Tags

Signatures

• UAC bypass

  Tags

  evasiontrojan

  TTPs

  Bypass User Account ControlDisabling Security ToolsModify Registry

• Blocklisted process makes network request

• Disables cmd.exe use via registry modification

  Tags

  evasion

• Modifies Installed Components in the registry

  Tags

  persistence

  TTPs

  Registry Run Keys / Startup FolderModify Registry

• Possible privilege escalation attempt

  Tags

  exploit

• Sets file execution options in registry

  Tags

  persistence

  TTPs

  Registry Run Keys / Startup FolderModify Registry

• Checks computer location settings

  Description

  Looks up country code configured in the registry, likely geofence.

  TTPs

  Query RegistrySystem Information Discovery

• Modifies file permissions

  Tags

  discovery

  TTPs

  File Permissions Modification

• Adds Run key to start application

  Tags

  persistence

  TTPs

  Registry Run Keys / Startup FolderModify Registry

• Checks whether UAC is enabled

  Tags

  evasiontrojan

  TTPs

  System Information Discovery

• Enumerates connected drives

  Description

  Attempts to read the root path of hard drives other than the default C: drive.

  TTPs

  Query RegistryPeripheral Device DiscoverySystem Information Discovery

• Sets desktop wallpaper using registry

  Tags

  ransomware

  TTPs

  DefacementModify Registry

Related Tasks