CryptoLocker Prevention

[Chuckster]

 
[i]$pass = “PasswordHere” | ConvertTo-SecureString –AsPlainText –Force[/i]

 

For encrypting the password in another file then run the following from a PowerShell prompt while logged in as the user who the script will run as (Domain Admin preferred but anyone who can successfully run the Block-SMBShareAccess command on file servers).

 

 
[i]“Passwordhere” | ConvertTo-SecureString –AsPlainText –Force | ConvertFrom-SecureString | Out-File “C:\File.ini”[/i]

 

Can someone help explain the above to me? Not really sure how to implement the last bit.

[Arthur]

The following article has a couple of interesting suggestions for slowing down and/or detecting ransomware client-side (one of which is a variation on Paula Januszkiewicz's sinkhole idea and another which is a variation on @halbaradkenafin's idea of disconnecting mapped drives).

 

Proactively Reacting to Ransomware

 

For our inaugural post, we thought we would share some proof of concept ideas regarding potential reactions and responses to ransomware outbreaks. We have been tossing around some ideas and scripts, that we think can buy the victim back some time when their machine is being infected by ransomware. The hope being that this additional time allows the victim time to react to the infection and hopefully provide the victim an opportunity to remedy the situation.

 

As an incident responder, we all know that ransomware cases can be overly damning to a victim and an organization, so reacting to them as quick as possible is crucial. Since protections in place, such as antivirus are constantly in a rat race, that is usually one step behind, it puts everyone at a disadvantage. One thing you can say about ransomware is that it isn't hard to spot a successful infection. Forensically speaking, it is overly noisy and riddles the host with artifacts of its execution.

 

Knowing that there are numerous artifacts and infection actions you can bank on, things such as file overwrites, an infection order, known extensions targeted and potentially persistence, what would happen if you reacted on those events specifically and not the malware itself. If we reacted on these events instead of looking for a stage1 or stage2 drop, the majority of ransomware infections could be delayed, buying back some time for the victim and incident responder to react and hopefully stop the infection.

 

The example below uses the file canaries and the sinkholes concepts together. The script creates plain text canary files using the extension list, creates the sinkhole mount point. This script will force the ransomware into a loop, so it perpetually encrypts the same canary files over and over again.

 

$HoneyPot = "c:\`$\"
New-Item $HoneyPot -ItemType directory

#Here are a few of the popular extensions for Ransomware to target.
$exts = @('.c','.h','.m','.ai','.cs','.db','.db','.nd','.pl','.ps','.py',
         '.rm','.3dm','.3ds','3fr','.3g2','.3gp','.ach','.arw','.asf','.asx',
         '.avi','.bak','.bay','.cdr','.cer','.cpp','.cr2','.crt','.crw','.dbf',
         '.dcr','.dds','.der','.des','.dng','.doc','.dtd','.dwg','.dxf','.dxg',
         '.eml','.eps','.erf','.fla','.flv','.hpp','.iif','.jpe','.jpg','.kdc',
         '.key','.lua','.m4v','.max','.mdb','.mdf','.mef','.mov','.mp3','.mp4',
         '.mpg','.mrw','.msg','.nef','.nk2','.nrw','.oab','.obj','.odb','.odc',
         '.odm','.odp','.ods','.odt','.orf','.ost','.p12','.p7b','.p7c','.pab',
         '.pas','.pct','.pdb','.pdd','.pdf','.pef','.pem','.pfx','.pps','.ppt',
         '.prf','.psd','.pst','.ptx','.qba','.qbb','.qbm','.qbr','.qbw','.qbx',
         '.qby','.r3d','.raf','.raw','.rtf','.rw2','.rwl','.sql','.sr2','.srf',
         '.srt','.srw','.svg','.swf','.tex','.tga','.thm','.tlg','.txt','.vob',
         '.wav','.wb2','.wmv','.wpd','.wps','.x3f','.xlk','.xlr','.xls','.yuv',
         '.back','.docm','.docx','.flac','.indd','.java','.jpeg','.pptm','.pptx',
         '.xlsb','.xlsm','.xlsx')

ForEach ($ext in $exts) {

   # For each extension, this will create a pseudorandom number of files between 2 and 5
   # We don't want this ransomware to get bored while we are trying to kill it.
   For($i = 1; $i -le $(Get-Random -Minimum 2 -Maximum 5 ); $i++) { 

       # Now we are going to create the file contents.
       $textout = ''
       For($i = 1; $i -le $(Get-Random -Minimum 10 -Maximum 1000 ); $i++) { 
           # For pseudorandom characters
           # $textout += -join ((65..90) + (97..122) | Get-Random -Count 64 | % {[char]$_})
           # For some plaintext easy to read
           $textout += 'Completely Plaintext File. '
       }

