GandCrab 5.0.4 Not Stopped

[KDibble]

Avast Business Protection Plus
EndPoint Protection 8.x
with SOA
Most recent pattern and engine files installed
Windows 7 SP1 Ultimate 32-bit

Yesterday at about 1:52 pm US EST, SOA reported that the web shield found the following:

[usual protocol]  //aoundantag.com/rez-senqo/o402ek2m.php?|=dalon5.dds   

I assume this means that the URL was detected either as a web drive-by or by clicking a malicious link in an email or document.

The web shield detected this as a problem but avast! DID NOT PREVENT EXECUTION.

This URL inserted a GandCrab ransomware infection on the workstation, which encrypted all targeted files on that machine and then migrated to a mapped share and partially encrypted its contents before someone discovered it and the workstation and the server that held the share were shut down.

VirusTotal reports the following on that URL:

BitDefender - Malware
ESET - Malware
Fortinet - Malware
CRDF - Malicious
Forcepoint ThreatSeeker - Malicious
Sophos AV - Malicious
Spamhaus - Spam

None of the other VirusTotal engines detected anything.

I have not completed a forensic review but I wanted to alert you. Perhaps someone can investigate and discover more about the details of what this URL does.

[KDibble]

Update: I determined that the user downloaded an email containing a Word file attachment that was infected. I won't attempt to upload the file here. When opened in Word 2010 it displays a simple message claiming that the file was created in an earlier version of Word and the user should click various buttons in Word to enable it. I assume the user did so, and then was shown a link that she clicked to access the nasty URL I posted earlier.

With everything that was contained in that attachment, I believe avast! should have detected it as malicious and deleted it when the user tried to open it, as it usually does with malicious attachments.

I uploaded the Word file to VirusTotal, and it was flagged by multiple engines. This is the analysis that VirusTotal provided:

History
Creation Time
2018-04-19 18:59:00
First Submission
2018-12-17 17:55:01
Last Submission
2018-12-17 17:55:01
Last Analysis
2018-12-17 17:55:01
File names
•   QSMINC.doc
OLE Compound File Info
Commonly Abused Properties
•   May try to run other files, shell commands or applications.
Makes use of macros
Macros and VBA code streams
ThisDocument.cls
run-file
Summary Info
application name
Microsoft Office Word
character count
2
code page
Cyrillic
comments
Face to face dynamic projection
creation datetime
2018-04-19 19:59:00
edit time
180
last saved
2018-12-17 11:32:00
page count
1
revision number
11
security
0
subject
Hawaii Assunta
template
Normal
title
Ameliorated dedicated service-desk
word count
0
Document Summary Info
byte count
23552
characters with spaces
2
code page
Cyrillic
company
Jacobson Inc and Sons Rosalia Barton
hyperlinks changed
false
line count
1
links dirty
false
manager
Darrell Ondricka
paragraph count
1
scale
false
shared document
false
version
1048576
OLE Streams
•   
•  Root Entry
•  •  CompObj
•  •  DocumentSummaryInformation
•  •  SummaryInformation
•  •  1Table
•  •  Data
•  •  Macros/PROJECT
•  •  Macros/PROJECTwm
•  •  Macros/VBA/ThisDocument
•   •  Macros/VBA/_VBA_PROJECT
ExifTool File Metadata
AppVersion
16.0
Bytes
23552
CharCountWithSpaces
2
Characters
2
CodePage
Windows Cyrillic
Comments
Face to face dynamic projection
CompObjUserType
Microsoft Word 97-2003 Document
CompObjUserTypeLen
32
Company
Jacobson Inc and Sons Rosalia Barton
CreateDate
2018:04:19 18:59:00
DocFlags
Has picture, 1Table, ExtChar
FileType
DOC
FileTypeExtension
doc
HeadingPairs
Title, 1, , 1
HyperlinksChanged
No
Identification
Word 8.0
LanguageCode
Russian
LastPrinted
0000:00:00 00:00:00
Lines
1
LinksUpToDate
No
MIMEType
application/msword
Manager
Darrell Ondricka
ModifyDate
2018:12:17 10:32:00
Pages
1
Paragraphs
1
RevisionNumber
11
ScaleCrop
No
Security
None
SharedDoc
No
Software
Microsoft Office Word
System
Windows
Template
Normal
TotalEditTime
3 minutes
Word97
No
Words
0

