During discussions about possible actions to mitigate the risk of the ransomware Locky, someone pointed at the possibility of preventing at OS level the creation of
.locky files via the File Server Resource Manager. The idea was that the impossibility to create
.locky files could hamper the execution malware.
Since I am extremely skeptical about the efficiency of this technique I would like to understand the methodology used by Locky when dealing with targeted files.
I am not interested about how the encryption is done but rather what are the steps leading from a sane file to the encrypted version (specifically: what happens when Locky fails to encrypt a file and what happens to a file after its content have been (successfully or not) encrypted).
Is such an analysis available?