Sign In with your
Trend Micro Account
Need Help?
Need More Help?

Create a technical support case if you need further support.

Preventing WannaCry (WCRY) ransomware attacks using Trend Micro products

    • Updated:
    • 6 Dec 2017
    • Product/Version:
    • Deep Discovery Analyzer 5.1
    • Deep Discovery Analyzer 5.5
    • Deep Discovery Analyzer 5.8
    • Deep Discovery Analyzer All.All
    • Deep Discovery Inspector 3.6
    • Deep Discovery Inspector 3.7
    • Deep Discovery Inspector 3.8
    • Deep Discovery Inspector 5.0
    • Deep Discovery Inspector All.All
    • Deep Security 10.0
    • Deep Security 9.6
    • Deep Security All.All
    • OfficeScan 10.6
    • OfficeScan 11.0
    • OfficeScan All.All
    • OfficeScan XG.All
    • Worry-Free Business Security Services 6.2
    • Worry-Free Business Security Services All.All
    • Worry-Free Business Security Standard/Advanced 9.0
    • Worry-Free Business Security Standard/Advanced 9.5
    • Worry-Free Business Security Standard/Advanced All.All
    • Platform:
    • Windows 10
    • Windows All
Summary

Updated: May 21 @ 6:00PM GMT

 
Please note that this article is intended for enterprise and business users. For Home/Home Office users, please visit the related knowledgebase article here.

What is the Wannacry (WCRY) ransomware?

Trend Micro is closely monitoring the latest ransomware outbreak that has affected several organizations around the world. This ransomware attack is referred to as WCRY or WannaCry. This ransomware is taking advantage of a recently disclosed Microsoft vulnerability (MS17-010 – “Eternalblue”) associated with the Shadow Brokers tools release. After a computer is infected, WannaCry ransomware targets and encrypts 176 file types. Some of the file types WannaCry targets are database files, multimedia and archive files, as well as Microsoft Office documents. In its ransom note, which supports 27 languages, it initially demands US$300 worth of Bitcoins from its victims—an amount that increases incrementally after a certain time limit. The victim is also given seven days before the affected files are deleted.

Ransomware Wana Decrytor Ransom Message

Click image to enlarge

 
As of May 21,2017, Trend Micro's Ransomware File Decryptor tool has added limited support for recovery of infected Windows machines. Please visit here for more information on the tool.

How does it infect computers?

WannaCry leverages CVE-2017-0144, a vulnerability in Microsoft Server Message Block 1.0 (SMBv1), to infect computers. The security flaw is attacked using an exploit leaked by the Shadow Brokers group—the “EternalBlue” exploit, in particular. Although, Microsoft’s Security Response Center (MSRC) Team addressed the vulnerability via MS17-010 released March, 2017, unpatched computers are easily infected. Its worm-like behavior allows WannaCry to spread across networks, infecting connected systems without user interaction. Once one computer on a network is infected, it will place the whole network at risk.

We are closely monitoring similar threats - such as the recently reported Uiwix ransomware and Monero-Mining malware - that appear to be exploiting the same vulnerability mentioned above - and are continually updating our detections with these new samples (e.g. Ransom_UIWIX.A, TROJ_COINMINER.WN). Please visit our new Security Intelligence blog entry for more information on these new threats.

Details
Public

What steps do I need to take to reduce the risk of infection?

Implement the best practices

  • Patch and update your systems, or consider a virtual patching solution.
  • Enable your firewalls as well as intrusion detection and prevention systems.
  • Proactively monitor and validate traffic going in and out of the network.
  • Implement security mechanisms for other points of entry attackers can use, such as email and websites.
  • Deploy application control to prevent suspicious files from executing on top of behavior monitoring that can thwart unwanted modifications to the system.
  • Employ data categorization and network segmentation to mitigate further exposure and damage to data.
  • Disable SMB (v1) on vulnerable machines – using either GPO or by following the instructions provided by Microsoft.
  • Ensure that all of the latest patches (if possible using Virtual Patching solution) are applied to affected operating systems – especially the ones related to MS17-010.

