Malware simulation

It all comes down to context and actions. How did you do the encryption? A Powershell script that calls on Windows to encrypt the file?

I used the .Net AesCryptoServiceProvider in PowerShell and ran it against a directory of files, renaming them as it went. Seemed to trigger Sophos after certain number of files were encrypted. I forgot what the threshold was, it has been a while.

what you describe is what I would expect to happen. CG doesn't trigger instantly - it monitors an has a context dependent rule set that will trigger when the the thresholds/criteria are met.

I did use AesCryptoServiceProvider  as well against more than 50k files, renaming them to .encrypted after encrypting them. I also ran test where I encrypt/decrypt them multiple times etc. but all without any luck. After that I created a .NET executable (.exe) to try if that makes a difference, but it didn't.

Can you tell more about the files you encrypted? (file size, age) that might be different. Also, did you test recently, or was that some time ago? Thanks for the responses so far!

I did use AesCryptoServiceProvider  as well against more than 50k files, renaming them to .encrypted after encrypting them. I also ran test where I encrypt/decrypt them multiple times etc. but all without any luck. After that I created a .NET executable (.exe) to try if that makes a difference, but it didn't.

Can you tell more about the files you encrypted? (file size, age) that might be different. Also, did you test recently, or was that some time ago? Thanks for the responses so far!

It looks like I tested this the beginning of 2020.

Ill run it again and see what happens.

Please, let me know the results.

So, I took a bunch of files (copied the "Program Files (x86)" dir) and ran this against it. https://gist.github.com/arnydo/a0c41325e579b7dae3c8abd1a6b13980

Triggered CryptoGuard.

Kyle Parrish said:

(copied the "Program Files (x86)" dir)

Thanks Kyle.. I think this is the only noteworthy difference between your attempt and mine. I created dummy text files (created by another proces to make it less obvious).

If I remember correctly, when I ran this test last year I had created dummy files as well, but made sure to include many different file/mime types. This triggered it as well. 

Good to know. That I didn't do. Thanks.

You can run this too www.knowbe4.com/ransomware-simulator