# LockBit 2.0 Ransomware (Bitwise Spider) - Technical Reverse Engineering Analysis

> Static reverse engineering of a 32-bit LockBit 2.0 ransomware sample shows hybrid Libsodium/AES-128-CBC encryption of the first 4KB of each file, UAC bypass via ColorDataProxy/CCMLuaUtil COM interfaces, Run-key persistence, and domain-wide deployment through SYSVOL and Group Policy. LockBit is a Russian-speaking RaaS operation whose administrator (LockBitSupp) was identified by law enforcement in 2024.

- **Published:** 2026-11-05T01:04:59Z
- **Last reviewed:** 2026-11-05T01:04:59Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5284
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5284.png
- **ID:** TL-2026-5284
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** LockBit (Russia)
- **Detections:** 9 (1 shown free below) · **IOCs:** 15 (2 shown free below)

## Description

LockBit 2.0 (appeared June 2021, bundled with the StealBit exfiltration tool) is a ransomware-as-a-service payload operated by the LockBit group (CrowdStrike: Bitwise Spider). This record documents the sample analyzed by Chuong Dong (static analysis in IDA Pro, published 2022-03-19; MD5 63dcf75ad743b292e4a6cd067ffc2c18, SHA256 9feed0c7fa8c1d32390e1c168051267df61f11b048ec62aa5b8e66f60e8083af). No CVE or CVSS is associated; the sample abuses built-in Windows functionality and Active Directory design.

Execution and evasion: the sample hides its strings as runtime-decoded stack strings, resolves APIs inline using FNV1A hashes (loading gdiplus, ws2_32, netapi32, activeds, mpr, bcrypt, wtsapi32 and others via LoadLibraryA), and checks PEB NtGlobalFlag for the value 0x70, hanging indefinitely if a debugger is detected. It queries GetSystemDefaultUILanguage/GetUserDefaultUILanguage and skips encryption on hosts using Azerbaijani, Armenian, Belarusian, Georgian, Kazakh, Kyrgyz, Russian, Tajik, Turkmen, Uzbek or Ukrainian locales. It adds an ACCESS_DENIED ACE for Everyone to its own process, enables SeDebugPrivilege and SE_TAKE_OWNERSHIP_PRIVILEGE, and creates a run-once mutant named by a GUID built from the public key bytes. If not already SYSTEM (S-1-5-18) it duplicates a session token (WTSQueryUserToken/DuplicateTokenEx/CreateProcessAsUserW). For UAC bypass it masquerades as explorer.exe by editing its PEB loader entry and abuses the ColorDataProxy and CCMLuaUtil auto-elevating COM interfaces (UACME technique).

Persistence and configuration: a Run key value named with the public-key GUID points at the executable and is removed after encryption. The sample registers a .lockbit file association whose open command launches a dropped LockBit_Ransomware.hta via mshta.exe. An XOR(0x5F)-encoded flag array toggles UAC bypass, self-deletion, logging, network traversal, AD group-policy propagation, the .lockbit icon, and ransom-note printing on network printers.

Impact preparation: the malware kills a list of processes (databases, Office, mail, backup, remote-access and analysis tools such as wireshark, sysmon, procmon, ProcessHacker) and stops SQL Server, Veeam, Acronis, Commvault, VMware and similar services. It runs `vssadmin delete shadows /all /quiet & wmic shadowcopy delete`, sets bcdedit bootstatuspolicy ignoreallfailures and recoveryenabled no, and clears the Security, System and Application event logs with wevtutil.

Encryption: a victim Curve25519 key pair is generated with Libsodium crypto_box_keypair and sealed to the attacker public key; per-file 16-byte AES key and IV are used for AES-128-CBC. Only the first 4KB of most files is encrypted; database/archive extensions (.sql, .mdf, .zip, .7z and others) receive multiple 1MB chunks. Files are renamed with the .lockbit extension, Restore-My-Files.txt is dropped in each directory, a wallpaper bitmap is set, and notes are printed to physical printers. Work is spread across threads (one per CPU core) via an I/O completion port, with a per-drive %02X%02X%02X%02X.lock file preventing duplicate work.

