Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 8 replies
  • Subscribers 13 subscribers
  • Views 18349 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Wannacry - Intercept X Standalone - Windows 10

StevenOsterwald

Hello,

I installed the following VM (VmWare WOrkstation 12) today:

 

- Windows 10 x64 Pro 1703

- Intercept X Standalone

- Windows Defender disabled

- Firewall Windows active (no additional rules)

 

I then created a few textfiles in C:\Users\user\Documents\ and started wannacry. https://www.virustotal.com/en/file/ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa/analysis/1499255455/

The ransomware went trough without any propblem and encrypted the files. Now I wonder if I did something wrong (I hope so!) or if Interceptor is useless at this point.

If more info is needed please let me know.

 

Greetings



This thread was automatically locked due to age.
Parents
  • 0

    At first glance it does not look like Intercept X correctly installed as it should have been listed as "Installed" in the top right screenshot.

     

     

    If you click the Run diagnostic tool button you should see the endpoint self help tool. Check to confirm that in the installed components section you see HitmanPro Alert as installed. If this is missing I suspect it's failing to download 100% from sophos and onsite web filtering would be the culprit!

  • 0 in reply to TheChaves

    THank you TheChaves for your answer,

     

    I restarted the VM and updated Sophos Intercept, let it run the Diagnostic Tool and restarted the VM and then ran Wannacry.

    Unfortunately nothing changed.

  • 0 in reply to StevenOsterwald

    Is the only data you placed on to the VM .txt files only? This may not be enough for Intercept to detect so I encourage you to test again with a mixture of file types that would be attacked in a real world scenario...copy some images, rtf files, office documents, pdf's, etc...

     

    Then test again.

Reply
  • 0 in reply to StevenOsterwald

    Is the only data you placed on to the VM .txt files only? This may not be enough for Intercept to detect so I encourage you to test again with a mixture of file types that would be attacked in a real world scenario...copy some images, rtf files, office documents, pdf's, etc...

     

    Then test again.

Children
Unfiltered HTML