Ransomware Attack Simulation

Lockard Security conducted a ransomware simulation that started off by exploited a fully patched and updated Windows 10 pro system running Office 2021. The exploit was using a Word document that was able to establish a reverse tcp shell. From there Lockard Security was able to setup persistence by backdooring Google Chrome and deployed ransomware. The ransomware attack was successful and was able to move laterally into different subnets by abusing the trust between zones. For a security assessment by Lockard Security, contact us at www.lockardsecurity.com to schedule your assessment today.

[@SamuraiJack1881]

Thank you for everyting bro, have a good job.

[@marvinokapo3321]

Hey mate the Infection-Simulation document that you used to maintained the connection and to upload the malware in the victim machine where did you get it from? (Educational purpose). Thanks.

[@user-li3hv4ok7t]

I would thank you if you could give a link to your research with all the commands you used for the persistence part, of course just for educational purposes

[@alexbrasilia6459]

Do you have a paid course to be possible we learn step by step about this ?

[@magnese7993]

Which kali tool did you used?

[@Dr.Yuzerssif]

Thank you for this video. I need your help.. My laptop was exposed to a JAWR ransomware attack. I see that you are an expert in this field. I hope you can help me solve this complex problem. Thank you very much in advance

[@rersheed]

HI! I have been trying to simulate ransomware traffic for testing a countermeasure but I couldn't. How can I simulate wannacry ransomware traffic? Best Regards

[@udohpele1696]

Thanks for this demo. On question please, if the user is not a local admin and is unable to run the file after clicking, will the hack still be successful?

[@lockard452]

Hi, I'm sorry for the delayed response as I'm just now seeing your question. A non admin user would still be able to open this file. In doing so the malicious code would still run, however it would be in the context of the users permissions. When this happens, the attack much do a privilege escalation attack to get admin / root access.

[@jaydave4696]

Hey! It's an absolute amazing video..but how can i get this codes..for my Ransomware project?can u reply pls.

[@InternetVet]

just drop all inbound connections on port 5985 & 5986 to prevent this?

[@conan5890]

Nice video, explanation and demonstration. I think you should try again against a computer who has a paid license of antivirus (e.g ESET etc). The free version Windows defender has nothing in order to defend any attack.

[@detective5253]

this is interesting technique and similar somehow to a signed malware with a company's private signing key typically to backdoor whitelisted applications. modern cyber sec are getting way more sophisticated than ever.

[@starboyy__y]

I Was Also Looking For That Type Of Videos Bro 🥲

[@MAG320]

I would like to see how the ransomware was created (for ed purposes) so I can provide a debrief to a couple clients.

[@UniqueMappingSequence]

🤨🤨

[@mohammadiaa]

Yeeees clients

[@samajbhanproduction1520]

IKIK

[@meowtrox1234]

how about if you have a DYNAMIC IP ADDRESS? will ransomware be possible?

[@zilverfox-wu1yd]

i assume you made a backdoor first, just how do you crypt it in kali linux plus exploit?

[@lockard452]

Its a broken Macro technique, I recommend taking the OSEP training to learn more about this method. I avoid using crypters as they are easily flagged as suspicious.

[@zilverfox-wu1yd]

@@lockard452 okay thanks lol

[@kasinoFlow]

@@lockard452I want to learn more about hacking can you make a discord by anychance

[@paradownload2051]

Sir can i have a copy ofnthat simulation? For educational purposes, im into cybersec right now

[@rafaelsandoval6472]

do you have a video where you put the malicious code into the macro file? Thank you

[@lockard452]

Hi, I'm sorry for the delayed response as I'm just now seeing your question. No I do not, the main reason for that is so AV vendors doesn't pick up some of my methods. That said, this one already is being detected, which is expected over time. I'll consider creating move videos on the entire process, start to finish. Along with diving deeper into the code and methods used.

[@littleghoost]

how to disable antivirus before infecting?

[@elelipappa3102]

Can you make a tutorial on how to create such ransomware?(Love your content)

[@Hogrider6.9]

lol

[@Gm-Rifat]

What kind of mail you are using ? How can I use it ? Is it free ?

[@andreazaric303]

Is tempmail

[@ronwurdesagendasises9249]

How do you make this Word Document without Makros?

[@lockard452]

Its a broken Macro technique. I recommend taking the OSEP training to learn more about this method.

[@shadowsalah1484]

Hey guys hacker's control ransom with a C&C server?

[@gernot4490]

does kaspersky allow opening the infected word-doc in the beginning of the vid? i dont think so so its preventing the ransomware attack?

[@jacvbtaylor]

That probably all depends on the exploit in the doc

[@mrgermanyhd]

How did you make it without WinDef or AV noticing or alarming? Can u tell me in 1-2 sentences how this exploit works and what I need to do? (educational purposes only)

[@zilverfox-wu1yd]

crypter

[@lockard452]

Hi, I'm sorry for the delayed response as I'm just now seeing your question. It requires creating the payload in away that is unique, without any suspicious indicators that would get flagged. Most crypters are easily detectable as suspicious,. It requires a lot of testing, trail and error. For example, the methods I used here no longer works, therefore you have to always continue to evolve the payloads to stay one step ahead of the detection engines.

[@hack-talk9098]

Start with the full video so I learn how to create the payload and listener

[@lockard452]

I'll be creating an updated video with full end to end which will show the latest and greatest processes and methods.

[@BlueZackMuthey]

how did you get access to the targets computer?

[@BlockImmigrants]

The link the victim clicked gave away the IP address, and with the IP, the hacker can basically access the victim.

[@TK-od8hd]

​@@BlockImmigrantsso a Firewall rule will block this connection?

[@issho8885]

​@@TK-od8hdonly if the attacker IP was known beforehand and it was put in the rule

[@sreerahul6663]

Hi bro If a pc is infected with ransomeware virus how to decrypt it please do a video

[@HiChicken-zj7yc]

you can't, pay or format your pc

[@networksolucoes7537]

Muito boa apresentação!!

[@a6eu]

Hello Lord, I have final project tomotrow, and I need to demonstrate this attack to get bonus points, I really need this. Can you help me, plsss?!!

[@lockard452]

Dang, I'm just now seeing this comment! Hope you were able to do demonstrate this for your class.

[@thewickedmma]

broo help me out. im going through the same thingg

[@FrontendCss]

It's Kali Linux

[@apitaremore9453]

how to remove ransomware??

[@harshadsd90]

same question tried all decryption methods but not work 😢😢

[@HiChicken-zj7yc]

cause u can't only the one who puts it in the system who can which u gonna need to pay for

[@electragammingtech9801]

give me the google sheet documents

[@lockard452]

You don't want it :D

[@robertclark2607]

who would use windows ge

[@SteveRoufosse]

Je parie que personne ne saurait m'envoyer un ransomware 😂

[@Its_A_Me._A_Mario]

So you don’t go to jail y’all, hack a vm lol

[@danwolf1168]

Instead of “hacker” you should say cyber criminal.

[@saji002]

generally its hacker

[@mohamedamjath3884]

Hi, can i contact you pls

[@user-uk3ut3qo8q]

I watch the video but still couldn’t do it myself until he came to my aid👆(the above bio on social media). Thank you