Ransom.Win32.CRYPTOLOCK.THGAOBO

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It drops files as ransom note.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Other Details

This Ransomware does the following:

• It encrypts all drives and files
• It attempts to terminate running processes using the Restart Session Manager to encrypt the associated file as such will result to the following registry modifications:
  
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session{Numbers}
  RegFiles{Numbers} = {Encrypted Path and File}
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session{Numbers}
  RegFilesHash = {Hex Values}
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session{Numbers}
  Sequence = 0x01
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session{Numbers}
  SessionHash = {Hex Values}
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session{Numbers}
  Owner = {Hex Values}

Ransomware Routine

This Ransomware avoids encrypting files with the following strings in their file path:

• Windows
• ProgramData
• $Recycle.bin
• System Volume Information

It renames encrypted files using the following names:

• {Original Filename}.{Original File Extension}.readme

It drops the following file(s) as ransom note:

• {Encrypted Directory}\Read_Me.txt

It leaves text files that serve as ransom notes containing the following text: