Reply to thread

Message

<blockquote data-quote="vitao" data-source="post: 1111074" data-attributes="member: 109212">on my testings it seems containment continues to just ignore but there is something new: the dll (the ransom itself) shows at unrecognized list but not blocked not prompted for user decision, so it seems its the containment being evaded here, right? or am i getting it wrong?ive already recorded the video with the test but i need to record the part with my talkings. ill try to do it by the weekend.edit.: one thing that needs to be noted here. the dll is the ransomware itself and windwos defender block it by recognizing it as malicious but comodo antivirus just plays the dumb and ignores it. even kingsoft can recognize it as malware but cis... funny right?edit2: the video testing it will have 2 parts. one showing the new cis with its default config. in the second one cis is with cruelsister config tweaked by me and with the part that loyisa said that had to be changed, the script analys that i checked every damn option there.in both scenarios cis is r@ped by the poc in its v3. in both scenarios uac is turned off by windows settings (not by regedit, so its not fully off as many knows). i tried with uac on and the result was the same but as it was a short attempts it is not on the full video recorded before <img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite115" alt=":p" title="Stick out tongue&nbsp; &nbsp; :p" loading="lazy" data-shortname=":p" /></blockquote>

[QUOTE="vitao, post: 1111074, member: 109212"] on my testings it seems containment continues to just ignore but there is something new: the dll (the ransom itself) shows at unrecognized list but not blocked not prompted for user decision, so it seems its the containment being evaded here, right? or am i getting it wrong? ive already recorded the video with the test but i need to record the part with my talkings. ill try to do it by the weekend. edit.: one thing that needs to be noted here. the dll is the ransomware itself and windwos defender block it by recognizing it as malicious but comodo antivirus just plays the dumb and ignores it. even kingsoft can recognize it as malware but cis... funny right? edit2: the video testing it will have 2 parts. one showing the new cis with its default config. in the second one cis is with cruelsister config tweaked by me and with the part that loyisa said that had to be changed, the script analys that i checked every damn option there. in both scenarios cis is r@ped by the poc in its v3. in both scenarios uac is turned off by windows settings (not by regedit, so its not fully off as many knows). i tried with uac on and the result was the same but as it was a short attempts it is not on the full video recorded before :P [/QUOTE]

Verification