Credentials from Password Stores: Credentials from Web Browsers

Malicious Access or copy of Web Browser Credential store.

Deletes shadow copies

Ransomware often targets backup files to inhibit system recovery.

Boot or Logon Autostart Execution: Active Setup

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

Drops file in Drivers directory

Manipulates Digital Signatures

Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.