Reply to thread

Message

<blockquote data-quote="harlan4096" data-source="post: 836724" data-attributes="member: 36043">Last special sample (MegaCortex Ransomware) just posted by [USER=32430]@Der.Reisende[/USER] yesterday:[ATTACH]225838[/ATTACH]
I performed a quick test and the results (WV set in Auto Quarantine):[ATTACH]225839[/ATTACH][ATTACH]225841[/ATTACH]

[ATTACH]225840[/ATTACH][ATTACH]225842[/ATTACH]WV detected/deleted several dropped/spawned exe files in C:\Windows\Temp\ but 903 files were encrypted in different system folders... BUT Users Documents and WV bait folders (inside Documents folder) were protected , files in my bait folder placed in drive root folder (outside User Space) were encrypted also:[ATTACH]225843[/ATTACH][ATTACH]225844[/ATTACH]
The malware remained running (but in Access Denied status) on system still trying to encrypt probably other systems folders, it did not set any registry in Windows AutoRuns sections, I rebooted and the malware did not run any more...The sample is already detected on demand/upon extraction:[ATTACH]225845[/ATTACH]</blockquote>

[QUOTE="harlan4096, post: 836724, member: 36043"] Last special sample (MegaCortex Ransomware) just posted by [USER=32430]@Der.Reisende[/USER] yesterday: [CENTER][ATTACH alt="WV.png"]225838[/ATTACH] [/CENTER] I performed a quick test and the results (WV set in Auto Quarantine): [CENTER][ATTACH alt="WV1.png"]225839[/ATTACH][ATTACH alt="WV3.png"]225841[/ATTACH] [ATTACH alt="WV2.png"]225840[/ATTACH][ATTACH alt="WV4.png"]225842[/ATTACH][/CENTER] WV detected/deleted several dropped/spawned exe files in C:\Windows\Temp\ [B]but 903 files were encrypted in different system folders[/B]... [B]BUT[/B] [B]Users Documents and WV bait folders (inside Documents folder) were protected [/B], files in my bait folder placed in drive root folder (outside User Space) were encrypted also: [CENTER][B][ATTACH alt="WV5.png"]225843[/ATTACH][ATTACH alt="WV6.png"]225844[/ATTACH][/B] [/CENTER] The malware remained running ([B]but in Access Denied status[/B]) on system still trying to encrypt probably other systems folders, it did not set any registry in Windows AutoRuns sections, I rebooted and the malware did not run any more... The sample is already detected on demand/upon extraction: [CENTER][ATTACH]225845[/ATTACH][/CENTER] [/QUOTE]

Verification