Microsoft scrambled to patch a critical Windows flaw following a British intelligence organization discovering and disclosing the exploit to the company. The flaw in question, CVE-2017-11937, was uncovered by the UK's National Cyber Security Centre (NCSC), which is a part of the Government Communications Headquarters (GCHQ) intelligence agency.
To utilize CVE-2017-11937, an attacker must specially craft a malicious packet that will be scanned by default. For this to happen, the packet must be sent to a location that Windows security products scan automatically (such as email, hosting servers, and a website). Since the scan is automatic, the packet can execute its remote code before the system has any time to react, thus giving a hacker full access to the machine.
The program uses Powershell, by default Powershell is has the execution policy "restricted", this ransomware by-pass this policy?
It would be possible to stop this attack by creating a "Spider" folder inside %appdata% with readonly permissions, so the program wouldn't have access to download the payload and execute?
Hey I appreciate the question. As a general rule, I don't ever advise someone to try and perform a workaround for malware when there are already official solutions (i.e. the ones outlined in the article).
Your question DID however intrigue me. I asked some individuals who are far more experienced in the nuances of Powershell than I, and they all responded with uniformity that your proposed solution would create issues with all applications on your machine.