Solution Map

RECOMMENDATIONS

User Education

• Ensure Trend Micro Products are updated.
• Always check who the email sender is. If the email is supposedly coming from a bank, verify with your bank if the received message is legitimate. If from a personal contact, confirm if they sent the message. Do not rely solely on trust by virtue of relationship, as your friend or family member may be a victim of spammers as well.
• Double-check the content of the message. There are obvious factual errors or discrepancies that you can spot: a claim from a bank or a friend that they have received something from you? Try to go to your recently sent items to double-check their claim. Such spammed messages can also use other social engineering lures to persuade users to open the message.
• Refrain from clicking links in email. In general, clicking on links in email should be avoided. It is safer to visit any site mentioned in email directly. If you have to click on a link in email, make sure your browser uses web reputation to check the link, or use free services such as Trend Micro Site Safety Center.
• Ensure that programs and users of the computer use the lowest level of privileges necessary to complete a task.
• Be aware of social engineering attacks to be safe.
• Backup important data. Unfortunately, there is no known tool to decrypt the files encrypted by a ransomware. A safe computing practice is to ensure you have back-ups of your files. The 3-2-1 principle should be in play: three copies, two different media, one separate location. Cloud storage services (such as SafeSync) can be a useful part of your backup strategy.

Configuration Best Practices

• For best practices in preventing ransomware infection using OfficeScan and Worry-Free Business Security/Services (WFBS/WFBS-SVC), refer to this link.
• Enable the Ransomware Protection feature available in OSCE 11 SP1 to prevent known ransomware-like behavior in the client’s environment.
• For best practices in configuring OfficeScan for malware protection, refer to this link.
• For best practices in enhancing protection against malware threats in Worry-Free Business Security/Services (WFBS/WFBS-SVC), refer to this link.
• Some malwares arrive as email attachment of spam email messages that use social engineering method to lure users to open and execute it. For this specific malware, the attachment come as a JS file or HTM file. It is strongly suggested to block these files by either by true file type or by extension name (eg. *.js, *.jse, *.htm, or *.html).
  For other types of malware attachments, you may refer to this link on how to filter and block email attachments using Trend Micro's Messaging products.
• For ERS Advance service (IP reputation) users, make sure that this feature is enabled and QIL is at least set to level 2. Refer to this procedure.
• For added protection for social engineering attacks, you can take advantage of Trend Micro’s Social Engineering Attack Protection feature integrated with Trend Micro’s InterScan Messaging Security and Hosted Email Security products. More details can be found here.
• For IMSVA users and during an outbreak, we advise the clients to create a policy that would block executables (or a specific file type/extension known to carry a specific malware) and archive document and zip files which will be submitted to support for further analysis. For your reference, you can follow the links below which can be further customized according to known file type malware carriers:
  
  • Blocking executable files
  • Archiving of doc and zip files
   

  For TROJ_CRYPWALL v3, the attachment can be filtered or blocked using name or extension (eg. JS, JSE, HTM, HTML) or for JS by true file type (eg. Executable > Java byte code)

  The policies above are usually placed after the following rules:

  • Spam rule
  • Antivirus rule
  • Client’s other customize rule (optional)

  The objective is to reject all known spam mails and known malwares and at the same time, get a high confidence sample file that will be submitted to support for further analysis.

Sample Collection

• To ensure that new variants of this malware family is detected, we need to continue collecting samples so it can be submitted for analysis and added to the patterns and solutions if needed.
• This is best done by filtering and blocking email attachments using Trend Micro's Messaging products. This link provides information on typical file types that carries the said malware, as well as the type of sample files that can be collected during an outbreak.
• When collecting a sample spam mail with possible TROJ_CRYPWALL v3 involvement, please make sure to send the actual/original spam mail and not the forwarded spam.
• Collect and submit spam and all quarantined samples for sourcing and analysis. For new cases you may upload 1 ZIP or RAR file (up to 50 MB) that is protected with the password "virus" to this link.
  FTP will be helpful for other samples. ZIP or RAR files that is protected with the password "virus"
  • SMEX and WFBS-Messaging Security Agent Quarantined mails
    Please resend all quarantined mails from MSA or SMEX server side to specific recipient for sourcing. To resend a message that is displayed in the Quarantine Log, place a checkmark in the box corresponding to that message’s row in the log and then click Resend. Spam from client side can be pulled out from either spam folder or junkmail.folders.
  • IMSVA Quarantined mails
    For IMSVA please download the files from the IMSVA console>Mail Areas & Queues>Query>Quarantine tab. Display logs then click specific emails to download copies.
• If Trend Micro product, ATTK scan and other Trend Micro anti-malware tools did not find or detect any malware, do this procedure to collect suspicious samples and system information.
• Normal filtering configuration should be reverted once the alert has passed.

For related reports, visit our Threat Encyclopedia:

• TROJ_CRYPWAL.YOI