Propagation: if the host is a domain controller and the token has domain admin rights, the sample copies itself to %SystemRoot%\SYSVOL_DFSR\sysvol\<domain>\siripts and builds a GPO (IGroupPolicyObject CLSID {EA502722-A23D-11D1-A7D3-0000F87571E3}) containing NetworkShares.xml, Services.xml, Files.xml (copies the binary to the desktop of every host), ScheduledTasks.xml (taskkill /F of target processes) and Registry.pol (disables Windows Defender real-time monitoring and sets threat actions to ignore). It forces application with a PowerShell Get-ADComputer | Invoke-GPUpdate loop, falling back to a scheduled task that reboots hosts with shutdown.exe /r /f /t 0. Independently, it scans the local subnet on ports 135 and 445, enumerates shares with NetShareEnum, and impersonates elevated tokens or the shell process to encrypt remote drives. On completion it overwrites itself with `fsutil file setZeroData` after a ping delay and schedules deletion with MoveFileExW.

Context: CISA/FBI advisory AA23-165A describes LockBit as the most globally active ransomware variant in 2022 and 2023. LockBit 3.0 (LockBit Black) followed in June 2022 as a continuation of 2.0. The NCA-led Operation Cronos disrupted the group's infrastructure on 2024-02-19, and in May 2024 the administrator LockBitSupp was identified as Russian national Dmitry Khoroshev and sanctioned by the US, UK and Australia. The source analysis lists no network IOCs (IPs/domains), so BeaconBeagle C2 correlation was not applicable to this sample.

## MITRE ATT&CK

- T1059.001 PowerShell
- T1106 Native API
- T1547.001 Registry Run Keys / Startup Folder
- T1546.001 Change Default File Association
- T1053.005 Scheduled Task
- T1548.002 Bypass User Account Control
- T1134.001 Token Impersonation/Theft
- T1484.001 Group Policy Modification
- T1685 Disable or Modify Tools
- T1685.005 Clear Windows Event Logs
- T1070.004 File Deletion
- T1218.005 Mshta
- T1027 Obfuscated Files or Information
- T1622 Debugger Evasion
- T1112 Modify Registry
- T1614.001 System Language Discovery
- T1135 Network Share Discovery
- T1046 Network Service Discovery
- T1570 Lateral Tool Transfer
- T1490 Inhibit System Recovery
- T1489 Service Stop
- T1529 System Shutdown/Reboot

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**LockBit 2.0 .lockbit File Association and mshta HTA Launcher** (`TL-2026-5284-SPL-002`)

TL-2026-5284: LockBit 2.0 creates HKLM\SOFTWARE\Classes\.lockbit and Classes\Lockbit\shell\Open\Command pointing at mshta.exe with LockBit_Ransomware.hta in the user profile. Detects the registry association, the dropped HTA, and mshta launching it.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1546.001, T1218.005, T1112
- **Data sources:** sysmon, microsoft_defender_for_endpoint, windows_process_creation
- **Severity:** high
- **Confidence:** high

### Splunk SPL

````spl
index=windows sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" earliest=-24h ((EventCode=1 Image="*\\mshta.exe" CommandLine="*LockBit_Ransomware.hta*") OR (EventCode IN (12,13,14) TargetObject="*\\Classes\\Lockbit\\shell\\*") OR (EventCode IN (12,13,14) TargetObject="*\\Classes\\.lockbit*") OR (EventCode=11 TargetFilename="*\\LockBit_Ransomware.hta"))
```LockBit 2.0 registers a .lockbit file association whose open command runs mshta.exe against a dropped HTA```
| eval indicator=case(EventCode=1,"mshta_launches_lockbit_hta", EventCode=11,"lockbit_hta_dropped", like(lower(TargetObject),"%lockbit%shell%"),"lockbit_open_command_registered", true(),"lockbit_file_association")
| stats min(_time) as first_seen values(indicator) as indicators values(Image) as images values(CommandLine) as commands values(TargetObject) as registry_keys values(Details) as registry_values values(TargetFilename) as files by host User
| convert ctime(first_seen)
| table first_seen host User indicators images commands registry_keys registry_values files
````

### Microsoft KQL

```kql
union
(DeviceProcessEvents
    | where Timestamp > ago(24h)
    | where FileName =~ "mshta.exe" and ProcessCommandLine contains "LockBit_Ransomware.hta"
    | project Timestamp, DeviceName, Account = AccountName, Indicator = "mshta_launches_lockbit_hta", Detail = ProcessCommandLine),
(DeviceRegistryEvents
    | where Timestamp > ago(24h)
    | where RegistryKey contains @"\Classes\Lockbit\shell" or RegistryKey endswith @"\Classes\.lockbit"
    | project Timestamp, DeviceName, Account = InitiatingProcessAccountName, Indicator = "lockbit_file_association", Detail = strcat(RegistryKey, " = ", RegistryValueData)),
(DeviceFileEvents
    | where Timestamp > ago(24h)
    | where FileName =~ "LockBit_Ransomware.hta"
    | project Timestamp, DeviceName, Account = InitiatingProcessAccountName, Indicator = "lockbit_hta_dropped", Detail = FolderPath)
| order by Timestamp desc
```

### Sigma

