App Review Microsoft Defender vs Magniber

[cruelsister]

Content source

https://www.youtube.com/watch?v=JmkmywJoFDQ

Once More unto the Breach...

 

[upnorth]

720p for the next video?

 

[eonline]

Wonderful music, the video shows that WD is not efficient with this Malware variant which leaves me concerned because it is my current setup. It even bypassed the WD protected folders. Thank you very much for sharing.

 

[Shadowra]

Good job Meghan ! (followed + liked)

I suspected that Magniber would also pass the Microsoft Defender anti-ransomware shield, even in hardened...
This Ransomware is quite violent, I've already managed to bypass the anti-ransomware protection of Bitdefender and F-Secure....

Hopefully the editors will wake up soon! (Kaspersky & ESET have done some detections in Hexa)

 

[cruelsister]

720p for the next video?

I had to use all new video recording and editing thingies as I lost all my licenses for the apps I used previously, so it was a bit of a learning curve (and I agree that I still have some learning to do).

 

[wat0114]

Excellent video, thanks. It would be interesting to know what process(es) in the infection chain ultimately did the encryption damage, especially when there were two visible alerts generated by Defender. Did Defender actually block those two attempts or did one or both of them blow right through it, or was it something else that Defender failed to block?

 

[motox781]

Thanks for the time and energy you put into this!

With that said, it seems as if you are using Windows 7 (maybe it's not). If so, why not test with an updated copy of either Windows 10 or 11?

 

[Kiss]

With this quality you don't even need to post, in full 2022 at 480p?

 

[Trooper]

Good job Meghan ! (followed + liked)

I suspected that Magniber would also pass the Microsoft Defender anti-ransomware shield, even in hardened...
This Ransomware is quite violent, I've already managed to bypass the anti-ransomware protection of Bitdefender and F-Secure....

Hopefully the editors will wake up soon! (Kaspersky & ESET have done some detections in Hexa)

Are Kaspersky and ESET the only two av companies that provide detection for this threat?

 

[Kiss]

GDATA is one of the few that can stop Magniber

 

[Shadowra]

Are Kaspersky and ESET the only two av companies that provide detection for this threat?

These are the ones I see regularly in detection

 

[Shadowra]

GDATA is one of the few that can stop Magniber

During a test on one of my VMs, GDATA reacted well with the anti-ransomware shield, but the files were encrypted...
No reaction from BEAST or DeepRay

 

[harlan4096]

Are Kaspersky and ESET the only two av companies that provide detection for this threat?

WiseVector SX also...

 

[cruelsister]

why not test with an updated copy of either Windows 10 or 11?

This was done on a Windows 11 21H2 system with StartAllBack enabled (as I prefer the W10 style).

 

[Andy Ful]

Hit and sunk filelessly.

The Enterprises can be impacted via exploit kits (like Magnitude) used to compromise the network and deliver the Magniber.

The home users can be impacted when using pirated software or instructed on shady forums to install the update from an unsafe source.

The transmission method is still various forums, cracked software websites, fake pornographic websites, etc. When users visit these websites, they are induced to download from third-party network disks.

Win11 users beware! Magniber ransomware has been upgraded again, aiming at win11 | 360 Total Security Blog

At the end of April this year, the Magniber ransomware disguised as a Windows 10 upgrade patch package and spread widely, and 360 Security Center...

blog.360totalsecurity.com

 

[Andy Ful]

Excellent video, thanks. It would be interesting to know what process(es) in the infection chain ultimately did the encryption damage, especially when there were two visible alerts generated by Defender. Did Defender actually block those two attempts or did one or both of them blow right through it, or was it something else that Defender failed to block?

These two blocks were related to disk sectors, they did not block the modifications into the folders.
I think that the files can be restored via OneDrive synchronization (suggested by Microsoft).
There are two interesting questions:

1. Did the malware get high privileges?
2. Did the malware delete volume shadow copies?

 

[Andy Ful]

Although any video with working ransomware can be kinda shocking, the truth is that there is no need to worry. The method used by Magniber (MSI file) is very rarely used against home users.

Furthermore, for any AV one can find working malware. There is no perfect & usable protection against malware. Even such a strong protection like CF with @cruelsister settings cannot save many users. Of course, the installer/fix will be blocked, but this is expected for pirated software, game mods, or cracks. The blocked malware cannot expose the malicious actions, so the user will simply turn off the protection and still can be infected.

Microsoft can efficiently (but not perfectly) fight such malware in several ways:

1. Making the samples very short-living (Block At First Sight + post-execution detections). Even if the sample could infect a few users, then after several minutes other users can be often protected against this sample.
2. Adding the methods used by ransomware to ASR rules.
3. Blocking delivery paths, when the malicious actors would like to use the malware in widespread attacks (weaponized documents, scripts, etc.).
4. Adding the malicious URLs to SmartScreen (used also system-wide by Defender's Network Protection).

So, we will see the normal cat & mouse game. When Microsoft (or any other AV) is going to improve the protection, the Magniber fellows will make necessary modifications, and so on.

 

[Kongo]

Thanks for the time and energy you put into this!

With that said, it seems as if you are using Windows 7 (maybe it's not). If so, why not test with an updated copy of either Windows 10 or 11?

It's Windows 11 with a Windows 7 skin.

 

[wat0114]

1. Did the malware get high privileges?

Good question. I didn't see any UAC alerts, but even if enabled and on Always Notify, could this malware bypass it somehow?

EDIT

I guess anyone downloading pirated software or "updates" from sketchy sites would happily elevate the prompts anyway

 

[Anthony Qian]

Good job Meghan ! (followed + liked)

I suspected that Magniber would also pass the Microsoft Defender anti-ransomware shield, even in hardened...
This Ransomware is quite violent, I've already managed to bypass the anti-ransomware protection of Bitdefender and F-Secure....

Hopefully the editors will wake up soon! (Kaspersky & ESET have done some detections in Hexa)

A tester has already tested Magniber vs Microsoft Defender configured to Max Protection, and files were still encrypted.