Detect Neshta payload

Neshta

Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

Phobos

Phobos ransomware appeared at the beginning of 2019.

Deletes shadow copies

Ransomware often targets backup files to inhibit system recovery.

Modifies boot configuration data using bcdedit

Renames multiple (369) files with added filename extension

This suggests ransomware activity of encrypting all the files on the system.

Deletes backup catalog

Uses wbadmin.exe to inhibit system recovery.

Modifies Windows Firewall