```yaml
title: LockBit 2.0 HTA Launched via mshta.exe File Association
id: 7c1e2a94-5d38-4b6f-8a03-2e9f4b7d6c02
status: experimental
description: Detects mshta.exe opening LockBit_Ransomware.hta, the launcher reached through the .lockbit file association that LockBit 2.0 registers for persistence (TL-2026-5284).
references:
    - https://www.chuongdong.com/reverse%20engineering/2022/03/19/LockbitRansomware/
    - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-165a
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/05
tags:
    - attack.persistence
    - attack.t1546.001
    - attack.defense-evasion
    - attack.t1218.005
    - attack.t1112
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\mshta.exe'
        CommandLine|contains: 'LockBit_Ransomware.hta'
    condition: selection
falsepositives:
    - Unlikely; a legitimate file would not carry this name
level: high

```

**Known false positives:**

- Red-team or malware-analysis sandboxes detonating the sample
- Security tooling that replays known ransomware artifacts

**Tuning notes:** Requires Sysmon registry (12/13/14) and file-create (11) events. Exclude analysis sandboxes by host. The HTA file name is a sample-specific indicator; later builds may rename it, so also review mshta.exe launches from AppData.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- LockBit 2.0 UAC Bypass via CMSTPLUA / ColorDataProxy COM Elevation (locked: unlock with TL Creds)
- LockBit 2.0 GPO-Delivered Windows Defender Disablement (locked: unlock with TL Creds)
- LockBit 2.0 Subnet Scan for SMB/RPC Shares (Ports 135/445 Fan-Out) (locked: unlock with TL Creds)
- LockBit 2.0 Self-Deletion (ping 127.0.0.7 and fsutil setZeroData) (locked: unlock with TL Creds)
- LockBit 2.0 Mass Termination of Database, Backup and Security Processes/Services (locked: unlock with TL Creds)
- LockBit 2.0 Ransom Note and Encrypted File Artifacts (locked: unlock with TL Creds)
- LockBit 2.0 Recovery Inhibition and Event Log Clearing (vssadmin/wmic/bcdedit/wevtutil) (locked: unlock with TL Creds)
- LockBit 2.0 SYSVOL siripts Staging and Forced GPUpdate Propagation (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (2 of 15)

Defanged, TLP:CLEAR.

- File hash: `9feed0c7fa8c1d32390e1c168051267df61f11b048ec62aa5b8e66f60e8083af`
- File hash: `63dcf75ad743b292e4a6cd067ffc2c18`

Full set of 15 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [LockBit Ransomware v2.0 - Chuong Dong](https://www.chuongdong.com/reverse%20engineering/2022/03/19/LockbitRansomware/)
- [CISA AA23-165A Understanding Ransomware Threat Actors: LockBit](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-165a)
- [CISA AA23-075A LockBit 3.0 Ransomware (FBI/CISA/MS-ISAC)](https://www.ic3.gov/CSA/2023/230316.pdf)
- [Picus Security: CISA Alert AA23-075A - The Latest LockBit Ransomware Variant, LockBit 3.0](https://www.picussecurity.com/resource/blog/cisa-alert-aa23-075a-the-latest-lockbit-ransomware-variant-lockbit-3.0)
- [NCSC: International partners LockBit ransomware threat](https://www.ncsc.gov.uk/pdfs/news/ncsc-international-partners-lockbit-ransomware-threat.pdf)
- [NCA: Operation Cronos LockBit disruption](https://nca-newsroom.prgloo.com/news/op-cronos)
- [Help Net Security: LockBit leader unmasked, US charges Russian national](https://www.helpnetsecurity.com/2024/05/07/lockbit-lockbitsupp-unmasked/)
- [BleepingComputer: LockBit ransomware admin identified, sanctioned in US, UK, Australia](https://www.bleepingcomputer.com/news/security/lockbit-ransomware-admin-identified-sanctioned-in-us-uk-australia/)
- [Searchlight Cyber: A timeline of events - Operation Cronos and LockBit](https://slcyber.io/a-timeline-of-events-operation-cronos-and-lockbit/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5284