Reply to thread

Message

<blockquote data-quote="cruelsister" data-source="post: 995964" data-attributes="member: 7463">Hi Wat! Indeed the malware requested beaucoup elevations, including for TCB (Trusted Computer Base) which pretty much opens the system to all sorts of potential nastiness. Also as is getting typical of ransomware, SeBackupPrivilege (to allow file Reads) and SeRestorePrivilege which will grant write access can be seen. By the way, UAC at the maximum level does not peep at all, including on initial run (should have included this tidbit in the video but it slipped my mind as I hate UAC!).Also a fun fact- see the Windows Installer box that pops up on running the file? That is actually pretty much a fake as another copy is spawned elsewhere in the system that actually runs. So clicking Cancel for that Installer box just will kill the Fake while the actual malware is happily trashing the system.I also would have gotten rid of CF i I had to use those settings! The hardest thing to understand about CF is that Simple is Best, and that is almost counter-intuitive in the Security field.</blockquote>

[QUOTE="cruelsister, post: 995964, member: 7463"] Hi Wat! Indeed the malware requested beaucoup elevations, including for TCB (Trusted Computer Base) which pretty much opens the system to all sorts of potential nastiness. Also as is getting typical of ransomware, SeBackupPrivilege (to allow file Reads) and SeRestorePrivilege which will grant write access can be seen. By the way, UAC at the maximum level does not peep at all, including on initial run (should have included this tidbit in the video but it slipped my mind as I hate UAC!). Also a fun fact- see the Windows Installer box that pops up on running the file? That is actually pretty much a fake as another copy is spawned elsewhere in the system that actually runs. So clicking Cancel for that Installer box just will kill the Fake while the actual malware is happily trashing the system. I also would have gotten rid of CF i I had to use those settings! The hardest thing to understand about CF is that Simple is Best, and that is almost counter-intuitive in the Security field. [/QUOTE]

Verification