Sign In with your
Trend Micro Account
Need Help?
Need More Help?

Create a technical support case if you need further support.

Mitigating the TROJ_CRYPWALL v3 using Trend Micro products

    • Updated:
    • 7 Nov 2016
    • Product/Version:
    • Deep Discovery 3.0
    • Deep Discovery 3.1
    • Deep Discovery 3.2
    • Deep Security 8.0
    • Deep Security 9.0
    • Deep Security 9.5
    • Deep Security 9.6
    • InterScan Messaging Security Virtual Appliance 8.2
    • InterScan Messaging Security Virtual Appliance 8.5
    • InterScan Messaging Security Virtual Appliance 9.0
    • InterScan Web Security Virtual Appliance 6.0
    • InterScan Web Security Virtual Appliance 6.5
    • OfficeScan 10.6
    • OfficeScan 11.0
    • ScanMail for Exchange 10.2
    • ScanMail for Exchange 11.0
    • Platform:
    • N/A N/A
Summary

TROJ_CRYPWALL v3 is also known as CryptoWall 3.0. Apart from its encryption technique, it also deletes Windows Shadow Copies - making restoration of files difficult. This version comes together with a FAREIT spyware variant.

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. It modifies registry entries to disable various system services. This action prevents most of the system functions to be used.

It connects to certain websites to send and receive information.

For further information on TROJ_CRYPWALL variants that Trend Micro already detects, click here.

empty window

 
Make sure to always use the latest pattern available to detect the old and new variants of TROJ_CRYPWALL.
Details
Public

Solution Map

Major ProductsVersionsVirus PatternBehavior MonitoringEmail ReputationAntiSpam PatternWeb ReputationDDI Pattern
OfficeScan*10.6 and above









Update Pattern via web console
Update Pattern via web consoleN/AN/A









Enable Web Reputation Service**
N/A
Deep Security8.0 and aboveN/AN/AN/AN/A
ScanMailSMEX 10 and laterN/AEnable Email Reputation Service**


Update Pattern via web console
N/A
SMD 5 and laterN/AN/AN/A
InterScan MessagingIMSVA 8.0 and aboveN/AEnable Email Reputation Service**N/A
InterScan WebIWSVA 6.0 and laterN/AN/AN/AN/A
Deep DiscoveryDDI 3.0 and laterN/AN/AN/AUpdate Pattern via web console
 
*OSCE 11 SP1 has introduced a new feature called Ransomware Protection to combat ransomware-like malware. To enable this feature, please refer to KB 1111377.
**Refer to the Product Administrator’s Guide on how to enable the Email Reputation or Web Reputation services features.

RECOMMENDATIONS

User Education

  • Ensure Trend Micro Products are updated.
  • Always check who the email sender is. If the email is supposedly coming from a bank, verify with your bank if the received message is legitimate. If from a personal contact, confirm if they sent the message. Do not rely solely on trust by virtue of relationship, as your friend or family member may be a victim of spammers as well.
  • Double-check the content of the message. There are obvious factual errors or discrepancies that you can spot: a claim from a bank or a friend that they have received something from you? Try to go to your recently sent items to double-check their claim. Such spammed messages can also use other social engineering lures to persuade users to open the message.
  • Refrain from clicking links in email. In general, clicking on links in email should be avoided. It is safer to visit any site mentioned in email directly. If you have to click on a link in email, make sure your browser uses web reputation to check the link, or use free services such as Trend Micro Site Safety Center.
  • Ensure that programs and users of the computer use the lowest level of privileges necessary to complete a task.
  • Be aware of social engineering attacks to be safe.
  • Backup important data. Unfortunately, there is no known tool to decrypt the files encrypted by a ransomware. A safe computing practice is to ensure you have back-ups of your files. The 3-2-1 principle should be in play: three copies, two different media, one separate location. Cloud storage services (such as SafeSync) can be a useful part of your backup strategy.

