LockFile Ransomware Employs Novel Encryption Technique
Researchers working with security firm Sophos published a report on a new strain of ransomware called LockFile. What makes the new threat unique is the way it encrypts files on victim systems.
LockFile is a new name on the malware landscape, emerging only recently, shortly after the discovery that unpatched MS Exchange servers were vulnerable to ProxyShell attacks.
The Sophos team explains that the new ransomware uses an encryption technique that was never used by another strain of ransomware in the past. The way LockFile encrypts files is described as "intermittent encryption". The report explains that the malware encrypts "every 16 bytes" of each file. Sophos further explains that this method keeps the resulting encrypted file "statistically very similar" to the state of the original file.
This novel approach to encryption helps LockFile fool some anti-ransomware countermeasures, but it's not the only evasion tool the ransomware uses. LockFile also uses memory mapped I/O when encrypting files. This keeps disk I/O to a minimum and can further keep the malicious activity of LockFile under the radar.
Ultimately, LockFile also has no need to contact any sort of command and control server for communication. This makes the ransomware even more difficult to spot early on a victim system, as there are no traceable suspicious outgoing connections.
LockFile uses a legitimate Windows tool called Windows Management Interface or WMI - a command line tool that is bundled with every release and installation of modern-day Windows. WMI is used to shut down processes related to database management and virtualization. This both ensures that the files are now ripe for exploitation and also that by using WMI as an intermediary, it does not become immediately obvious that the legitimate processes were shut off by the ransomware.
Sophos further explained why the intermittent encryption method can fool some defences. The way this works has to do with a verification method called "chi squared". This method assigns each file a score. If a file is encrypted with other strains of ransomware, even ones that encrypt just the first few blocks of the file, will have a significantly divergence in its chi squared score, compared to the original file. However, the intermittent encryption method produces files that have chi squared scores that are much closer to the original files.
