Rewterz Threat Alert – LockBit Ransomware Targeting Networks

October 22, 2020

Severity

High

Analysis Summary

LockBit ransomware takes as little as five minutes to deploy the encryption routine on target systems once it lands on the victim network. LockBit attacks leave few traces for forensic analysis as the malware loads into the system memory, with logs and supporting files removed upon execution. In one case, they found that the attack began from a compromised Internet Information Server that launched a remote PowerShell script calling another script embedded in a remote Google Sheets document. This script connects to a command and control server to retrieve and install a PowerShell module for adding a backdoor and establish persistence. To evade monitoring and go unnoticed in the logs, the attacker renamed copies of PowerShell and the binary for running Microsoft HTML Applications (mshta.exe); this prompted Sophos to call this a “PS Rename“ attack. The backdoor is responsible for installing attack modules and executes a VBScript that downloads and executes a second backdoor on systems restart. An overview of the attack is available below:

The attack scripts also attempt to bypass Windows 10’s built-in anti-malware interface. Artifacts found on attacked systems suggest the use of scripts based on the PowerShell Empire post-exploitation framework. Their purpose was to collect details about the victim network, identify valuable systems, and check for available defense solutions. In three hours, the malware encrypted about 25 servers and 225 computer systems.

Impact

Security Bypass
Information Theft
Files Encryption

Indicators of Compromise

SHA-256

0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76
0e66029132a885143b87b1e49e32663a52737bbff4ab96186e9e5e829aa2915f
0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335
0f5d71496ab540c3395cfc024778a7ac5c6b5418f165cc753ea2b2befbd42d51
13849c0c923bfed5ab37224d59e2d12e3e72f97dc7f539136ae09484cbe8e5e0
15a7d528587ffc860f038bb5be5e90b79060fbba5948766d9f8aa46381ccde8a
1b109db549dd0bf64cadafec575b5895690760c7180a4edbf0c5296766162f18
1e3bf358c76f4030ffc4437d5fcd80c54bd91b361abb43a4fa6340e62d986770
256e2bf5f3c819e0add95147b606dc314bbcbac32a801a59584f43a4575e25dc
26b6a9fecfc9d4b4b2c2ff02885b257721687e6b820f72cf2e66c1cae2675739
2b8117925b4b5b39192aaaea130426bda39ebb5f363102641003f2c2cb33b785
3f29a368c48b0a851db473a70498e168d59c75b7106002ac533711ca5cfabf89
410c884d883ebe2172507b5eadd10bc8a2ae2564ba0d33b1e84e5f3c22bd3677
4acc0b5ed29adf00916dea7652bcab8012d83d924438a410bee32afbcdb995cc
5b9bae348788cd2a1ce0ba798f9ae9264c662097011adbd44ecfab63a8c4ae28
6292c2294ad1e84cd0925c31ee6deb7afd300f935004a9e8a7a43bf80034abae
69d9dd7fdd88f33e2343fb391ba063a65fe5ffbe649da1c5083ec4a67c525997
83ab7a2bcac146db472f3b930c01af5b6d3d978ead7b14a9d0ac16e1a76e9f9d
9bc98d15f243257c1b5bca59464abe68c680cd5482ba9f5082201dde41a016cf
a03326ac8efa930e10091a374d40ddab9f7c2f12246d6ef7983bad93256f1f3a
a0085da4a920e92d8f59fefa6f25551655ca911382b5e34df76a9333ac8b7214
a08fbf01d02097094b725101309b2bf7fefc2e27724654b840b87e091aa5c9b9
a1360645cf3113715cc023d2e4cf9f6f3a6278abcf4499f0ba7cd76c82839eb0
c8205792fbc0a5efc6b8f0f2257514990bfaa987768c4839d413dd10721e8871
ce8559871b410e23057393eb2d9fb76ec902da2ff1f8006ad312c81852a41f6f
e3f236e4aeb73f8f8f0caebe46f53abbb2f71fa4b266a34ab50e01933709e877
ec88f821d22e5553afb94b4834f91ecdedeb27d9ebfd882a7d8f33b5f12ac38d
ffbb6c4d8d704a530bdd557890f367ad904c09c03f53fda5615a7208a0ea3e4d
09e956d140d6879cf7eacbb65dcbfbe1dea1961a31c5d0f834343ef2c886ccc1
9bc98d15f243257c1b5bca59464abe68c680cd5482ba9f5082201dde41a016cf

Remediation

Block the threat indicators at their respective controls.
Do not respond to emails coming from untrusted sources.
Do not open untrusted files received by any means.