Configuration Best Practices

  • For best practices in preventing ransomware infection using OfficeScan and Worry-Free Business Security/Services (WFBS/WFBS-SVC), refer to this link.
  • Enable the Ransomware Protection feature available in OSCE 11 SP1 to prevent known ransomware-like behavior in the client’s environment.
  • For best practices in configuring OfficeScan for malware protection, refer to this link.
  • For best practices in enhancing protection against malware threats in Worry-Free Business Security/Services (WFBS/WFBS-SVC), refer to this link.
  • Some malwares arrive as email attachment of spam email messages that use social engineering method to lure users to open and execute it. For this specific malware, the attachment come as a JS file or HTM file. It is strongly suggested to block these files by either by true file type or by extension name (eg. *.js, *.jse, *.htm, or *.html).
    For other types of malware attachments, you may refer to this link on how to filter and block email attachments using Trend Micro's Messaging products.
  • For ERS Advance service (IP reputation) users, make sure that this feature is enabled and QIL is at least set to level 2. Refer to this procedure.
  • For added protection for social engineering attacks, you can take advantage of Trend Micro’s Social Engineering Attack Protection feature integrated with Trend Micro’s InterScan Messaging Security and Hosted Email Security products. More details can be found here.
  • For IMSVA users and during an outbreak, we advise the clients to create a policy that would block executables (or a specific file type/extension known to carry a specific malware) and archive document and zip files which will be submitted to support for further analysis. For your reference, you can follow the links below which can be further customized according to known file type malware carriers:
     
    For TROJ_CRYPWALL v3, the attachment can be filtered or blocked using name or extension (eg. JS, JSE, HTM, HTML) or for JS by true file type (eg. Executable > Java byte code)

    The policies above are usually placed after the following rules:

    • Spam rule
    • Antivirus rule
    • Client’s other customize rule (optional)

    The objective is to reject all known spam mails and known malwares and at the same time, get a high confidence sample file that will be submitted to support for further analysis.

Sample Collection

  • To ensure that new variants of this malware family is detected, we need to continue collecting samples so it can be submitted for analysis and added to the patterns and solutions if needed.
  • This is best done by filtering and blocking email attachments using Trend Micro's Messaging products. This link provides information on typical file types that carries the said malware, as well as the type of sample files that can be collected during an outbreak.
  • When collecting a sample spam mail with possible TROJ_CRYPWALL v3 involvement, please make sure to send the actual/original spam mail and not the forwarded spam.
  • Collect and submit spam and all quarantined samples for sourcing and analysis. For new cases you may upload 1 ZIP or RAR file (up to 50 MB) that is protected with the password "virus" to this link.
    FTP will be helpful for other samples. ZIP or RAR files that is protected with the password "virus"
    • SMEX and WFBS-Messaging Security Agent Quarantined mails
      Please resend all quarantined mails from MSA or SMEX server side to specific recipient for sourcing. To resend a message that is displayed in the Quarantine Log, place a checkmark in the box corresponding to that message’s row in the log and then click Resend. Spam from client side can be pulled out from either spam folder or junkmail.folders.
    • IMSVA Quarantined mails
      For IMSVA please download the files from the IMSVA console>Mail Areas & Queues>Query>Quarantine tab. Display logs then click specific emails to download copies.
  • If Trend Micro product, ATTK scan and other Trend Micro anti-malware tools did not find or detect any malware, do this procedure to collect suspicious samples and system information.
  • Normal filtering configuration should be reverted once the alert has passed.

For related reports, visit our Threat Encyclopedia:

Premium
Internal
Rating:
Category:
Configure; Troubleshoot; Remove a Malware / Virus; Update
Solution Id:
1112019
Feedback
Did this article help you?

Thank you for your feedback!

To help us improve the quality of this article, please leave your email here so we can clarify further your feedback, if neccessary:
We will not send you spam or share your email address.

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.

If you need additional help, you may try to contact the support team. Contact Support


To help us improve the quality of this article, please leave your email here so we can clarify further your feedback, if neccessary:
We will not send you spam or share your email address.

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.


Need More Help?

Create a technical support case if you need further support.