Guidance with Ransomware attack (WannaCry)

One of the worst global cyberattack started on Friday, 12th of May 2017, and has affected more than 200,000 system in more than 150 countries across the globe. The attack is a ransomware (a malicious program that encrypts data on a system and demands for a ransom before the files are decrypted) variant which exploits Windows systems with an earlier reported vulnerability listed in one of Microsoft’s security bulletin, MS17-10. The ransomware dubbed “WannaCry” requests a ransom of USD 300 to obtain the decryption key. The European and America continent have been the worst hit by the ransomware, but lately, there have indications of infections within Nigeria especially around Lagos and Abuja, and more systems are getting infected by the minute. There have been efforts to takedown the attack but there have also been reports that a new variant of the ransomware has been developed to evade the current takedown process. Details of the WannaCry ransomware, evidence of compromise and recommendations to stay protected are as follows:

Method of distribution
The initial distribution method is through a phishing/spam e-mail campaign; employees should be particularly vigilant for suspicious attachments or hyperlinks as one initial infection can affect an entire corporate network.

Indicators of compromise
These are the indicators of compromise identified at the moment:
Created files
The following files are created in each folder containing encrypted files:
@Please_Read_Me@.txt (sha1:596799b75b5d60aa9cd45646f68e9c0bd06df252)
@WanaDecryptor@.exe (sha1:45356a9dd616ed7161a3b9192e2f318d0ab5ad10)
Additionally, the following files are created in the indicated paths:
C:\Users\\AppData\Local\Temp\b.wnry
C:\Users\\AppData\Local\Temp\c.wnry
C:\Users\\AppData\Local\Temp\m.vbs
C:\Users\\AppData\Local\Temp\taskdl.exe (sha1:47a9ad4125b6bd7c55e4e7da251e23f089407b8f)
C:\ProgramData\\taskse.exe (sha1:be5d6279874da315e3080b06083757aad9b32c23)
C:\Users\\AppData\Local\Temp\149431494587197.bat (sha1:5d6ada3f2ecc162ecd821faee72a719b7f194678)
Persistence method and other behavioural patterns
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v “” /t REG_SZ /d “\”C:\Users\\AppData\Local\Temp\tasksche.exe\”” /f
Affected file extensions
The extensions of the files affected by this ransomware are the following:
“.doc”,”.docx”,”.xls”,”.xlsx”,”.ppt”,”.pptx”,”.pst”,”.ost”,”.msg”,”.eml”,”.vsd”,”.vsdx”,”.txt”
“.csv”,”.rtf”,”.123″,”.wks”,”.wk1″,”.pdf”,”.dwg”,”.onetoc2″,”.snt”,”.jpeg”,”.jpg”,”.docb”
“.docm”,”.dot”,”.dotm”,”.dotx”,”.xlsm”,”.xlsb”,”.xlw”,”.xlt”,”.xlm”,”.xlc”,”.xltx”,”.xltm”
“.pptm”,”.pot”,”.pps”,”.ppsm”,”.ppsx”,”.ppam”,”.potx”,”.potm”,”.edb”,”.hwp”,”.602″
“.sxi”,”.sti”,”.sldx”,”.sldm”,”.sldm”,”.vdi”,”.vmdk”,”.vmx”,”.gpg”,”.aes”,”.ARC”,”.PAQ”
“.bz2″,”.tbk”,”.bak”,”.tar”,”.tgz”,”.gz”,”.7z”,”.rar”,”.zip”,”.backup”,”.iso”,”.vcd”,”.bmp”
“.png”,”.gif”,”.raw”,”.cgm”,”.tif”,”.tiff”,”.nef”,”.psd”,”.ai”,”.svg”,”.djvu”,”.m4u”,”.m3u”
“.3g2″,”.mkv”,”.3gp”,”.mp4″,”.mov”,”.avi”,”.asf”,”.mpeg”,”.vob”,”.mpg”,”.wmv”,”.fla”
“.swf”,”.wav”,”.mp3″,”.sh”,”.class”,”.jar”,”.java”,”.rb”,”.asp”,”.php”,”.jsp”,”.brd”,”.sch”
“.dch”,”.dip”,”.pl”,”.vb”,”.vbs”,”.ps1″,”.bat”,”.cmd”,”.js”,”.asm”,”.h”,”.pas”,”.cpp”,”.c”
“.cs”,”.suo”,”.sln”,”.ldf”,”.mdf”,”.ibd”,”.myi”,”.myd”,”.frm”,”.odb”,”.dbf”,”.db”,”.mdb”
“.accdb”,”.sql”,”.sqlitedb”,”.sqlite3″,”.asc”,”.lay6″,”.lay”,”.mml”,”.sxm”,”.otg”,”.odg”
“.uop”,”.std”,”.sxd”,”.otp”,”.odp”,”.wb2″,”.slk”,”.dif”,”.stc”,”.sxc”,”.ots”,”.ods”,”.3dm”
“.max”,”.3ds”,”.uot”,”.stw”,”.sxw”,”.ott”,”.odt”,”.pem”,”.p12″,”.csr”,”.crt”,”.key”,”.pfx”
“.der”,”.mid”,”.wma”,”.flv”

At the same time, the malware generates the following mutex to fulfil its purpose:
MsWinZonesCacheCounterMutexW

This ransomware sample erases the security backup copies known as “Shadow Copies”, which are created by the OS itself. This behaviour is usual in this type of malware:
“cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog –quiet”
Encrypted files are renamed with the extension “wncry”.

Communications
Likewise, the sample incorporates the ability to perform Tor-based communications to enable payments. The Tor network domains identified for this communication are the following:
• gx7ekbenv2riucmf.onion
• 57g7spgrzlojinas.onion
• xxlvbrloxvriy2c5.onion
• 76jdd2ir2embyv47.onion
• cwwnhwhlz52maqm7.onion

The ransomware also makes call backs to the following IP addresses:
1) 188.166.23.127:443
2) 193.23.244.244:443
3) 2.3.69.209:9001
4) 146.0.32.144:9001
5) 50.7.161.218:9001
6) 217.79.179.77
7) 128.31.0.39
8) 213.61.66.116
9) 212.47.232.237
10) 81.30.158.223
11) 79.172.193.32
12) 89.45.235.21
13) 38.229.72.16
14) 188.138.33.220

Recommendations

To mitigate this risk of becoming infected with this ransomware. Please do the following:
1. Ensure all Windows-based systems are fully patched. At a very minimum, ensure Microsoft bulletin MS17-010 has been applied. Have effective patch management that deploys security updates to endpoints and other critical parts of your infrastructure in a timely manner
2. In accordance with known best practices, it is advised that inbound traffic to the Server Message Block (SMB, ports 139, 445) service from the internet should be blocked immediately.
3. We also recommend that inbound or outbound communication to the aforementioned IP Addresses are blocked completely while network connections to the Tor network, which would indicate a possible infection are monitored.
4. There should be an increased awareness campaign around phishing and social engineering methods that may be employed to compromise the organization’s systems and computers.
5. Implement a disaster recovery plan that includes backing up and restoring data from devices that are kept offline. Adversaries frequently target backup mechanisms to limit the possibilities a user may be able to restore their files without paying the ransom.

Leave a Reply