       # More random filenames because... why not?
       $RandomFileName = -join ((65..90) + (97..122) | Get-Random -Count 8 | % {[char]$_})

       # Save random file contents to random file name with our extension
       $RandomFilePath = ($HoneyPot + $RandomFileName + $ext)
       $textout| Out-File -FilePath $RandomFile -Force -ErrorAction SilentlyContinue
   }
}

# Next we create the sinkhole.
# Let's grab the volume info for C
$Volume_info_for_C = Get-WMIObject -Class Win32_Volume -Filter "driveletter='c:'"

# Now lets snag the DeviceID
$Device_ID_of_C = $Volume_info_for_C.DeviceID

# We are going to use the DeviceID to setup some new mount points for this volume.
# Normally, everything is mounted only to C:\ but we're going to get creative.
$Sinkholes = @('$$','Users\$GoToJail','Users\username\Documents\$GoDirectlyToJail')

ForEach ($Sinkhole in $Sinkholes) { 
   New-Item c:\$Sinkhole -ItemType directory
   $Volume_info_for_C.AddMountPoint("c:\$Sinkhole")
}

[Arthur]

Turn on SecureBoot, install Windows in UEFI mode and you won't have to worry about Petya.

 

Petya ransomware reportedly encrypts hard drives, manipulates operating system boot process

 

... a new type of ransomware, dubbed Petya, has been discovered that encrypts a user's hard drive - instead of individual files - during an operating system's boot process.

 

Petya is distributed via an email message that claims to be from someone seeking to be hired by a company; however, the message itself does not include any email attachments for a potential victim to download. Instead, it includes a hyperlink to a Trojan Horse masquerading as a résumé hosted by the legitimate cloud storage service Dropbox.

 

http://i.cubeupload.com/KFvUGO.png

 

Once a user executes this Trojan Horse, Petya modifies the operating system's master boot record (MBR) and causes it to crash. A user who restarts the affected machine will be presented with a screen that masquerades as Microsoft's CHKDSK utility (shown above) that initiates Petya's encryption process, in spite of the claim that disk errors are being repaired.

 

http://i.cubeupload.com/6UODIl.png

 

After Petya has completed the encryption process, a skull will appear on a rapidly flashing screen that instructs the victim to press a key to continue.

 

http://i.cubeupload.com/difU0f.png

[gshaw]

The flashing skull screen is the kind of thing Hollywood usually dreams up, no doubt it'd scare the living daylights out of the average user

[smithson83]

does anyone know if this is a legit file?

C:\ProgramData\Sophos\AutoUpdate\Cache\sophos_autoupdate1.dir\crypto.dll

 

FSRM found it but as its on the C: drive it only notified me it was there. was wondering if it was an actual Sophos dll, I did a quick google, but nothing came up.

Edited March 29, 2016 by smithson83

[kevin_lane]

From my experience with sophos I don't think It is however I would contact sophos just to double check or check their forums

[3s-gtech]

From my experience that is legit - I blacklisted *crypto using FSRM on our file server which also hosts the Sophos deployment share. That didn't go well! Sophos broke pretty comprehensively until I linked the two things (with several days between them, typically). I have the same file on my clients.

[smithson83]

After a bit more research, it does seem to be part of the SAU. I'll work around it and hope its legit.

 

Is there anyway to whitelist/exclude a directory with FSRM?

[3s-gtech]

Yes. 'Create File Screen Exception' under the File Screens section. That's how I did it.

[smithson83]

Yes. 'Create File Screen Exception' under the File Screens section. That's how I did it.

 

Duuuurrrrr

[Arthur]

A handy AppLocker guide from the NSA.

 

Application Whitelisting Using Microsoft AppLocker (PDF)

 

http://i.cubeupload.com/rxpkzW.png

 

http://i.cubeupload.com/9Ezq8b.png

 

http://i.cubeupload.com/X3wcqG.png

 

http://i.cubeupload.com/wtfVmX.png

 

http://i.cubeupload.com/qDvftU.png

[smithson83]

How do you guys deal with SIMs updates, I had to disable the policy this morning to get clients to installs the updates properly.

I have set the SIMS Drive letter and UNC path to unrestricted, but I had to set %temp% to unrestricted, then the updates install, seems it creates a host of tmp files in there.

 

How do I get around this, any ideas?

[mrbios]

How do you guys deal with SIMs updates, I had to disable the policy this morning to get clients to installs the updates properly.

I have set the SIMS Drive letter and UNC path to unrestricted, but I had to set %temp% to unrestricted, then the updates install, seems it creates a host of tmp files in there.

 

How do I get around this, any ideas?

 

Ah so that's why I'm getting the incompatible database error...

