Skip to content
This repository has been archived by the owner on Apr 26, 2021. It is now read-only.

Elevate Permissions to avoid Ransomeware Crashes #3136

Open
wants to merge 5 commits into
base: master
Choose a base branch
from

Conversation

cccs-kevin
Copy link

Thanks for contributing! But first: did you read our community guidelines?
https://cuckoo.sh/docs/introduction/community.html

What I have added/changed is:

Auxiliary module that elevates permissions for certain directories and all files/sub-directories such that only SYSTEM has write access.

The goal of my change is:

When dealing with certain ransomware samples, such as d9c3e675971499e4a2c0677b5ae96cd5582900e7cbfc16a00555ec90335aaebf, they arbitrarily encrypt all files in all directories located at C:\\. This is where the Python interpreter and the injected directory used for analysis are located, and thus they get encrypted and the connection required for analysis breaks. If we elevate the permissions required to write to these directories to exclude Administrators and lower, then this connection prevails and we are able to get the full analysis of this sample.

What I have tested about my change is:

General functionality via manual testing.

@cccs-kevin cccs-kevin changed the title Permissions Elevate Permissions to avoid Ransomeware Crashes Nov 16, 2020
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant