Skip to content
This repository was archived by the owner on Apr 26, 2021. It is now read-only.

Conversation

@cccs-kevin
Copy link

Thanks for contributing! But first: did you read our community guidelines?
https://cuckoo.sh/docs/introduction/community.html

What I have added/changed is:

Auxiliary module that elevates permissions for certain directories and all files/sub-directories such that only SYSTEM has write access.

The goal of my change is:

When dealing with certain ransomware samples, such as d9c3e675971499e4a2c0677b5ae96cd5582900e7cbfc16a00555ec90335aaebf, they arbitrarily encrypt all files in all directories located at C:\\. This is where the Python interpreter and the injected directory used for analysis are located, and thus they get encrypted and the connection required for analysis breaks. If we elevate the permissions required to write to these directories to exclude Administrators and lower, then this connection prevails and we are able to get the full analysis of this sample.

What I have tested about my change is:

General functionality via manual testing.

@cccs-kevin cccs-kevin changed the title Permissions Elevate Permissions to avoid Ransomeware Crashes Nov 16, 2020
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant