could you
please send us the decryptor for {REDACTED RDP_
KEY}?

RDP_
KEY

TA

Day 15 at 6 am

Sending the key

RDP_
KEY

Gridware - LockBit Threat Report. Last Updated June 2021

10

Malware Analysis
The LockBit ransomware executable was analysed using the following methods:• Static analysis methods to examine the decompiled code.
• Dynamic analysis methods to execute the ransomware within a virtual machine and examine its’
behaviours.
This section details a summary of findings based on this technical analysis.

Embedded Data
Strings were extracted from the ransomware executable and deobfuscated. It was found that bothransom notes in text and HTML Application (HTA) format respectively were present. This is contained
within the ransomware executable and is deobfuscated then dropped in each directory with encrypted
files.
Figure 3: Screenshot of
Section of HTA Ransom
Note

The HTA ransom note extracted can be viewed as a HTA application file. Notably, it contains the surface
web link http://lockbit-decryptor.top/?12345678911234567891123456789112 and the onion link http://
lockbitks2tvnmwk.onion/?12345678911234567891123456789112 for ransom negotiation. The ID 12345
678911234567891123456789112 appended to the end of these links is likely to be a placeholder for theactual ransom ID generated for each encrypted machine.

Gridware - LockBit Threat Report. Last Updated June 2021

11

Figure 4: Screenshot
of HTA Ransom Note
Extracted

The text file ransom note also contains the surface web link and onion link to access the ransom
negotiation site. However, the placeholder ID is not present.
Figure 5: Screenshot of
TXT File Ransom Note

Commands run embedded within executable to delete volume shadow copies, edit the boot statuspolicy, clear system state backups and clear Windows event logs. These commands were executed to
do the following:• Run cmd.exe• Run commands to delete volume shadow copies using vssadmin.exe with “all” and “quiet” flags
enabled.
• Use wmic to delete shadow copies• Edit the Boot Configuration Data (BCD) using BCDEdit. Set the boot status policy to“IgnoreAllFailures” “recoveryenabled No” to disable automatic repair on startup.
• Delete the system state backups using wbadmin• Clear system, security and application logs in Windows Event Viewer using wevtutil.

Gridware - LockBit Threat Report. Last Updated June 2021

12

cmd.exerunas/c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default}
recoveryenabled no & wbadmin delete catalog -quiet/c vssadmin Delete Shadows /All /Quiet/c bcdedit /set {default} recoveryenabled No/c bcdedit /set {default} bootstatuspolicy ignoreallfailures/c wbadmin DELETE SYSTEMSTATEBACKUP/c wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest/c wmic SHADOWCOPY /nointeractive/c wevtutil cl security/c wevtutil cl system/c wevtutil cl application
Volume Shadow Copy & Event log clean
There are also embedded commands which are used to delete itself after halting execution. Because
the running executable cannot delete itself, it opens a new cmd.exe process and sends three pingrequests to localhost (127.0.0.1) to give the calling process (the ransomware currently running) time toexit. Then, the ransomware executable file is zeroed out (fsutil file setZeroData offset=0 length=524288“%s”) and the file is deleted (Del /f /q “%s”).
cmd.exey /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288“%s” & Del /f /q “%s”

Analysis
CHECK FOR LANGUAGE
When the ransomware executed, it checks for the default language of the system and current
user using the Windows API calls GetSystemDefaultUILanguage and GetUserDefaultUILanguage,
respectively. If the language code identifier (LCID) is of one of the localities specified, the program will
exit. Otherwise, the function will return, and the ransomware will continue execution.

Figure 6: Functions to
Check Language

Gridware - LockBit Threat Report. Last Updated June 2021

13

Below are all LCIDs checked for by the ransomware for each corresponding hex value. Notably, all of
the LCIDs checked are for those countries that are members of the Commonwealth of Independent
States (CIS). This is commonly seen in ransomware operated by groups originating from Russia, whoavoid targeting CIS countries to avoid drawing attention from the government.
Language

Location (or type)

Language ID

Language Tag

Azerbaijani (Cyrillic)Azerbaijan

0x082C

az-Cyrl-AZ

Azerbaijani (Latin)

