eGambit EDR versus WannaCrypt Ransomware

This article will explore eGambit features to fight against massive ransomware attacks WannaCrypt. The reader will discover how Cyber Robots & Artificial Intelligence engines might get stronger than malwares…

On May 12, 2017 before noon, the cybersecurity community discovered a massive spread of a new ransomware abusing a well know vulnerability against Microsoft Windows operating systems.

MS17-010 security issues, with a patch proposed on 14th March 2017.

Many computers were not protected against related threats as old Windows XP and many recent unpatched Windows as well (Production Infrastructures like SCADA stuff, Unmanaged PC…). Indeed, many infrastructures were not applying these needed principles : Containment & Detection.

This article will not focus on the attack itself, as many web sites already shared interesting information.

Instead, we will explain how enhanced mechanisms proposed in eGambit product had the power to detect and/or neutralize the threats automatically, worldwide without human actions.

Threat Blocked eGambit

ABOUT THE WANNACRYPT RANSOMWARE

This malware got multiple names such as Wcry, WanaCry, WanaCrypt, Wanna Decryptor, etc.

Multiple virus strains were observed (with or without the famous kill switch…)

According to our security experts at TEHTRIS, the malware WannaCrypt was poorly written, as the attackers decided to work with a “mass market” feeling.

Indeed, as explained by our stealth pentesters at TEHTRIS, it would have been more efficient for the attackers if they had built a file-less attack thanks to the EternalBlue exploit.

Hopefully, the attack was not that dangerous despite what was said in some newspapers. A far more horrible attack could have exist, destroying tons of computers worldwide (especially when exploits are known for months).

This is extremely interesting because eGambit is able to analyze and to fight against unknown programs when they appear on an infrastructure.

AUTOMATIC FIGHT AGAINST UNKNOWN THREATS

The full eGambit arsenal is able to automatically work against unknown threats.

Quick scenario example regarding a new threat (Ransomware, APT…) :

  • An eGambit Endpoint Security agent detects an unknown programs (unknown worldwide)
  • This program is analyzed and sent back to the nearest available connected appliance for further analysis
  • The eGambit Forensics portal with its API is used by multiple robots to cut and analyze potential weapons
  • Analyzed with Internal Antivirus engines > Might remain an unknown threat (signatures cannot always work with new stuff)
  • Requests into worldwide databases like VirusTotal > Unknown threat until someone would submit it
  • eGambit Internal Sandboxes > DETECTION + Interesting IOC > eGambit Endpoint Security agent will know it in minutes
  • eGambit Artificial Intelligence > DETECTION > Detection rate = 98.1% even with unknown Windows malwares

eGambit can automatically detect & fight new threats like WannaCrypt and the survival time is less than few minutes for the malware worldwide.

NETWORK ANALYSIS

eGambit robots are able to automatically analyze new threats like humans would do, thanks to our powerful eGambit Forensics portal. This allows eGambit end-users to have a 24/7 protection with humans + robots & artificial intelligence.

Example: with the WannaCry Ransomware, here are the evidences of network traffic found :

DNS REQUEST

Security experts quickly found out the binary code in order to connect to a specific web site :

http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com

This HTTP ping-like mechanism was a kind of kill-switch already included in the malware :

  • What would happen if this domain name was not created quickly enough ?
  • The attack slowed down when this domain was registered by a security expert
  • Nevertheless, new versions came out without the kill switch option…

NETWORK BEHAVIOR ANALYSIS

BEHAVIOR ANALYSIS THANKS TO eGambit HONEYTOKEN FILES

eGambit use honey token files such as fake Office Documents
  • Each time a program will try to attack these files, it will trigger an alert
  • Ransomwares are easily detected with this method
  • This Ransomware added new file extensions to multiple modified files (WNCRY, WNCRYT)
  • The Recycle Bin was also removed
  • Shadow Copies were potentially deleted
  • eGambit detected many weird related executions (see next slide) on these fake Microsoft binaries

BEHAVIOR ANALYSIS THROUGH EXECUTED COMMANDS IN eGambit FORENSIC PORTAL

Execution of multiple commands easily found by the eGambit Sandboxing system (not stealth). Beyond the fact that TOR was detected, new startups keys were detected in the Registry.

THE DROPPER TRIED TO CREATE A NON STEALTH WINDOWS SERVICE LOOKING LIKE MS STUFF

eGambit FORENSICS versus WANNACRYPT

Execution of multiple commands easily found by the eGambit Sandboxing system (not stealth). Beyond the fact that TOR was detected, new startups keys were detected in the Registry.

eGambit A.I. versus WANNACRYPT – DETECTION RATE 100% : 1 – 0

Beyond previous eGambit sensors, our Artificial Intelligence engine had to work on the malware.

The programs used by the WannaCrypt Ransomware (dropper, etc) were fully detected by the eGambit Artificial Intelligence engine with a strong confidence.

Recently, an independent testing company in China (SKD-Labs) credited eGambit Artificial Intelligence engine with 98.1% of detection. This engine has no signature (deep learning & neural networks).

eGambit EDR versus WANNACRYPT : 1 – 0

Fighting against the ransomware with the eGambit Endpoint Security agent worked better than traditional security, though we remain humble as new threats could try to be more stealth.

Once the programs were identified automatically thanks to our robots and artificial intelligence engines worldwide, then the threats could be detected and neutralized directly.

Customers just need to apply for a good neutralization inside eGambit.

Conclusion

  • Nothing will replace a good patch management policy, and this terrible incident worldwide reminds all of us, that nobody shall wait for attacks. We will all remain humble regarding the IT Security threats that can happen, especially because of the related proliferation of advanced weapons like the exploits used by WannaCrypt (~Nation State sponsored).

  • On top of the basic Windows security principles, we strongly recommend to deploy advanced Endpoint Security agents with enhanced features (like eGambit for example) in order to :

  • Help your antivirus against unknown threats (Sandbox, Artificial Intelligence…)

  • Follow local system activity (Spawn tree protections, persistent threats tracking, real time process tracking…)

  • Analyze your Windows system logs (SIEM features, even on Workstations)

  • Audit your Windows Security (check CVE issues and improve patch management…)

  • For now, we recorded 0 compromising worldwide, by the WannaCrypt threat, for all the Windows protected by the eGambit Endpoint Security agent with the neutralization activated
Share on social networks
Share on facebook
Share on twitter
Share on linkedin
Our latest articles
Cyber or not Cyber ?

Subscribe to the TEHTRIS newsletter.

Once a month, get the latest cyber news by subscribing to the TEHTRIS newsletter.

To explore the subject

Similar publications

Cyber or not cyber ?

Once a month, receive the essential news and cyber watch by subscribing to the TEHTRIS newsletter.