Sophos Intercept X with EDR includes the ability to get additional processed
details. The process details will perform a number of things and gives you
multiple options on a tab breakdown. On the first landing page you get to see
the reputation of this executable. Is it well known and manufactured by a
legitimate software vendor and signed, is it somewhere in between and suspect, or
is it very similar to malware. This initial indicator can be a very good
guide on whether or not you need to perform a block, and search for this
across other devices. What I want to show here though is some information that's
available directly from the console so you can see it in action. In this case
Sophos Intercept X has a ransomware detection from ransomgen.exe that was
launched from a PowerShell. We've already taken some actions to isolate the
computer and now we're investigating the processes that were involved in the
attack. We can see the PowerShell was identified as the root cause. As an
administrator I can take a look at the details of PowerShell, and I can see that
PowerShell itself has a very strong known good reputation. PowerShell is
actually a part of the operating system. You can see here we've grayed out the
option to clean and block it, removing this from the machine is not advised and
can't be done directly through here. PowerShell though is on an application
control list, so if you want it to prevent its use by the end users you
could. Going back to the details of this report though we can see the overall
reputation, the path that PowerShell is installed at, the command line that was
used during this execution. And we can see more details here. We can see that
this execution of PowerShell included a base64 encoded command string, something
very indicative of malware. But again, we're not allowed to put this on the
block list, it's a known good system component. PowerShell actually launched
the command processor, another known good application
command.exe. Again you can't clean and block that. Going down the path we can
also see that it deployed a vbscript, a memory execution tool, the ransomgen
file, and putty. Taking a look for the details of the putty dot executable we
can see that it has a strong correlation to known bad. And if we take a look at
the report summary we'll get to see some characteristics that have involved the
machine learning to compare this executable to millions of other files. So
the attributes in putty have a 36% correlation to suspect executables. Not
very high. It's code similarity to known malware is somewhat high if the location
that it's installed at and was detected on the device is fairly high. Getting
more details on that individual analysis we can see that putty includes the
ability to perform AES encryption. It can launch executable shells. It may be
hiding some of its imports. It possibly can create other processes. Code
similarity says this is an identical match to unknown malware but it also has
similar matches to other versions of putty that were also convicted. It is
very similar also to a legitimate application. In this case what I've done
is I've taken a free download executable called putty.exe and install the backdoor
in it. It's not surprising that it's similar to the known legitimate
application but the backdoor is what's allowing us to convict it.
It's install location is on the user's desktop, which is a dodgy location. If we
go ahead and look at the file properties in more detail, we can see that the
property of this file indicates that it was produced by a legitimate author, but
when we take a look at the exact details for the file break down we can see that
it's not signed. That it is including a number of characteristics and PEX
imports, so DLLs that are being used, the actual calls
those libraries. Most of these are associated with the known good
application. What I might want to do with this before I put it on a clean and
block list is search for it across other devices. Going back though to our ransomgen.
This is actually a test tool from Sophos. So when we look at its reputation
it's relatively good. It's manufactured by Sophos, but it has characteristics
that associated with malware. So you can see here it's most similar to Sophos
tester, it's an exact match it's just been renamed. This isn't something that we
want to treat as malware. It is deployed into a suspect location though. All of
these details are to assist the administrator in taking an action to go
ahead and clean and block. One of the most important things to note here
though is that known good software cannot be removed. These are applications
that may be being abused by an adversary to perform malicious activity, but aren't
malicious in and of themselves. In this case we can see that putty has a very
low reputation, and can be cleaned and blocked and searched for on other
devices. This executable mem.exe, if we look at its process details its known
bad as well it's something that should go ahead and be treated as malicious. All
of this information is available directly. By clicking on any of the
process or executable file attributes- you can note that process details aren't
available for script files- they're not a process. If we go ahead and look at the
full attack chain, we'll also see additional executables that were
involved here, and they've been tagged. One of them is marked as known bad, and
if we zoom in, we can see that the known bad is an executable called dropper.exe.
dropper.exe was launched from the same WS script file that launched our
ransomgen attack. And looking at its characteristics, we can see that it has a
strong correlation to malware. This is an executable that is going to actually
perform a powerflex attack on the device. It's been identified as bad in this
graph, but wasn't prevented from executing because I had it on an allowed
list, or I had turned off a policy that allowed the protection. By exploring the
capabilities in the process details, administrators get to take advantage of
strong machine learning, they get to take advantage of file reputation
capabilities, they can even go into details of individual executables, and in
the case of dropper, we see that it has an execution space that's marked as read
write and execute. This is self-modifying code, this is very indicative of malware.
The attribute analysis on this indicates that it has a stack canary, it contains
packed code, it manipulates other processes, it examines the disk drives to determine
the components available in the system. It's very safe to treat this as malware.
If we go and initiate a clean and block, we'll actually terminate at any running
execution on this device and put it on a blocking list so that all other devices
will treat it as malware.