Ransom.Win32.LOCKERGOGA.AA

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It encrypts files with specific file extensions. It encrypts files found in specific folders.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware drops the following copies of itself into the affected system:

• %User Temp%\tgytutrc{4-Random Numbers}.exe

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, and 8.)

It adds the following processes:

• %User Temp%\tgytutrc{4-Random Numbers}.exe -m
• %User Temp%\tgytutrc{4-Random Numbers}.exe -i SM-tgytutrc -s

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, and 8.)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• MX-tgytutrc

Other System Modifications

This Ransomware modifies the following registry entries:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\
RestartManager\Session00{01-20}
RegFiles00{00-20} = {Encrypted File}

HKEY_CURRENT_USER\SOFTWARE\Microsoft\
RestartManager\Session00{01-20}
RegFilesHash = {Hex Values}

HKEY_CURRENT_USER\SOFTWARE\Microsoft\
RestartManager\Session00{01-20}
Sequence = 0x00000001

HKEY_CURRENT_USER\SOFTWARE\Microsoft\
RestartManager\Session00{01-20}
SessionHash = {Hex Values}

HKEY_CURRENT_USER\SOFTWARE\Microsoft\
RestartManager\Session00{01-20}
Owner = {Hex Values}

Other Details

This Ransomware does the following:

• Modifies the password of all installed user accounts to "HuHuHUHoHo283283@dJD"
• It moves copies of itself to the %User Temp% directory before proceeding with its encryption routine
• It attempts to log out local and remote sessions
• It attempts to disable installed network adapters

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, and 8.)

Ransomware Routine

This Ransomware encrypts files with the following extensions:

• all file types

It encrypts files found in the following folders:

• Drives of the following type:
  • Fixed
  • Removable
  • Remote
  • Ramdisk

It avoids encrypting files found in the following folders:

• %Windows%

(Note: %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.)

It appends the following extension to the file name of the encrypted files:

• .locked

It leaves text files that serve as ransom notes containing the following text:

• %System Root%\Users\Public\Desktop\README_LOCKED.txt