Modifies WinLogon for persistence

Modifies Windows Defender DisableAntiSpyware settings

Modifies Windows Defender Real-time Protection settings

Modifies Windows Defender TamperProtection settings

UAC bypass

Windows security bypass

Clears Windows event logs

Deletes shadow copies

Ransomware often targets backup files to inhibit system recovery.

Adds policy Run key to start application

Boot or Logon Autostart Execution: Active Setup

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

Boot or Logon Autostart Execution: Port Monitors

Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation.

Command and Scripting Interpreter: PowerShell

Run Powershell command to delete shadowcopy.

Command and Scripting Interpreter: PowerShell

Using powershell.exe command.

Disables one or more Microsoft Defender components

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

Downloads MZ/PE file

Event Triggered Execution: AppInit DLLs

Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

Event Triggered Execution: Image File Execution Options Injection

Sets service image path in registry

This determines the executable launched when a service starts. It can be used to establish persistence.