Azerbaijan

0x042Caz-Latn-AZ

Armenian

Armenia

0x042B

hy-AM

Belarusian

Belarus0x0423

be-BY

GeorgianGeorgia

0x0437ka-GE

KazakhKazakhstan

0x043F

kk-KZ

KyrgyzKyrgyzstan

0x0440ky-KG

Russian

Moldova

0x0819ru-MD

RussianRussia0x0419ru-RU

Tajik (Cyrillic)

Tajikistan

0x0428tg-Cyrl-TJ

TurkmenTurkmenistan

0x0442tk-TM

Uzbek (Cyrillic)

Uzbekistan

0x0843uz-Cyrl-UZ

Uzbek (Latin)

Uzbekistan

0x0443uz-Latn-UZ

Ukrainian

Ukraine0x0422

uk-UA

Table 5: Language IDs
Checked by LockBit

CHECK FOR COMMAND LINE ARGUMENTS
The LockBit ransomware will check if any parameters are added at the command line upon being
executed, for example like below:
C:\LockBit_ransomware.exe parameter
If no command line parameters are entered, then CommandLineToArgvW9 will return the name/path ofthe executable – meaning that this will return 1 argument. This means that the following line of code
present in the LockBit ransomware will check if there is only one argument (less than 2) and return 0
if there is. Execution will only continue if no parameters are entered. It is unknown why it does this,however it could possibly be to evade security researchers who attempt to execute it with parameters
to determine if LockBit has any debug features.

9.

CommandLineToArgvW function (shellapi.h): https://docs.microsoft.com/en-us/windows/win32/api/shellapi/nf-shellapi-commandlinetoargvw

Gridware - LockBit Threat Report. Last Updated June 2021

14

Figure 7: Functions to
Check No. of Command
Line Parameters

UAC BYPASS
To run with escalated privileges without being detected, the ransomware attempts to elevate privileges
via UAC Bypass. User Account Control (UAC) is an access control feature in Microsoft Windows which
requires that each program that needs administrator privileges must prompt the user for consent. UAC
bypass sidesteps this requirement, allowing the ransomware to obtain elevated privileges without a
UAC prompt being displayed to the user, thereby reducing the risk of detection.

Figure 8: LockBit
Injecting Into Windows
Explorer

Firstly, the ransomware masquerades itself as the explorer.exe process by injecting its code into it.

Gridware - LockBit Threat Report. Last Updated June 2021

15

Figure 9:
XOR’d explorer.exe

Notably, the string “explorer.exe”, is XOR’ed with 0x5 to obfuscate the ransomware’s injection attempt.
Then, the COM library is initialised, and the ransomware uses a Windows COM object to obtainadministrator access.
Figure 10: COM
Initialised

The COM objects exploited in this case are obfuscated using XOR encryption. The strings referenced are
below:
Table 6: COM Strings
Referenced

Strings"Software\\Microsoft\\Windows NT\\CurrentVersion\\ICM\\Calibration"“DisplayCalibrator”"{3E5FC7F9-9A51-4367-9063-A120244FBEC7}""{D2E7041B-2927-42fb-8E9F-7CE93B6DC937}"

The strings {3E5FC7F9-9A51-4367-9063-A120244FBEC7} and {D2E7041B-2927-42fb-8E9F-7CE93B6DC937}
are both COM interfaces vulnerable to UAC bypass. These refer to the ICMLuaUtil COM interface andthe ColorDataProxy COM object, respectively. The full registry key Software\\Microsoft\\Windows
NT\\CurrentVersion\\ICM\\Calibration\\DisplayCalibrator is written to by dllhost to execute the UAC
bypass. This will allow the ransomware to elevate to administrative permissions without displaying a
prompt to the user.
Execution of the ransomware shows that queries were made for the COM interface {3E5FC7F9-9A514367-9063-A120244FBEC7}.
The process svchost.exe checks if elevation is enabled for “” in registry key HKCR\CLSID\{3E5FC7F9-

Gridware - LockBit Threat Report. Last Updated June 2021

16

Figure 11: Dynamic
Analysis - COM
Interface Queries

9A51-4367-9063-A120244FBEC7}\Elevation\Enabled. If enabled, this means that interfaces based on thisCOM class can run with elevated privileges without additional user prompts.

