5

I was recently asked to look at a Windows computer behaving strangely, and I found a "Your files have been encrypted" ransom note that had been left in several directories. I wasn't able to identify any actual encrypted files, except for one copy of the ransom note that had been encrypted by a different ransomware that left another note.

The ransom note was present in 3 formats: a plain text file, an HTML file, and a shortcut (.url file) pointing to the payment web page.

I was able to read some of the files, but some of them (the second ransomware's note, and the first ransomware's HTML file) disappeared immediately on any attempt to open them. I was then notified by System Center Endpoint Protection that it had identified them and quarantined them. I had to restore them from quarantine and disable its real-time scanning to be able to read them.

This seems to me like a drastic action. It acted as if reading the note was going to cause further damage, when in fact the opposite is true: reading the note is the only way you will ever have a non-zero chance of decrypting your files!

It wasn't just treating them as "generally suspicious" - it specifically said they were Ransom:HTML/Tescrypt.A and Ransom:HTML/Crowti.A so it had enough information to make a better decision.

On the other hand, preventing the victims from reading the ransom notes could be seen as a hard "no negotiation" rule. If victims can't make contact, the crypto-ransom industry will be less profitable, and maybe that fact will deter future incidents, which would be a definite long-term benefit. As for the current victim, well, there was no guarantee the bad guy is really going to give up the decryption key after they get the money...

Is Shoot The Hostage an official policy in the anti-virus industry?

Improve this question
3
  • In your message you say "I wasn't able to identify any actual encrypted files", so basically you are confirming that the malware, while present, was unable to proceed in his nefarious action (most probably because of the anti-virus system)?
    – WhiteWinterWolf
    Aug 7, 2015 at 13:51
  • I don't know why it didn't encrypt more files. I assume since the ransom notes were installed that the scanner didn't recognize them at the time of the initial infections (which, going by file timestamps, happened 4 and 11 months ago).
    – user54862
    Aug 7, 2015 at 14:10
  • I cannot know for sure either, but the fact that the malware left ransom notes while the files where not actually encrypted clearly shows that something turned wrong for him. And if something turns wrong for a malware on a machine with an anti-virus installed, the best bet is to think that the anti-virus just did its job. He missed the notes files creation, but successfully blocked the files encryption process which was the real malicious payload in this malware.
    – WhiteWinterWolf
    Aug 7, 2015 at 14:21

2 Answers 2

Reset to default
2

The AV is set to identify and quarantine files associated with malware. It probably can't tell the file is just a ransom note and not something more malicious, so it treats it like it would treat any other part of ransomware.

Also, it didn't prevent you from reading the ransom note entirely, it just made you take a few extra steps to access it. Not quite "Shoot the hostage".

Improve this answer
1

Yes it certainly is common to remove or quarantine all files associated with ransomware (or any other potential security threat).

This is not really decreasing your chance to decrypt your files. IMHO you have already lost if they are encrypted and the ransomware uses a randomly generated key. The likelihood that you would actually get any decryption key after paying money is small.

Files placed by the ransomware on the other hand have the potential to create further damage. For instance the html file could redirect you to a webserver containing various exploits. So putting the file in quarantine does make sense.

Deleting files right away would be indeed a bad behavior as false-positives happen from time to time or you might want to check those files like in your case (at your own risk).

Every good Endpoint Protection Software should be configurable to have the desired behavior.

Improve this answer

You must log in to answer this question.