Windows Defender vs Top 200 Ransomware

Summary

In this video, the host tests Windows Defender's ability to stop ransomware attacks using a set of 200 recent ransomware variants. Despite Defender's strong initial performance, the ransomware eventually breaks through, encrypting some files. The host analyzes the ransomware's behavior, noting its slow, persistent encryption process and how Windows Defender struggles with newer, targeted threats. After further investigation, the malware is identified as a potential new ransomware variant, highlighting the challenges of defending against cutting-edge threats. The video emphasizes the importance of staying vigilant and informed about the limitations of antivirus tools like Defender.

Takeaways

• 😀 The video tests Windows Defender's ability to stop ransomware by executing 200 recent variants on a live, fully updated Windows system.
• 🧪 The test is an annual tradition on the channel and is designed to check real-world detection and execution, not just signatures.
• 💻 A live feed was used to monitor process launches, blocks, and any encryption activity in real time.
• 🔒 Windows Defender blocked many samples initially, but several ransomware variants still got through and executed.
• ⚠️ One sample began renaming files with the unusual extension ".mlbo", indicating a likely new or low-visibility ransomware strain.
• 📉 Some user files were successfully encrypted despite Defender catching many threats earlier in the run.
• ♻️ The malware showed advanced tactics—deleting shadow copies, persistence via startup shortcuts, UAC bypasses, and hidden token manipulation.
• 🔍 The creator used ID Ransomware and VMRay sandbox analysis to identify behavior, but ID Ransomware couldn’t always identify the strain.
• 🖼️ The ransomware also performed defacement (changed desktop wallpaper) and caused unexpected reboots, indicating additional malicious capabilities.
• 🌐 Defender performs well against older or known threats (cloud detections), but brand-new or targeted ransomware can evade detection.
• 🧰 Some executed files contained legitimate installers or trojanized installers, complicating detection and analysis.
• 📌 The creator emphasizes that new samples submitted recently are less likely to be detected and that layered defenses matter.
• 🗣️ Viewers are encouraged to examine sample behavior, use tools like ID Ransomware/VMRay, and share thoughts in the comments.
• ✅ Overall conclusion: Defender did a decent job initially, but this test shows it can be bypassed by new/risky ransomware—so vigilance and multiple defenses are essential.

Q & A

What is the main purpose of the video?

The video tests Windows Defender's ability to stop ransomware by executing the top 200 ransomware variants on a fully updated Windows system to see if the system's data gets encrypted.

What type of ransomware was used in the test?

The video does not specify one single type of ransomware but uses a variety of the latest ransomware variants, including one with a file extension 'mlbo' which appears to be a new variant.

What role does the live feed play in the test?

The live feed provides a real-time view of which ransomware variants are being blocked or missed by Windows Defender, allowing the viewer to track the process of the test and see when something gets executed.

What happens when Windows Defender misses a ransomware detection?

If Windows Defender misses a detection, the ransomware can execute and potentially start encrypting files. This is what happens with the 'mlbo' ransomware, which manages to start encrypting files despite Defender’s initial protections.

What was the significance of the 'mlbo' extension?

The 'mlbo' extension is linked to a ransomware variant that was able to bypass Windows Defender's detection, resulting in partial encryption of files on the system. It appears to be a relatively new or less-known ransomware.

What does the test suggest about Windows Defender’s effectiveness?

The test suggests that while Windows Defender performs well at blocking older or more common ransomware, it struggles against newer, targeted malware that has not been widely detected or reported yet.

How did the system respond after the ransomware started encrypting files?

After the ransomware started encrypting files, the system displayed several alerts and prompts, including some related to a Trojan and other processes, and eventually restarted. The system was not entirely compromised, but data encryption did occur.

What does the analysis of the 'mlbo' ransomware show?

The analysis reveals that the 'mlbo' ransomware uses several malicious techniques, including deleting shadow copies, executing hidden processes, bypassing UAC (User Account Control), and making network connections. It also modifies the desktop background, which is typical of defacement actions in ransomware.

What challenges did the test face in detecting the ransomware?

One major challenge was that the ransomware used in the test, especially the 'mlbo' variant, was not well-known and was not detected by traditional malware databases. This highlights the difficulty in protecting against new and targeted threats.

What tools were used to analyze the ransomware further after the test?

After the test, the ransomware was analyzed in the VMRay sandbox, where it was found to create numerous child processes and engage in malicious activities, such as network connections and system process manipulation, which were not observed during the initial test.