{"id":18452,"date":"2021-09-27T08:56:25","date_gmt":"2021-09-27T08:56:25","guid":{"rendered":"https:\/\/nsfocusglobal.com\/?p=18452"},"modified":"2026-04-17T18:07:45","modified_gmt":"2026-04-17T18:07:45","slug":"insights-into-ransomware-spread-using-exchange-1-day-vulnerabilities-2-2","status":"publish","type":"post","link":"https:\/\/nsfocusglobal.com\/pt-br\/insights-into-ransomware-spread-using-exchange-1-day-vulnerabilities-2-2\/","title":{"rendered":"Insights into Ransomware Spread Using Exchange 1-Day Vulnerabilities 2-2"},"content":{"rendered":"\n

Analysis of the Kill Chain of the LockFile Ransomware Group<\/h2>\n\n\n\n

KDU Tool Terminating Multiple Antivirus Processes<\/strong><\/p>\n\n\n\n

The attacker renames the KDU tool (open-source Windows driver loader implementing DSG bypass via an exploit) autologin, copies the related program to the temporary directory, and loads and executes the designated driver file to execute code with kernel privileges to terminate the antivirus process. <\/p>\n\n\n\n

Our analysis of the .sys file loaded by the attacker suggests that with simple functions, this program traverses all processes in the system, locates the antivirus process according to its name, and terminates it.<\/p>\n\n\n\n

\"Red<\/figure>\n\n\n\n
\"Red<\/figure>\n\n\n\n

In the driver, process names of multiple antivirus software are saved, like McAfee, Symantec, Windows Defender, and VIPRE.<\/p>\n\n\n\n

\"Red<\/figure>\n\n\n\n

After the autologin.sys driver is loaded, a tool is used to obtain the output of the driver.<\/p>\n\n\n\n

\"Red<\/figure>\n\n\n\n

It is noteworthy that KDU loads the driver file to the memory for execution through mapping, instead of following the normal driver loading process. Therefore, a traditional check tool is unable to obtain the loaded driver.<\/p>\n\n\n\n

LockFile Execution for Encryption and Self-Deletion Upon Encryption<\/strong><\/p>\n\n\n\n

autoupdate.exe is a 64-bit program used by LockFile to encrypt files. This program is packed using UPX.<\/p>\n\n\n\n

This program performs the following steps: <\/p>\n\n\n\n

1. Create a mutex “25a01bb859125507013a2fe9737d3c33”.<\/p>\n\n\n\n

\"Red<\/figure>\n\n\n\n

2. Decode some wmic commands and execute the following seven commands using cmd \/c to terminate related processes, like VMware, VirtualBox, SQLServer, MySQL, and Oracle.<\/p>\n\n\n\n

wmic process where “name  like ‘%vmwp%'” call terminate<\/p>\n\n\n\n

wmic process where “name  like ‘%vbox%'” call terminate<\/p>\n\n\n\n

wmic process where “name  like ‘%sqlservr%'” call terminate<\/p>\n\n\n\n

wmic process where “name  like ‘%mysqld%'” call terminate<\/p>\n\n\n\n

wmic process where “name  like ‘%omtsreco%'” call terminate<\/p>\n\n\n\n

wmic process where “name  like ‘%tnslsnr%'” call terminate <\/p>\n\n\n\n

wmic process where “name  like ‘%vmware%'” call terminate<\/p>\n\n\n\n

\"Red<\/figure>\n\n\n\n

3. Obtain all logical driver letters. For a hard disk or USB flash drive, a new thread will be created to encrypt the corresponding file, add the .lockfile suffix to the file name, create a ransomware file LOCKFILE-README-<computer name>-<time>.hta (<computer name> is the computer name and <time> is the timestamp) in the driver directory, and write the encoded contents to the .hta file.<\/p>\n\n\n\n

\"Red<\/figure>\n\n\n\n

After all files are encrypted, autoupdate.exe will generate the %PUBLIC%\\LOCKFILE-README.hta file and invoke mshta to execute the this HTA file.<\/p>\n\n\n\n

During encryption, the Rijndael algorithm (used by AES) is used to encrypt file contents.<\/p>\n\n\n\n

\"Red<\/figure>\n\n\n\n

4. Create a process to execute the following command to delete itself: cmd \/c ping 127.0.0.1 -n 5 && del “%s” && exit<\/p>\n\n\n\n

\"Red<\/figure>\n\n\n\n

Attack Check<\/h2>\n\n\n\n

1. By reference to the event IoCs, users can check whether communication records of the following IP addresses\/domain names exist in the current network:<\/p>\n\n\n\n