 

Just tested, same issue here, disable it and sims updates fine. Eurgh, looking forward to seeing if anyone has any updates to this one?

 

EDIT: I guess this is the only time i'll have this problem though? As this is the last time i have to use SOLUS2 method of updating? Or is anyone with SOLUS3 getting the same issue?

Edited April 4, 2016 by mrbios

[Steve21]

Ah so that's why I'm getting the incompatible database error...

 

Just tested, same issue here, disable it and sims updates fine. Eurgh, looking forward to seeing if anyone has any updates to this one?

 

EDIT: I guess this is the only time i'll have this problem though? As this is the last time i have to use SOLUS2 method of updating? Or is anyone with SOLUS3 getting the same issue?

 

Not sure if it'll fix it (Using different way here), but I know when I was looking at this before all the Capita Exe's have a Digital Signature against them so that can be used as the allow based on Publisher etc.

 

Steve

[mrbios]

Not sure if it'll fix it (Using different way here), but I know when I was looking at this before all the Capita Exe's have a Digital Signature against them so that can be used as the allow based on Publisher etc.

 

Steve

 

I've already got them as an allowed publisher unfortunately, and annoyingly i get nothing in the event viewer to say what has been blocked or where from...

 

EDIT: i lie, it wasn't displaying in date order, derp. so it does appear to be .tmp files that are being blocked from users local appdata. I wonder if the temp files are always the same name?

Edited April 4, 2016 by mrbios

[smithson83]

Cheers @Steve21, will give that a shot. Initial test seem to work ok (Sims runs with just that inplace)... Just need to find a client that needs updating now Edited April 4, 2016 by smithson83

[smithson83]

I've already got them as an allowed publisher unfortunately, ..... it does appear to be .tmp files that are being blocked from users local appdata. I wonder if the temp files are always the same name?

 

From my tests, they change each time

[Gibson335]

Has anyone removed mapped drives, and if so have you encountered any issues?

 

Cheers.

[gaz350b]

I know teslacrypt follows shortcuts, so probably not going to help removing network drives.

[Gibson335]

I know teslacrypt follows shortcuts, so probably not going to help removing network drives.

Really? I thought they could only work via mapped drives. I hadn't read they could work through shortcuts.

 

Thanks.

[Arthur]

Has anyone removed mapped drives

Nope, because it's not going to help.

 

www.bleepingcomputer.com/news/security/the-locky-ransomware-encrypts-local-files-and-unmapped-network-shares/

 

A new ransomware has been discovered called Locky that encrypts your data using AES encryption and then demands .5 bitcoins to decrypt your files. Though the ransomware sounds like one named by my kids, there is nothing childish about it. It targets a large amount of file extensions and even more importantly, encrypts data on unmapped network shares. Encrypting data on unmapped network shares is trivial to code and the fact that we saw the recent DMA Locker with this feature and now in Locky, it is safe to say that it is going to become the norm. Like CryptoWall, Locky also completely changes the filenames for encrypted files to make it more difficult to restore the right data.

 

https://blog.knowbe4.com/new-ransomware-cryptofortress-encrypts-unmapped-network-shares

 

Unfortunately this all changes with CryptoFortress as this ransomware will also attempt to enumerate all open network Server Message Block (SMB) shares and encrypt any that are found.

 

As you can see from the image below, CryptoFortress is successfully able to encrypt the file test.txt in an open share over SMB on a test network. This new ability changes the threat landscape for all server and network administrators and it is even more important than ever to properly secure your shared folders with strong permissions.

[Arthur]

The latest TeslaCrypt no longer uses an extension for encrypted files.

 

www.helpnetsecurity.com/2016/04/22/teslacrypt-new-versions-no-decryption

 

One of the latest changes to the malware is that it no longer uses an extension for encrypted files, making it more difficult for victims to identify the threat for what it is.

 

Another big change is that TeslaCrypt is no longer delivered only via exploit kits, but also via spam emails.

 

Endgame researchers spotted the latest of these spam campaigns: emails supposedly containing proof of a successful delivery of a package. Unfortunately, the attached ZIP files instead contain a JavaScript file that is a downloader that uses the local environment’s Windows Script Host or wscript to download the payload (i.e. TeslaCrypt).

 

http://i.imgur.com/K6pBd4Y.jpg

[Arthur]

 

 

Source: https://twitter.com/SwiftOnSecurity/status/722478603003256832

 

Also worth doing are .jse files which are encoded .js files.

Edited April 28, 2016 by Arthur

[Chuckster]

If you have Software Restriction Policy set up correctly, you could add both .JS and .JSE to the 'Designated File Types', which is what I've done just now.

[Chuckster]

Disabling Windows Script Host might also be an idea: https://labsblog.f-secure.com/2016/04/19/how-to-disable-windows-script-host/