Protect your network using Trend Micro Products

Trend Micro recommends a layered security approach on endpoint, messaging, and gateway, to ensure that all potential entry and compromise points have protection against these types of threats:

  • Updated Configuration and Next Generation Technology - Trend Micro customers using the latest versions of OfficeScan and Worry-Free Business Security should ensure that they have both Predictive Machine Learning (OfficeScan, Worry-Free Services) and all relevant Ransomware protection features enabled in their product. The following article contains information on optimal configurations to help protect against ransomware: https://success.trendmicro.com/solution/1112223
  • Smart Scan Agent Pattern and Official Pattern Release: Trend Micro has added known variant and component detections into the following patterns for all products that utilizes these patterns:
    • Smart Scan Agent Pattern - 13.401.00
    • Official Pattern Release (conventional) - 13.401.00
     
    Please note that these patterns are the minimum recommended ones that contain protection for this threat -- however, due to new components and variants being discovered it is important that customers ALWAYS obtain the latest pattern files to ensure up-to-date protection.
  • Trend Micro Web Reputation Services (WRS) has added coverage for known Command and Control (C&C) servers.
  • Trend Micro Deep Security and Vulnerability Protection (formerly the IDF plug-in for OfficeScan) customers with the latest IPS rules have an updated layer of Virtual Patching protection for multiple Windows operating systems, including some that have reached end-of-support (XP, 2000, 2003). Specifically, Trend Micro released the following IPS rules for proactive protection:
    • IPS Rules 1008224, 1008228, 1008225, 1008227 - Includes coverage for MS17-010 and some specific protection against Windows SMB remote code execution vulnerabilities
  • Trend Micro Deep Discovery Inspector customers with the latest rules also have an additional layer of protection against the vulnerabilities associated with the exploit. Specifically, Trend Micro has released the following official rule for proactive protection:
    • DDI Rule 2383: CVE-2017-0144 - Remote Code Execution - SMB (Request)
  • Trend Micro TippingPoint customers with the following filters have updated protection:
    • Filters 5614, 27433, 27711, 27935, 27928 - Includes coverage for MS17-010 and some specific protection against Windows SMB remote code execution vulnerabilities and attacks
    • ThreatDV Filter 30623 - helps to mitigate outbound C2 communication
    • Policy Filter 11403 - provides additional protection against suspicious SMB fragmentation
  • Trend Micro Endpoint Application Control (EAC) administrators utilizing the product's "Lockdown" mode - which allows only pre-specified applications to run - also provides protection against this threat.
  • Trend Micro Cloud Edge and Smart Home Network customers have protection with the following rules:
    • Rule 1133615: SMB Microsoft Windows SMB Server SMBv1 CVE-2017-0145 Buffer Overflow (CVE-2017-0145)
    • Rule 1133635: SMB Microsoft MS17-010 SMB Remote Code Execution -1
    • Rule 1133636: SMB Microsoft MS17-010 SMB Remote Code Execution -2
    • Rule 1133637: SMB Microsoft MS17-010 SMB Remote Code Execution -3
    • Rule 1133638: SMB Microsoft MS17-010 SMB Remote Code Execution -4

Trend Micro highly recommends that vendor critical patches are applied as soon as possible upon release. Customers and partners who may need some additional information or have questions are encouraged to contact their authorized Trend Micro technical support representative for further assistance.

Useful tools to help detect and prevent infection

Trend Micro also has some standalone tools available for assessing and addressing potential WCRY risk and infections on end-user machines.

 
Please note these tools are provided as-is, without warranties of any kind. They are meant to assist customers in emergency troubleshooting, and are not guaranteed to be error-free. Please click here for further information about the terms and conditions on Trend Micro tools.

Customers who have any questions or issues using the tools provided below should contact Trend Micro technical support for additional assistance.

  • Trend Micro Anti-Threat Toolkit (ATTK): users having issues with their endpoint protection may try downloading ATTK to scan a potentially compromised machine for malware (including WCRY). There are both online and offline versions available. Please visit this article for additional instructions on how to use ATTK.
  • Trend Micro WCRY Simple Patch Validation Tool: this simple tool performs two functions – (1) checks a local machine to see if Microsoft’s MS17-010 patch has been successfully applied; and (2) offers to and allows the user to easily disable SMB v1 on the local machine via registry key. It is designed as a quick tool for users that may not have other easy means to validate the system patch or disable SMB v1. (SHA-256: 6f8e6dd35155f68f0c20acf214e2d3523bde25cb65ed922832d76542107bad24)
  • Trend Micro Ransomware Decryptor:  Trend Micro has added limited decryption support for WCRY infected machines as of May 21, 2017.  Based on internal testing, the highest success rate has been observed on infected systems running Windows XP (x86) - but individual users' success rates will vary.  Please visit the article for the tool and detailed instructions.

Additional Information

Below is additional technical information on the known variants and components of this ransomware attack: 

Expert Analysis

Technical Information

3rd Party Information

Premium
Internal
Rating:
Category:
Remove a Malware / Virus
Solution Id:
1117391
Feedback
Did this article help you?

Thank you for your feedback!

To help us improve the quality of this article, please leave your email here so we can clarify further your feedback, if neccessary:
We will not send you spam or share your email address.

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.

If you need additional help, you may try to contact the support team. Contact Support


To help us improve the quality of this article, please leave your email here so we can clarify further your feedback, if neccessary:
We will not send you spam or share your email address.

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.