Ransom.Win32.LOCKBIT.ENK

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Se ejecuta y, a continuación, se elimina.

Detalles de entrada

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Instalación

Crea las siguientes copias de sí mismo en el sistema afectado:

• {Desktop or temp folder of connected devices}\{Random characters}.exe

Infiltra los archivos siguientes:

• {Drive}\{Random characters}.lock
• %System%\{Random characters}.ico (Icon image for encrypted files)
• %User Temp%\{Random characters}.tmp.bmp (Background image)

(Nota: %System% es la carpeta del sistema de Windows, que en el caso de Windows 98 y ME suele estar en C:\Windows\System, en el caso de Windows NT y 2000 en C:\WINNT\System32 y en el caso de Windows 2000(32-bit), XP, Server 2003(32-bit), Vista, 7, 8, 8.1, 2008(64-bit), 2012(64bit) y 10(64-bit) en C:\Windows\System32).

Agrega los procesos siguientes:

• "%System%\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no (Process to delete shadow files)
• "%System%\cmd.exe" /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 "{Malware file path and name}" & Del /f /q "{Malware file path and name}" (Process to delete itself)
• "%System%\mshta.exe" "%Desktop%\LockBit_Ransomware.hta" {GUID} (Process to display ransom note)
• powershell.exe -Command "Get-ADComputer -filter * -Searchbase '%s' | foreach{ Invoke-GPUpdate -computer $_.name -force -RandomDelayInMinutes 0}" (Process to query connected machines and invoke group policy update)

(Nota: %System% es la carpeta del sistema de Windows, que en el caso de Windows 98 y ME suele estar en C:\Windows\System, en el caso de Windows NT y 2000 en C:\WINNT\System32 y en el caso de Windows 2000(32-bit), XP, Server 2003(32-bit), Vista, 7, 8, 8.1, 2008(64-bit), 2012(64bit) y 10(64-bit) en C:\Windows\System32).

Se ejecuta y, a continuación, se elimina.

Técnica de inicio automático

Agrega las siguientes entradas de registro para permitir su ejecución automática cada vez que se inicia el sistema:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
{GUID} = "{Malware file path and name}" (Initial value before encryption finishes)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
{GUID} = "%Desktop%\LockBit_Ransomware.hta"

Otras modificaciones del sistema

Agrega las siguientes entradas de registro:

HKEY_CURRENT_USER\Software\{Random characters}
Private = {Generated session key}

HKEY_CURRENT_USER\Software\{Random characters}
Public = {Generated session key}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.lockbit
(Default) = LockBit

HKEY_CLASSES_ROOT\.lockbit
(Default) = LockBit

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.lockbit\DefaultIcon
(Default) = %System%\{Random characters}.ico

HKEY_CLASSES_ROOT\Lockbit\shell\
Open\Command
(Default) = "%System%\mshta.exe" "%Desktop%\LockBit_Ransomware.hta"

HKEY_CURRENT_USER\Control Panel\Desktop
Wallpaper = %User Temp%\{Random characters}.tmp.bmp

HKEY_CURRENT_USER\Control Panel\Desktop
WallpaperStyle = 2

HKEY_CURRENT_USER\Control Panel\Desktop
TileWallpaper = 0

Este malware establece la imagen siguiente como fondo de escritorio del sistema:

Otros detalles

Agrega las siguientes entradas de registro como parte de la rutina de instalación:

HKEY_CURRENT_USER\Software
{Random characters} =

HKEY_LOCAL_MACHINE\SOFTWARE\Classes
.lockbit =

HKEY_CLASSES_ROOT
.lockbit =

HKEY_CLASSES_ROOT
Lockbit =

Hace lo siguiente:

