Ransom.Win32.ENQTOX.A.go

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It drops files as ransom note. It avoids encrypting files with the following file extensions.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware drops the following files:

• %Public%\.lock
• %Public%\sd\del.bat
• %Public%\Desktop\decrypt.key
• %Public%\Desktop\Readme_on_Chrome.html ← Ransom Note
• %User Profile%\Administrator\Desktop\Readme_on_Chrome.html ← Ransom Note
• {Malware File Path}\files.txt

(Note: %Public% is the folder that serves as a repository of files or folders common to all users, which is usually C:\Users\Public in Windows Vista, 7, and 8.. %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name} on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It adds the following processes:

• reg delete "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default" /va " /f"
• reg delete "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers" " /f"
• reg delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\WordWheelQuery " /f"
• reg delete HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\TypedPaths " /f"
• reg delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU " /f"
• wevtutil cl system ← Clears system logs
• wevtutil cl security ← Clears security logs
• vssadmin delete shadows " /all" /quiet ← Deletes shadow copies

Other System Modifications

This Ransomware deletes the following registry keys:

HKEY_CURRENT_USER\Software\Microsoft\
Terminal Server Client\Default
(Default) =

HKEY_CURRENT_USER\Software\Microsoft\
Terminal Server Client\Servers
(Default) =

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
WordWheelQuery
(Default) =

HKEY_CURRENT_USER\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
TypedPaths
(Default) =

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
RunMRU
(Default) =

Ransomware Routine

This Ransomware avoids encrypting files with the following strings in their file name:

• private.pem
• public.pem
• files.txt
• golancer.key
• decrypt.key
• desktop.ini
• Readme.html
• Readme_on_Chrome.html

It appends the following extension to the file name of the encrypted files:

• {Original Filename & File Extension}.[get_readme_on_desktop]

It drops the following file(s) as ransom note:

• %Public%\Desktop\Readme_on_Chrome.html
• %User Profile%\Administrator\Desktop\Readme_on_Chrome.html
  

It avoids encrypting files with the following file extensions:

• .exe
• .dll
• .sys
• .lnk
• .msi
• .hta
• .cpl
• .ini
• .cab
• .cur
• .idx
• .drv
• .hlp
• .icl
• .icns
• .ico
• .ocx
• .spl
• .bat
• .bin
• .pak
• .lock