[Pondus]

Much better to post link to the VT scan, then we can see all the info

Alternative the file MD5 or SHA-256 then we can search VT

avast lab can then also fetch the file from VT when they see this post
all files uploaded to VT are shared among members so they will get it sooner or later

[KDibble]

Glad to:

VirusTotal file scan:

https://www.virustotal.com/#/file/5172985158410e4888058ce991680f8281489606fbd6eda31e5ca51bd058a69d/detection

VirusTotal URL (see first message) scan:

https://www.virustotal.com/#/url/fce4977c043ac089668c696abca4142f38644ea20faaaf59ee887480d5fbacc1/detection

Thanks.

[polonus]

Malcode with us since 2015: https://blog.malwarebytes.com/threat-analysis/2015/10/beware-of-doc-a-look-on-malicious-macros/ May try to run other files, shell commands or applications.
             Makes use of macros

polonus

[KDibble]

User's story is unclear. She does not remember if she had to take action in the blue-background Word document, where the instructions were to do something in Word to "enable" it. When I tested it on her machine it was disconnected from the network, so perhaps it behaves differently if it can detect an internet connection upon opening?

If avast has known about this code since 2015, why didn't it block execution of the macros? Why was it the Web Shield, and not the File Shield, that noticed it and reported it in the SOA?

[Asyn]

Avast Business Protection Plus
EndPoint Protection 8.x
with SOA

To start with, that's an outdated version..!! Best you migrate your users to Avast Business AV.
-> https://kb.support.business.avast.com/GetPublicArticle?title=Manually-Migrate-From-Endpoint-Protection-To-Business-Antivirus

[Pondus]

attachment is now detected by avast
https://www.virustotal.com/#/file/5172985158410e4888058ce991680f8281489606fbd6eda31e5ca51bd058a69d/detection

[KDibble]

Avast Business Protection Plus
EndPoint Protection 8.x
with SOA

To start with, that's an outdated version..!! Best you migrate your users to Avast Business AV.
-> https://kb.support.business.avast.com/GetPublicArticle?title=Manually-Migrate-From-Endpoint-Protection-To-Business-Antivirus

With all due respect, the version we have is still fully supported, and still gets regular pattern and engine updates. "Outdated" is not a valid excuse for the failure to fully detect and stop this infection.

The migration is not trivial for a network with over 150 licenses, and there are many other more urgent matters that demand my time.

If and when we begin to introduce Windows 10 machines, we will deal with it then.

[KDibble]

attachment is now detected by avast
https://www.virustotal.com/#/file/5172985158410e4888058ce991680f8281489606fbd6eda31e5ca51bd058a69d/detection

Thank you very much.

[Updated to add:]

I confirm that program version 8.0.1609 with engine & definitions version 181219-2 detects and removes this file.

[Asyn]

Avast Business Protection Plus
EndPoint Protection 8.x
with SOA

To start with, that's an outdated version..!! Best you migrate your users to Avast Business AV.
-> https://kb.support.business.avast.com/GetPublicArticle?title=Manually-Migrate-From-Endpoint-Protection-To-Business-Antivirus

With all due respect, the version we have is still fully supported, and still gets regular pattern and engine updates. "Outdated" is not a valid excuse for the failure to fully detect and stop this infection. The migration is not trivial for a network with over 150 licenses, and there are many other more urgent matters that demand my time.

Well, that's up to you anyway.
But V8 was last updated 2016 and is missing all the features introduced later on.
So, don't expect it to be "bulletproof". (Esp. regarding Ransomware)