Új hozzászólás Aktív témák

• #63585 ƵøŁĭ veterán

  Új Válasz 2020-01-28 19:41:29 #63585

  Új hozzászólás

  Összes hozzászólása itt Válaszok az összes hozzászólására itt Válaszok erre a hozzászólásra

  Privát üzenet küldése

  

  ƵøŁĭ

  veterán

  A new ransomware called Ragnarok has been detected being used in targeted attacks against unpatched Citrix ADC servers vulnerable to the CVE-2019-19781 exploit.

  

  Attempts to disable Windows Defender
  As Microsoft's Windows Defender has become a solid and reliable antivirus and security program, we are finding that numerous malware programs are attempting to disable or bypass it to more easily conduct malicious operations.
  For example, we have seen GootKit, TrickBot, and the Novter infections all utilizing some sort of Windows Defender bypass.
  It is rare, though, to see ransomware infections themselves attempt to disable the functionality of Windows Defender, which is what Ragnarok attempts.
  It does this by adding the following Windows group policies that disable various protection options in Windows Defender:

  HKLM\SOFTWARE\Policies\Microsoft\Windows Defender "DisableAntiSpyware" = 1
  HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection "DisableRealtimeMonitoring" = 1
  HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection "DisableBehaviorMonitoring" = 1
  HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection "DisableOnAccessProtection" = 1

  The good news is that if you have Windows 10's Tamper Protection feature enabled, these methods will not work and Windows will simply ignore any attempts to bypass Windows Defender.

  In addition to Windows Defender, Ragnarok will also attempt to clear Shadow Volume Copies, disable Windows automatic startup repair, and turn off the Windows Firewall with the following commands:

  cmd.exe /c vssadmin delete shadows /all /quiet
  cmd.exe /c bcdedit /set {current} bootstatuspolicy ignoreallfailures
  cmd.exe /c bcdedit /set {current} recoveryenabled no
  cmd.exe /c netsh advfirewall set allprofiles state off

  (ง'̀-'́)ง(ง'̀-'́)ง

Új hozzászólás Aktív témák