• It enumerates printers in the network to print the ransom note.
• It uses LDAP queries and connected network shares/volumes to collect connected machines in the network.
• It performs a group policy update to connected machines for propagation and execution.
• It performs SMB queries by connecting to {Random IP in the network}:445 for propagation and execution.
• It creates a scheduled task with random file name to execute the copied ransomware and terminate processes.
• It bypasses UAC to escalate its privileges on infected machines.
• It modifies the following files inside the SYSVOL folder for modification of group policies:
  • Registry.pol
  • comment.cmtx
  • NetworkShares.xml
  • Services.xml
  • ScheduledTasks.xml
• It pushes the following group policy updates to disable malware protection on queried machines:
  • [Software\Policies\Microsoft\Windows Defender;DisableAntiSpyware]
  • [Software\Policies\Microsoft\Windows Defender\Real-Time Protection;DisableRealtimeMonitoring]
  • [Software\Policies\Microsoft\Windows Defender\Spynet;SubmitSamplesConsent]
  • [Software\Policies\Microsoft\Windows Defender\Threats;Threats_ThreatSeverityDefaultAction]
  • [Software\Policies\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction]
  • [Software\Policies\Microsoft\Windows Defender\UX Configuration;Notification_Suppress]
• It terminates the following processes and services with the following strings in their paths:
  • 360doctor
  • 360se
  • acwebbrowser
  • adexplorer
  • adexplorer64
  • adexplorer64a
  • adobe cef
  • adobe desktop service
  • adobecollabsync
  • adobeipcbroker
  • agntsvc
  • autodeskdesktopapp
  • autoruns
  • autoruns64
  • autoruns64a
  • autorunsc
  • autorunsc64
  • autorunsc64a
  • avz
  • axlbridge
  • bedbh
  • benetns
  • bengien
  • beserver
  • brccuxsys
  • brctrlcntr
  • cagservice
  • coresync
  • creative cloud
  • culture
  • dbeng50
  • dbsnmp
  • defwatch
  • dellsystemdetect
  • dumpcap
  • encsvc
  • enterpriseclient
  • excel
  • fbguard
  • fbserver
  • fdhost
  • fdlauncher
  • gdscan
  • glasswire
  • gwctlsrv
  • helper
  • httpd
  • infopath
  • inputpersonalization
  • isqlplussvc
  • j0gnjko1
  • java
  • koaly-exp-engine-service
  • msaccess
  • msdtsrvr
  • mspub
  • mydesktopqos
  • mydesktopservice
  • mysqld
  • node
  • notepad
  • notepad++
  • ocautoupds
  • ocomm
  • ocssd
  • onenote
  • onenotem
  • oracle
  • outlook
  • powerpnt
  • processhacker
  • procexp
  • procexp64
  • procexp64a
  • procmon
  • procmon64
  • procmon64a
  • pvlsvr
  • qbdbmgr
  • qbdbmgrn
  • qbidpservice
  • qbupdate
  • qbw32
  • raccine
  • raccine_x86
  • raccineelevatedcfg
  • raccinesettings
  • ragui
  • raw_agent_svc
  • rdrcef
  • rtvscan
  • sam
  • simply
  • simplyconnectionmanager
  • sqbcoreservice
  • sqlbrowser
  • sqlmangr
  • sqlservr
  • ssms
  • steam
  • supervise
  • sync-taskbar
  • sync-worker
  • synctime
  • sysmon
  • sysmon64
  • systemexplorer
  • systemexplorerservice
  • systemexplorerservice64
  • systemtrayicon
  • tbirdconfig
  • tcpview
  • tcpview64
  • tcpview64a
  • tdsskiller
  • teamviewer
  • teamviewer_service
  • thebat
  • thunderbird
  • titanv
  • tomcat6
  • totalcmd
  • totalcmd64
  • tv_w32
  • tv_x64
  • veeamdeploymentsvc
  • visio
  • vsnapvss
  • vxmon
  • wdswfsafe
  • winword
  • wireshark
  • wordpad
  • wsa_service
  • wxserver
  • wxserverview
  • xfssvccon
  • zhudongfangyu
• It encrypts files found in the following drive types:
  • Fixed drive
  • Removable drive
  • Network drive
  • RAM disks