Procedure examples

LockBit 2.0 has the ability to move laterally via SMB.

LockBit 2.0 can use wmic.exe to delete volume shadow copies.

LockBit 2.0 can be executed via scheduled task.

LockBit 2.0 can determine if a running process has administrative privileges and terminate processes that interfere with encryption or exfiltration.

LockBit 2.0 can use the PowerShell module `InvokeGPUpdate` to modify Group Policy.

LockBit 2.0 can use the Windows command shell for multiple post-compromise actions on objective.

LockBit 2.0 can delete itself from disk after execution.

LockBit 2.0 can enumerate system information including hostname and domain information.

LockBit 2.0 can exclude files associated with core system functions from encryption.

LockBit 2.0 can create Registry keys to bypass UAC and for persistence.

LockBit 2.0 has the ability to identify mounted external storage devices.

LockBit 2.0 can discover remote shares.

LockBit 2.0 has been observed creating accounts for persistence using simple names like "a".

LockBit 2.0 can decode scripts and strings in loaded modules.

LockBit 2.0 will not execute on hosts where the system language is set to a language spoken in the Commonwealth of Independent States region.

LockBit 2.0 can modify Group Policy to disable Windows Defender and to automatically infect devices in Windows domains.

LockBit 2.0 can use standard AES and elliptic-curve cryptography algorithms to encrypt victim data.

LockBit 2.0 can automatically terminate processes that may interfere with the encryption or file extraction processes.

LockBit 2.0 has the ability to delete volume shadow copies on targeted hosts.

LockBit 2.0 can use a Registry Run key to establish persistence at startup.

LockBit 2.0 can bypass UAC through creating the Registry key `HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\ICM\Calibration`.

LockBit 2.0 can execute command line arguments in a hidden window.

LockBit 2.0 can check if a targeted machine is using a set of Eastern European languages and exit without infection if so.

LockBit 2.0 can enumerate local drive configuration.

LockBit 2.0 can disable firewall rules and anti-malware and monitoring software including Windows Defender.

LockBit 2.0 can delete log files through the use of wevtutil.