Raccine, kills programs wiping Windows shadow volumes

[silversurfer]

A new ransomware vaccine program has been created that terminates processes that try to delete volume shadow copies using Microsoft's vssadmin.exe program,

This weekend, security researcher Florian Roth released the 'Raccine' ransomware vaccine that will monitor for the deletion of shadow volume copies using the vssadmin.exe command. "We see ransomware delete all shadow copies using vssadmin pretty often. What if we could just intercept that request and kill the invoking process? Let's try to create a simple vaccine," Raccine's GitHub page explains.

Raccine works by registering the raccine.exe executable as a debugger for vssadmin.exe using the Image File Execution Options Windows registry key.
Once raccine.exe is registered as a debugger, every time vssadmin.exe is executed, it will also launch Raccine, which will check to see if vssadmin is trying to delete shadow copies. If it detects a process is using 'vssadmin delete,' it will automatically terminate the process, which is usually done before ransomware begins encrypting files on a computer.

Read more: New ransomware vaccine kills programs wiping Windows shadow volumes

 

[struppigel]

Please note that this is not a vaccine. It's a generic ransomware detection with process kill to prevent encryption. It does not remove the ransomware which is fully fine for the scope of a PoC code. I also believe that most AVs do have some detection like this in their software.

What's the difference of vaccine vs detect&kill?

A vaccine is passive. It does not actively remove or kill the malware.
Vaccine works against one specific malware by applying characteristics to the system that persuades the malware to not work (properly) in the first place. E.g. classic vaccines for viruses would apply their infection markers. The virus will "think" the system is already infected and not execute the infection routine. A vaccine for a ransomware might persuade the ransomware that it already encrypted the system.
Generic vaccines are very rare. They are usually specifically against one strain of malware.

Detect & kill is an active protection. It has to run constantly or regularly to work and there must be some non-malware procedure that executes the kill or removal of files.

 

[Andy Ful]

The author skipped the possibility of killing explorer.exe in the tree of processes that had invoked vssadmin.exe. When killing explorer.exe the user would lose the Windows taskbar and Desktop. But, it is possible to overcome this issue by adding the code that refreshes the Explorer (kill all instances of the Explorer and run it again on the current user account). I used such a code in H_C some time ago. It is easy on default Admin account and slightly more advanced on SUA.

 

[Andy Ful]

The Raccine will not work for ransomware that uses WMI (without using wmic.exe) to delete shadow copies. This can be done via scripting (PowerShell, Windows Script Host, etc.). Simply, the vssadmin.exe will be a child process of WmiPrvSE and not a child of scripting engine or ransomware executable.

 

[struppigel]

Here is a similar PoC program that just didn't get the same media attention: nshalabi/ProtectVSS

POC to protect VSS copies by terminating vssadmin delete shadows command and killing the initiating parent process

 

[MacDefender]

I assume a script or executable trying to use vssadmin will set off most dynamic behavior blockers, right? Might be time to whip up a test....

 

[Minimalist]

Do legit apps (like Imaging software) use this technique to delete shadow copies once not needed any more? If yes, then FPs could be expected from this tool.

 

[MacDefender]

Do legit apps (like Imaging software) use this technique to delete shadow copies once not needed any more? If yes, then FPs could be expected from this tool.

Acronis definitely does this by default.

 

[struppigel]

Do legit apps (like Imaging software) use this technique to delete shadow copies once not needed any more? If yes, then FPs could be expected from this tool.

Out of my experience from writing AV signatures: If shadow volume deletion is the only thing you check for, FPs are almost certain. You always need some context to it to determine that it is ransomware.

 

[MacDefender]

Out of my experience from writing AV signatures: If shadow volume deletion is the only thing you check for, FPs are almost certain. You always need some context to it to determine that it is ransomware.

Yeah I think trying to do this statically is going to be a nightmare. This is a good candidate for a dynamic detection combined with a cloud reputation (whitelist) lookup.

 

[show-Zi]

I found out about this software on Softpedia yesterday.

Download ShadowGuard

Download ShadowGuard 1.0.1 - A simple software utility that can block unauthorized attempts to erase File Shadow Copies of files on your computer, which is usually done by ransomware

www.softpedia.com

 

[cruelsister]

As Andy F. notes above this thingy won't do anything to prevent malware which act more elegantly by the use of Windows Management Instrumentation from killing shadow copies (and a Fun Fact- things like ESET and Avast are equally oblivious).

 

[upnorth]

Release Raccine 0.9.0 · Neo23x0/Raccine

Logging to Windows Eventlog by @JohnLaTwC Sigma rule

github.com

 

[ForgottenSeer 89360]

Out of my experience from writing AV signatures: If shadow volume deletion is the only thing you check for, FPs are almost certain. You always need some context to it to determine that it is ransomware.

I can say the same from my experience, basing your detection on one single criteria is you, begging for trouble

 

[Nader]

Here is a similar PoC program that just didn't get the same media attention: nshalabi/ProtectVSS

Thanks
I am working on another PoC at the moment

 

[ichito]

I found out about this software on Softpedia yesterday.

Download ShadowGuard

Download ShadowGuard 1.0.1 - A simple software utility that can block unauthorized attempts to erase File Shadow Copies of files on your computer, which is usually done by ransomware

www.softpedia.com

Do you remember CryptoPrevent? It's already abandoned but still to get here (portable)
Download CryptoPrevent - MajorGeeks
ShadowGuard is developed by the same person

CryptoPrevent, ShadowExplorer, and VSSADMIN

ShadowExplorer (www.shadowexplorer.com) is an awesome application which I’ve used as a PC Technician many times in the past. It is used to provide a graphical ‘front-end’ interfa…

www.d7xtech.com

New App: ShadowGuard

ShadowGuard is a new app designed to detect when malware or ransomware is attempting to delete File Shadow Copies and take action. Typically ransomware will attempt to delete Shadow Copies of your…

www.d7xtech.com

ShadowGuard

Compatibility: Windows 10. Although officially unsupported, it will work on older versions of Windows back to Windows XP. ShadowGuard is also compatible for use with either CryptoPrevent or Lockdo…

www.d7xtech.com