Ransom_LOCKY usually arrives via social engineered spam mails to trick user into clicking the attachment.

No exploits are used in the spam. Clicking the attached DOC file triggers its execution. This DOC has a macro code that then drops a BAT file. The BAT file will also drop a VBS file which performs the download of Ransom_LOCKY.

The ransomware then deletes shadow copies by running vssadmin.exe. It adds a run key entry to enable its execution during every system start-up. The run key entry enables it to continue encrypting files if interrupted during previous executions.

The dropped copy, once executed, attempts to retrieve a unique ID, public key and ransom note from a certain registry. If it fails to retrieve information from this registry, it contacts its C&C server to obtain those information and saves it to the registry.

The public key is used for its RSA encryption algorithm.

Antispam Pattern

VSAPI Pattern (Malicious File Detection)

WRS Pattern (Malicious URL and Classification)

AEGIS Pattern (Behavior Monitoring Pattern)

DCT Pattern (System Clean Pattern)

Network Pattern