Figure 12: Check
Elevation Enabled

Consent.exe process started shortly after. Consent.exe checks the values for sufficient permissions for
COM object.

Gridware - LockBit Threat Report. Last Updated June 2021

17

Figure 13: Check
Elevation Enabled

The command C:\Windows\system32\DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}
is invoked to change the value of registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
ICM\Calibration\DisplayCalibrator to C:\Users\hithere\Desktop\9AE2456EE17245AA.exe.

Figure 14: Add LockBit to
DisplayCalibrator Key

SET SESSION REGISTRY
Numerous registry subkeys are added to the key SOFTWARE\LockBit which act as markers for the
specific system that the ransomware was run on.
An obfuscated string present is xor’d with the hexadecimal value 0x29 to give the deobfuscated string
SOFTWARE\LockBit. The RegCreateKeyExA10 function is called Taking SOFTWARE\LockBit as a parameterto create this registry key under HKEY_CURRENT_USER.

10.

RegCreateKeyExA function (winreg.h): https://docs.microsoft.com/en-us/windows/win32/api/winreg/nf-winreg-regcreatekeyexa

Gridware - LockBit Threat Report. Last Updated June 2021

18

Figure 15: XOR’d
SOFTWARE\LockBit

The ransomware will check for the existence of values full and Public using the RegQueryValueExA11
Windows function to query for the existence of these registry values under the SOFTWARE\LockBit
registry key. If both function calls return ERROR_SUCCESS (error 0x0) then the while loop will break.

Figure 16: Check for
Session Registry Keys

If the subkeys full and Public do not exist under SOFTWARE\LockBit, the Windows function
RegSetValueExA12 is called to set these registry keys. The RegCloseKey13 Windows function is thencalled to close the handle to the SOFTWARE\LockBit registry key.

11.
12.
13.

RegQueryValueExA function (winreg.h): https://docs.microsoft.com/en-us/windows/win32/api/winreg/nf-winreg-regqueryvalueexa
RegSetValueExA function (winreg.h): https://docs.microsoft.com/en-us/windows/win32/api/winreg/nf-winreg-regsetvalueexa
RegCloseKey function (winreg.h): https://docs.microsoft.com/en-us/windows/win32/api/winreg/nf-winreg-regclosekey

Gridware - LockBit Threat Report. Last Updated June 2021

19

Figure 17: Set
Session registry Keys

Figure 18: Dynamic
Analysis - Update
run, full, public

Dynamic analysis shows that during execution of LockBit, the run, full and Public keys were updated

NETWORK CONNECTIONS
Another interesting feature of the LockBit ransomware is its ability to scan for other hosts to profilitate
the ransomware. On the current system, the GetLogicalDrives function is called to retrieve a bitmask ofcurrently available drives in order to list all available drives on the system.

Figure 19:
GetLogicalDrives
Function

The list of drives is enumerated to check if any are network shares using the method GetDriveTypeW. If
the drive type returned is equivalent to 4 (DRIVE_REMOTE) then this means that it is a remote (network)
drive14.

Figure 20: Check for
DRIVE_REMOTE

14.

GetDriveTypeW function (fileapi.h): https://docs.microsoft.com/en-us/windows/win32/api/fileapi/nf-fileapi-getdrivetypew

Gridware - LockBit Threat Report. Last Updated June 2021

20

If the drive found is a network share, the following will occur:• The name associated with the network resource will be retrieved using the function
WNetGetConnectionW15. The trailing backslash is removed from the remote name using thefunction PathRemoveBackslashW16.
• The functions OpenThreadToken17 and DuplicateToken18 are used the open the access token
associated with the current thread and duplicate it if it is already in existence, respectively.
• A new thread is creating within the virtual address space of the calling process using thefunction CreateThread, the remote name retrieved previously using WNetGetConnectionW ispass as a variable to this thread.
• The next method in the executable is called, which will be referred to as FUN_enum_share2 forthis analysis.

Figure 21: Get
Network Resource

The functions WNetOpenEnumW and WNetEnumResourceW are used to enumerate network shares.
Following this, for each share discovered, the ransomware will create new threads and prepare to
encrypt them.

