App Review Windows Defender vs GandCrab Ransomware: video review

It is advised to take all reviews with a grain of salt. In extreme cases some reviews use dramatization for entertainment purposes.
RoboMan

RoboMan

Level 38
Thread author
Verified
Honorary Member
Top Poster
Content Creator
Well-known
High Reputation
Forum Veteran
Jun 24, 2016
2,608
24,580
3,600
Hidden Village of Hispanic America
Content source
https://youtu.be/-sygS9-7-s0
During today's test for the Hub (which I will be posting later tonight, PS thanks @silversurfer!) I found this specific piece of malware that I loved, because of what it did. So I recorded a quick review for you to see.

Who will win? The whole Microsoft Security Team or... this little boy?



Note: please do not ask for the sample, straight rules won't allow sharing links or samples from the Hub.
 
  • Like
Reactions: kyokodash, AriDfoix, Gandalf_The_Grey and 29 others
As soon as I saw wscript, I knew we had been infected by incurable plague.

I'm sorry but leaving interpreters enabled by default is a retarded protection model. Seriously.

There will be those that argue that interpreters are neither good nor bad.

I can make that kind of idiotic statement too..

"A gun lying on the street isn't good or bad either. It's just an object."

What's more effective and common sense for the vast majority of users of Windows - who don't use any interpreters - disable them by default or keep them enabled because "a lot of IT Pros use them" ? Seriously ? You're gonna make that kind of an argument ? So sink 7/8ths of humanity for the few - because it would be inconvenient for some IT pros to enable interpreters.

Windows security. And the people who control it. 8-Ball Chasers. Pathetic.
 
  • Like
Reactions: brambedkar59, AriDfoix, DeepWeb and 6 others
Superb video!!!

1). Short and to the point- you made a short video look easy to produce, and I know it was probably anything but.
2). Humor! Yeah!
3). Shows that in spite of the results seen on the Pro AV testing sites (where malware relics, D+3 and above, are used), WD is inadequate against newer samples. And I can assure you a Blackhat is NEVER going to push out older malware.

Well done!
 
  • Like
Reactions: brambedkar59, AriDfoix, Gandalf_The_Grey and 12 others
About interpreters - totally agree. Those very few who really need to use it, will know how to turn it on. The huge amount of the rest which doesn't know how to use and nor they will, will not know how the hell to turn it off. Should be off by default.

And @cruelsister your comment emotioned me the most! Coming from you, the person which tests and knowledge I admire the most over here, it's a pleasure :) Thank you!
 
  • Like
Reactions: brambedkar59, Gandalf_The_Grey, Burrito and 6 others
Vendula Kubová said:
The script interpreters are cancerous. They should have never been given so much freedom. I don't understand why Microsoft designed monsters like PowerShell, Office Macro's, and VB Script the way they did.
Click to expand...

Because the Microsoft and the IT Pro admin retards got together. That's all it took. The rest is history.

Microsoft decided to disable cmd and powershell on 10 S - because it would annoy the fewest IT Pros.

Are the IT Pros gonna come to your house and disinfect your system ? I think they should. You have default Windows designed for them - and not to protect the people who need the greatest amount of protection. It is partly because Microsoft caters Windows to "IT Pros" that everyone else is placed at high risk.

Disgusting.
 
  • Like
Reactions: brambedkar59, AriDfoix, In2an3_PpG and 3 others
As expected, WD lacks behaviour blocker, relying on Default-Deny, Cloud and Backups to stop most threats. Is also funny how easy it is to tamper with WD, to make all the options above irrelevant.

For us should be fine, but for Casual Users I won't be recommending WD any time soon.

Make another video, but with Kaspersky Free :emoji_thinking:
 
Last edited:
  • Like
Reactions: oldschool, Weebarra, harlan4096 and 1 other person
Great vid. I don't watch many, but I watched this one.
Am I right in assuming that Windows Defender was at default settings?
WD @default definitely needs SmartScreen as its first line of defense, or else it gets clobbered by zeroday samples.
But what happens if you enable some ASR rules?
 
