Locked Mock Ransomware

[dEEpEst]

"# mock-ransomware"

1. Release\ransomware.exe
2. Go to test folder, notice the permission changes, change them back to see the encrypted text
3. Delete copied malware inside of \\Users\\<name>\\ransomwaredirectory
4. open up regedit to also delete persistent keys

• reg DELETE HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v ransomware_pwn /f The operation completed successfully.
• reg QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Run
  • to verify

5. To view the driver installed

C:\> sc query MyCustomBeep

SERVICE_NAME: MyCustomBeep
        TYPE               : 1  KERNEL_DRIVER
        STATE              : 1  STOPPED
        WIN32_EXIT_CODE    : 1077  (0x435)
        SERVICE_EXIT_CODE  : 0  (0x0)
        CHECKPOINT         : 0x0
        WAIT_HINT          : 

 

This is the hidden content, please

• Sign In
• or
• Sign Up