15.
16.
17.
18.

WNetGetConnectionW function (winnetwk.h): https://docs.microsoft.com/en-us/windows/win32/api/winnetwk/nf-winnetwk-wnetgetconnectionw
PathRemoveBackslashW function (shlwapi.h): https://docs.microsoft.com/en-us/windows/win32/api/shlwapi/nf-shlwapi-pathremovebackslashw
OpenThreadToken function (processthreadsapi.h): https://docs.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-openthreadtoken
DuplicateToken function (securitybaseapi.h): https://docs.microsoft.com/en-us/windows/win32/api/securitybaseapi/nf-securitybaseapi-duplicatetoken

Gridware - LockBit Threat Report. Last Updated June 2021

21

Figure 22: Enumerate
Network Drives

CHANGE WALLPAPER
A wallpaper is dropped by the ransomware and is set for the current user it is running under. The
wallpaper is a BMP file dropped in %USERPROFILE%\{CURRENT USER}\AppData\Local\Temp\, where{CURRENT_USER} is the user account that executed the ransomware. Interestingly, methods from theWindows GDI+ C\C++ interface are used to set the wallpaper’s text, size and other aspects based on
attributes of the current system (e.g. display resolution).

Figure 23:
GDI+ Example

Gridware - LockBit Threat Report. Last Updated June 2021

22

Figure 24:
Dynamic Analysis- Screenshot ofRansom Wallpaper

Above is a screenshot that shows the LockBit wallpaper set after running the ransomware within avirtual machine. Take note of the files present on the desktop, which include the encrypted test files(copies of CUDA_C_Programming_Guide.pdf that have been encrypted) and the HTA ransom note.

Gridware - LockBit Threat Report. Last Updated June 2021

23

IOC List
Table 7: List of IOCs Related to this Incident
IOC TypeIOC

MD5

SHA256

SHA1 (if applicable)

Ransomware
Executable

9AE2456EE17245AA.
exe

595BA10B0C0D15994AF5A6EE8F4E8A03
595BA10B0C0D15994AF5A6EE8F4E8A03

D6F3E0D9661399BEB4839745F61BA0B59847686CAC81E6C3D04149C530025EDD

N/A

Malicious Executable

Mouse Lock_v22.exe

FC9C80E1767E1266056B1B2C89A74CE5

F3AD7F8F00FFE7EFCE17F6B5B8667EF82C6DF2C655BBAFA9B637657465403A85

N/A

Malicious Tool

Mimikatz

N/A

N/A

N/A

Script Excerpt

mimikatz.exe "privilege::debug" "logResult.txt" "sekurlsa::logonPasswords""token::elevate""lsadump::sam" exit

N/A

N/A

N/A

Script Filefast_dump_batch_
script(carved).txt

ssssssss8AFFE809A04CE83E9938F524F684E04A

A76DFF25C7876DD5F2ED91B272437FF9FE8E45CD687790D2DB5A71D6B0245B52

N/A

Onion Link

http://lockbitks2tvnmwk.onion

N/A

N/A

N/A

Clear Web Link

lockbit-decryptor.top

N/A

N/A

N/A

IPv4 Address

179.43.156.23

N/A

N/A

N/A

IPv4 Address

217.171.147.73

N/A

N/A

N/A

Executable(from Amcache)

5-NS new.exe

N/A

N/A

629c9649ced38fd815124221b80c9d9c59a85e74

Executable(from Amcache)

Everything.exe

N/A

N/A

1a0557d8d1678d26e4494ccbe9bb1b9010889668

Executable(from Amcache)

Advanced_Port_Scanner_2.5.3869.exe

N/A

N/A

3477a173e2c1005a81d042802ab0f22cc12a4d55

Executable(from Amcache)advanced_port_scanner.exe

N/A

N/A

763499b37aacd317e7d2f512872f9ed719aacae1

Gridware - LockBit Threat Report. Last Updated June 2021

Sydney
Level 12, Suite 6
189 Kent Street
Sydney NSW 2000(02) 9158 7304
Melbourne
Level 13, 114 William Street
Melbourne, VIC 3000
(03) 9020 7626

GRIDWARE.COM.AU
INFO@GRIDWARE.COM.AU