  • Like
Reactions: Gandalf_The_Grey, oldschool, stefanos and 7 others
Last edited:
  • Like
Reactions: brambedkar59, Gandalf_The_Grey, oldschool and 12 others
harlan4096 said:
I ran the dynamic test with KFA2019c + that sample yesterday about 30min after the pack was posted.

KFA2019 didn't detect the original script sample, but did (by signature) the dropped file:

https://malwaretips.com/threads/8-10-2018-22.87258/post-769739
Click to expand...
Sorry for the off topic but according to your experience Kaspersy Free can replace the paid version by ensuring a good protection level? I read it is really good in detection.
Thanks Harlan :)
 
  • Like
Reactions: brambedkar59, oldschool, RoboMan and 4 others
harlan4096 said:
KFA2019 does not have Application Control + FireWall... so probably a combo with NVT OSA, or SysHardened... or the so known combo CFW + CS's settings...
Click to expand...
Thaks again.
I have another PC that my son uses just for fun (and yes sometimes he is an happy clicker) with just SB and WD.
So I'm planning to install KFA and make a good scan :)
 
  • Like
Reactions: brambedkar59, oldschool, vtqhtr413 and 5 others
Hi Guys i have one question about WD and some windows settings.
If I want to using a Windows Defender and Edge and I turn off script execution by command in PowerShell 5.0 and uninstal PowerShell 2.0, turn off SMB protocol and flash player in Edge and windows it will be good?
Maybe someone want tu test this security config windows 10?
 
  • Like
Reactions: oldschool, vtqhtr413, RoboMan and 1 other person
Just finished the test with this sample and Panda Dome Premium + ForgottenSeer 58943's settings + NVT OSA, I ran 2 different scenarios:

PDP + PD Application Control On + NVT OSA On -> attack blocked by NVT OSA. System Protected.

PDP + PD Application Control On + NVT OSA Off -> attack blocked by PD Application Control, but also detected/deleted as Trojan. System Protected.

Full results of the sample pack at MalWare Hub later...
 
  • Like
Reactions: brambedkar59, BigWrench, oldschool and 7 others
KonradPL said:
Hi Guys i have one question about WD and some windows settings.
If I want to using a Windows Defender and Edge and I turn off script execution by command in PowerShell 5.0 and uninstal PowerShell 2.0, turn off SMB protocol and flash player in Edge and windows it will be good?
Maybe someone want tu test this security config windows 10?
Click to expand...

Disable PowerShell, PowerShell_ISE, wscript.exe, and cscript.exe is better.

Disable PowerShell v2.0 is good; it prevents many attacks.

Setting restricted execution policy in PowerShell v5.0 is easily bypassed; set Constrained Language mode.

You really should use a SUA.
 
  • Like
Reactions: brambedkar59, AriDfoix, Deleted member 178 and 4 others
KonradPL said:
Hi Guys i have one question about WD and some windows settings.
If I want to using a Windows Defender and Edge and I turn off script execution by command in PowerShell 5.0 and uninstal PowerShell 2.0, turn off SMB protocol and flash player in Edge and windows it will be good?
Maybe someone want tu test this security config windows 10?
Click to expand...
I didn't understand what you meant by "turn off script execution by command in PowerShell". How are you turning it off?

Generally speaking, Edge is a secure browser, and Windows Defender at default settings is enough baseline protection for a careful user. But you are obviously trying for a higher level of protection. If so, disabling Powershell is good, but not enough. You should also disable Wscript, and there are other vulnerable processes, too. If you want to tweak your OS, use SysHardener. It's a free tool from NoVirusThanks.

I just saw that Lockdown answered you. Take his advice.
 
  • Like
Reactions: oldschool, vtqhtr413, RoboMan and 3 others

You may also like...