Deletes shadow copies

Ransomware often targets backup files to inhibit system recovery.

Modifies boot configuration data using bcdedit

Command and Scripting Interpreter: PowerShell

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

Deletes backup catalog

Uses wbadmin.exe to inhibit system recovery.

Disables RegEdit via registry modification

Disables Task Manager via registry modification

Disables one or more Microsoft Defender components

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.