Detect Neshta payload

Modifies system executable filetype association

Neshta

Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

Phobos

Phobos ransomware appeared at the beginning of 2019.

Suspicious use of NtCreateUserProcessOtherParentProcess

Deletes shadow copies

Ransomware often targets backup files to inhibit system recovery.

Modifies boot configuration data using bcdedit

Deletes backup catalog

Uses wbadmin.exe to inhibit system recovery.

Executes dropped EXE

Modifies Windows Firewall

Modifies extensions of user files

Ransomware generally changes the extension on encrypted files.