Lockbit2

How Lockbit2 typically operates, as attributed by MITRE ATT&CK v19.2. Attributed via LockBit 2.0.

1. T1047 Windows Management Instrumentation Execution

   What they do: LockBit 2.0 can use wmic.exe to delete volume shadow copies.

   What that means: Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads.

2. T1053.005 Scheduled Task ExecutionPersistencePrivilege Escalation

   What they do: LockBit 2.0 can be executed via scheduled task.

   What that means: Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code.

3. T1059.001 PowerShell Execution

   What they do: LockBit 2.0 can use the PowerShell module `InvokeGPUpdate` to modify Group Policy.

   What that means: Adversaries may abuse PowerShell commands and scripts for execution.

4. T1059.003 Windows Command Shell Execution

   What they do: LockBit 2.0 can use the Windows command shell for multiple post-compromise actions on objective.

   What that means: Adversaries may abuse the Windows command shell for execution.

5. T1112 Modify Registry PersistenceDefense Impairment

   What they do: LockBit 2.0 can create Registry keys to bypass UAC and for persistence.

   What that means: Adversaries may interact with the Windows Registry as part of a variety of other techniques to aid in defense evasion, persistence, and execution.

6. T1136 Create Account Persistence

   What they do: LockBit 2.0 has been observed creating accounts for persistence using simple names like "a".

   What that means: Adversaries may create an account to maintain access to victim systems.

7. T1547.001 Registry Run Keys / Startup Folder PersistencePrivilege Escalation

   What they do: LockBit 2.0 can use a Registry Run key to establish persistence at startup.

   What that means: Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key.

8. T1484.001 Group Policy Modification Privilege EscalationDefense Impairment

   What they do: LockBit 2.0 can modify Group Policy to disable Windows Defender and to automatically infect devices in Windows domains.

   What that means: Adversaries may modify Group Policy Objects (GPOs) to subvert the intended discretionary access controls for a domain, usually with the intention of escalating privileges on the domain.

9. T1548.002 Bypass User Account Control Privilege Escalation

   What they do: LockBit 2.0 can bypass UAC through creating the Registry key `HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\ICM\Calibration`.

   What that means: Adversaries may bypass UAC mechanisms to elevate process privileges on system.

10. T1070.004 File Deletion Stealth

    What they do: LockBit 2.0 can delete itself from disk after execution.

    What that means: Adversaries may delete files left behind by the actions of their intrusion activity.

11. T1140 Deobfuscate/Decode Files or Information Stealth

    What they do: LockBit 2.0 can decode scripts and strings in loaded modules.

    What that means: Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis.

12. T1480 Execution Guardrails Stealth

    What they do: LockBit 2.0 will not execute on hosts where the system language is set to a language spoken in the Commonwealth of Independent States region.

    What that means: Adversaries may use execution guardrails to constrain execution or actions based on adversary supplied and environment specific conditions that are expected to be present on the target.

13. T1564.003 Hidden Window Stealth

    What they do: LockBit 2.0 can execute command line arguments in a hidden window.

    What that means: Adversaries may use hidden windows to conceal malicious activity from the plain sight of users.

14. T1685 Disable or Modify Tools Defense Impairment

    What they do: LockBit 2.0 can disable firewall rules and anti-malware and monitoring software including Windows Defender.

    What that means: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities.

15. T1685.005 Clear Windows Event Logs Defense Impairment

    What they do: LockBit 2.0 can delete log files through the use of wevtutil.

    What that means: Adversaries may clear Windows Event Logs to hide the activity of an intrusion.

16. T1057 Process Discovery Discovery

    What they do: LockBit 2.0 can determine if a running process has administrative privileges and terminate processes that interfere with encryption or exfiltration.

    What that means: Adversaries may attempt to get information about running processes on a system.

17. T1082 System Information Discovery Discovery

    What they do: LockBit 2.0 can enumerate system information including hostname and domain information.

    What that means: An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture.

18. T1083 File and Directory Discovery Discovery

    What they do: LockBit 2.0 can exclude files associated with core system functions from encryption.

    What that means: Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.

19. T1120 Peripheral Device Discovery Discovery

    What they do: LockBit 2.0 has the ability to identify mounted external storage devices.

    What that means: Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.

20. T1135 Network Share Discovery Discovery

    What they do: LockBit 2.0 can discover remote shares.

    What that means: Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement.

21. T1614.001 System Language Discovery Discovery

    What they do: LockBit 2.0 can check if a targeted machine is using a set of Eastern European languages and exit without infection if so.

    What that means: Adversaries may attempt to gather information about the system language of a victim in order to infer the geographical location of that host.

22. T1680 Local Storage Discovery Discovery

    What they do: LockBit 2.0 can enumerate local drive configuration.

    What that means: Adversaries may enumerate local drives, disks, and/or volumes and their attributes like total or free space and volume serial number.

23. T1021.002 SMB/Windows Admin Shares Lateral Movement

    What they do: LockBit 2.0 has the ability to move laterally via SMB.

    What that means: Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB).

24. T1486 Data Encrypted for Impact Impact

    What they do: LockBit 2.0 can use standard AES and elliptic-curve cryptography algorithms to encrypt victim data.

    What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.

25. T1489 Service Stop Impact

    What they do: LockBit 2.0 can automatically terminate processes that may interfere with the encryption or file extraction processes.

    What that means: Adversaries may stop or disable services on a system to render those services unavailable to legitimate users.

26. T1490 Inhibit System Recovery Impact

    What they do: LockBit 2.0 has the ability to delete volume shadow copies on targeted hosts.

    What that means: Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.

Software Lockbit2 has been seen using, grouped by what it is used for. Legitimate administration tools appear here because these actors routinely abuse them — presence in this list is not itself malicious.

Tool data from Ransomware Tool Matrix by BushidoUK, licensed CC BY 4.0. Grouped by purpose and matched to this group by Breach House.