TROJ_CRILOCK.ER

 Modified by: Adrian Cofreros

 ALIASES:

Trojan:Win32/Ransom.FO(Microsoft),Trojan-Ransom.Win32.Cryptolocker.l(Kaspersky),a variant of MSIL/TrojanDropper.Agent.SE trojan(NOD32)

 PLATFORM:

Windows 2000, Windows XP, Windows Server 2003

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:
 INFORMATION EXPOSURE:

  • Threat Type: Trojan

  • Destructiveness: No

  • Encrypted: Yes

  • In the wild: Yes

  OVERVIEW

Infection Channel:

Spammed via email, Downloaded from the Internet

This Trojan arrives as an attachment to email messages spammed by other malware/grayware or malicious users. It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

  TECHNICAL DETAILS

File Size:

Varies

File Type:

EXE

Memory Resident:

No

Initial Samples Received Date:

08 Mar 2014

Payload:

Modifies files, Displays message/message boxes

Arrival Details

This Trojan arrives as an attachment to email messages spammed by other malware/grayware or malicious users.

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following files:

  • {Path Name}\README TO UNLOCK.txt
  • %User Temp%\Email.pdf - it will be also executed
  • {Path Name}\READMETOUNLOCK.txt
  • %User Temp%\MailMessage.exe - detected as TROJ_CRILOCK.ER
  • %User Temp%\{variable name 1}.exe - detected as TROJ_CRILOCK.ER

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.)

It leaves text files that serve as ransom notes containing the following:

  • ** Your files have been locked and encrypted with a unique RSA-2048 key! **
    To unlock your files/data:
    1. Download and install the Tor browser from:
    https://www.torproject.org/projects/torbrowser.html.en
    2. Now go to:
    http://{BLOCKED}54x5f3.onion
    (From within the Tor browser)
    Follow the instructions. You will then receive the decryption key (password) and decryptor within 12 hours.
    BEWARE - this is NOT a virus.
    The ONLY way to get your files back is to pay for the decryptor + decryption key (password).
    Guaranteed recovery is provided within 10 days.
    ** Your ID# is {ID} **

Autostart Technique

This Trojan adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
{variable name 2} = "%User Temp%\{variable name 1}.exe"

Other System Modifications

This Trojan adds the following registry keys:

HKEY_CLASSES_ROOT\.{variable name 3}

HKEY_CLASSES_ROOT\{variable name 4}

HKEY_CLASSES_ROOT\{variable name 4}\DefaultIcon

HKEY_CLASSES_ROOT\{variable name 4}\shell\
open\command

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.{variable name 3}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
{variable name 4}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
{variable name 4}\DefaultIcon

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
{variable name 4}\shell\open\
command

It adds the following registry entries:

HKEY_CLASSES_ROOT\.{variable name 3}
(Default) = "{variable name 4}"

HKEY_CLASSES_ROOT\{variable name 4}
(Default) = "LOCKED"

HKEY_CLASSES_ROOT\{variable name 4}\DefaultIcon
(Default} = "%User Temp%\{variable name 1}.exe,0"

HKEY_CLASSES_ROOT\{variable name 4}\shell\
open\command
(Default) = "%User Temp%\{variable name 1}.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.{variable name 3}
(Default) = "{variable name 4}"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
{variable name 4}
(Default) = "LOCKED"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
{variable name 4}\DefaultIcon
(Default) = "%User Temp%\{variable name 1}.exe,0"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
{variable name 4}\shell\open\
command
(Default) = "%User Temp%\{variable name 1}.exe"

Other Details

This Trojan encrypts files with the following extensions:

  • *.1cd
  • *.3gp
  • *.7z
  • *.ac3
  • *.accdb
  • *.ai
  • *.ape
  • *.avi
  • *.bmp
  • *.cdr
  • *.cdr
  • *.cer
  • *.csv
  • *.dbf
  • *.dcr
  • *.divx
  • *.djvu
  • *.doc
  • *.docx
  • *.dwg
  • *.dwg
  • *.dxf
  • *.dxg
  • *.eps
  • *.epub
  • *.flac
  • *.flv
  • *.gif
  • *.gzip
  • *.htm
  • *.html
  • *.ifo
  • *.indd
  • *.iso
  • *.jpeg
  • *.jpg
  • *.kdc
  • *.kwm
  • *.m2v
  • *.max
  • *.md
  • *.mdb
  • *.mdf
  • *.mkv
  • *.mov
  • *.mp3
  • *.mp4
  • *.mpeg
  • *.mpg
  • *.odt
  • *.p12
  • *.p7b
  • *.p7c
  • *.pdf
  • *.pfx
  • *.png
  • *.pps
  • *.ppt
  • *.pptm
  • *.pptx
  • *.psd
  • *.pst
  • *.pwm
  • *.qbb
  • *.qbw
  • *.rar
  • *.raw
  • *.tar
  • *.tif
  • *.torrent
  • *.txt
  • *.vob
  • *.wav
  • *.wma
  • *.wmv
  • *.wpd
  • *.xls
  • *.xlsx
  • *.zip

It renames encrypted files using the following names:

  • {filename and extension}.CRYPTOLOCKER

NOTES:

This Trojan also encrypts files from the following drives and sub-folders:

  • {removable drive}
  • {network drive}
  • {physical drive}

It may show the following message once a computer is infected the machine or when a user clicks on an encrypted file:

Variable names may vary depending on the files detected as TROJ_CRILOCK.ER. Some of the variables are the following:

  • {variable name 1 }
    • hfqKbCfdb5R9xA9
    • voU3Rc5y67MY4tU
  • {variable name 2}
    • Alcmeter
    • winserveupd
  • {variable name 3}
    • LOCKED
    • CRYPTOLOCKER
  • {variable name 4}
    • TMDCHXKKVCVJWNI
    • PUGTKOTUDANZZVG

  SOLUTION

Minimum Scan Engine:

9.700

FIRST VSAPI PATTERN FILE:

10.646.08

FIRST VSAPI PATTERN DATE:

06 Mar 2014

VSAPI OPR PATTERN File:

10.647.00

VSAPI OPR PATTERN Date:

07 Mar 2014

Step 1

Before doing any scans, Windows XP, Windows Vista, and Windows 7 users must disable System Restore to allow full scanning of their computers.

Step 2

Delete this registry key

[ Learn More ]

Important: Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this step only if you know how or you can ask assistance from your system administrator. Else, check this Microsoft article first before modifying your computer's registry.

  • In HKEY_CLASSES_ROOT
    • .{variable name 3}
  • In HKEY_CLASSES_ROOT
    • {variable name 4}
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes
    • .{variable name 3}
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Classes
    • {variable name 4}

Step 3

Delete this registry value

[ Learn More ]

Important: Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this step only if you know how or you can ask assistance from your system administrator. Else, check this Microsoft article first before modifying your computer's registry.

  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • {variable name 2} = "%User Temp%\{variable name 1}.exe"

Step 4

Search and delete these files

[ Learn More ]
There may be some files that are hidden. Please make sure you check the Search Hidden Files and Folders checkbox in the "More advanced options" option to include all hidden files and folders in the search result.
  • %User Temp%\Email.pdf
  • {Path Name}\READMETOUNLOCK.txt

Step 5

Scan your computer with your Trend Micro product to delete files detected as TROJ_CRILOCK.ER. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.


Did this description help? Tell us how we did.