topic Re: AMP for endpoint can't block the packered WannaCry. in Endpoint Security

AMP for endpoint can't block the packered WannaCry.

Tsunoda — Fri, 21 Feb 2020 05:05:28 GMT

AMP for endpoint seems to be not able to block the wannacry which is encrypted with packer tool.

Are there any workaround?

Repro-steps:

1. get a wannacry from ThreatGrid or any other service

2. encrypt it with packer tool such as upx

3. open AMP console and enable TETRA feature.

4. Install the Connector.

5. Scan the wannacry with AMP for endpoint. It is judged as no problem.

6. Run the wannacry. It works. Some programs such as WannaDecrypter are blocked. But encryption of user data complete.

Re: AMP for endpoint can't block the packered WannaCry.

emirolyu — Sat, 24 Feb 2018 19:49:55 GMT

Hello Takahiro Tsunoda,

Thank you for your screenshots and the repro-steps.

What version of the AMP for Endpoints connector are you running in this testing?

Re: AMP for endpoint can't block the packered WannaCry.

Tsunoda — Mon, 26 Feb 2018 03:30:23 GMT

Hi Evgeny,

Thank you for your reply.

The version of connector I tested is 6.0.7.10670.

Best regards,

Takahiro

Re: AMP for endpoint can't block the packered WannaCry.

emirolyu — Mon, 26 Feb 2018 14:00:22 GMT

Hi Takahiro,

Thank you for sharing further details of your testing. Did you see a Cloud IOC fire in the AMP Console? I would expect that to happen as the minimum and in a realistic scenario, the infection could be prevented by one of the "new" engines, that are a part of this connector version. For real-time ransomware blocking, there's going to be a beta of one more component available soon, that is highly effective at addressing the problem of ransomware generically (file encryption behavior observed, initiating process blocked; with an ability to exclude benign processes). A notification about the Beta will be posted to the AMP Console and you would receive an email notification if that's enabled on your console.

Re: AMP for endpoint can't block the packered WannaCry.

Tsunoda — Mon, 26 Feb 2018 16:43:21 GMT

Hi Evgeny,

I checked the trajectry. IOC have been fired. But wannacry main file was not quarantined.

I was not able to find the information about beta. How can I use it?

Re: AMP for endpoint can't block the packered WannaCry.

emirolyu — Wed, 28 Feb 2018 07:47:38 GMT

Hi Takahiro,

Apologies for the delay to respond. You can enroll in the Beta program using your AMP for Endpoints console by navigating to Management > Beta > Enroll.

Re: AMP for endpoint can't block the packered WannaCry.

Tsunoda — Thu, 01 Mar 2018 10:54:55 GMT

Thank you for your answer. My question was cleared.