Ransom.Win32.CRYPTOLOCK.THGAOBO

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Detalles de entrada

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Otros detalles

Hace lo siguiente:

• It encrypts all drives and files
• It attempts to terminate running processes using the Restart Session Manager to encrypt the associated file as such will result to the following registry modifications:
  
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session{Numbers}
  RegFiles{Numbers} = {Encrypted Path and File}
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session{Numbers}
  RegFilesHash = {Hex Values}
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session{Numbers}
  Sequence = 0x01
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session{Numbers}
  SessionHash = {Hex Values}
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session{Numbers}
  Owner = {Hex Values}