Scribd Logo
Upload

Welcome to Scribd!

  • Blog 1

    Uploaded by

    Viren Choudhari
    17 views2 pages
    Malware often checks registry keys to determine if it is running in a virtual machine in order to avoid detection. Some malware also modifies registry keys to maintain persistence, disable security tools, or enable privileges like remote desktop access. Ransomware like Maze, Conti, REvil, Netwalker, and Clop all use registry key queries and modifications for functions like maintaining persistence, disabling defenses, and enabling privileges.

    Original Description:

    Original Title

    blog1

    Copyright

    © © All Rights Reserved

    Available Formats

    DOCX, PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    Report this Document
    Malware often checks registry keys to determine if it is running in a virtual machine in order to avoid detection. Some malware also modifies registry keys to maintain persistence, disable security tools, or enable privileges like remote desktop access. Ransomware like Maze, Conti, REvil, Netwalker, and Clop all use registry key queries and modifications for functions like maintaining persistence, disabling defenses, and enabling privileges.

    Copyright:

    © All Rights Reserved
    Download as DOCX, PDF, TXT or read online from Scribd
    Flag for inappropriate content
    Download as docx, pdf, or txt
    17 views2 pages

    Blog 1

    Uploaded by

    Viren Choudhari
    Malware often checks registry keys to determine if it is running in a virtual machine in order to avoid detection. Some malware also modifies registry keys to maintain persistence, disable security tools, or enable privileges like remote desktop access. Ransomware like Maze, Conti, REvil, Netwalker, and Clop all use registry key queries and modifications for functions like maintaining persistence, disabling defenses, and enabling privileges.

    Copyright:

    © All Rights Reserved
    Download as DOCX, PDF, TXT or read online from Scribd
    Flag for inappropriate content
    Download as docx, pdf, or txt
    of 2

    Story 1:

    Some malware reads registry key values and looks for substrings in them that suggest a virtual machine

     The Smoke Loader banking trojan, checks registry key values in System\CurrentControlSet\
    Enum\IDE and System\CurrentControlSet\Enum\SCSI to search for substrings that match QEMU,
    VirtualBox, VMware, or Xen virtualization products (Source)
     FinFisher verifies that HKLM\SOFTWARE\Microsoft\Cryptography\MachineGuid does not
    equal "6ba1d002-21ed-4dbe-afb5-08cf8b81ca32 (Source)
     CozyCar checks the registry key values in SOFTWARE\Microsoft\Windows\
    CurrentVersion\Uninstall for security products (Source)

    https://www.cybereason.com/blog/a-bazar-of-tricks-following-team9s-development-cycles

    Story 2:

    Top ransomware how they use registry keys

    1. Maze (aka ChaCha ransomware) Maze ransomware, first spotted in 2019, quickly


    rose to the top of its malware class. ...

    T1112: Modify Registry


    reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v
    fDenyTSConnections /t REG_DWORD /d 0 /f --- enable remote desktop

    T1547.001 - Registry Run Keys / Startup Folder

    T1012 - Query Registry

    2. Conti (aka IOCP ransomware) ...


    T1012 - Query Registry: Conti ransomware first checks the computer name belonging to the
    victim, via the registry:

    T1562.001 - Impair Defenses: Disable or Modify ToolsThe threat actors disabled Windows
    Defender by adding the below to an already linked GPO.
    T1547.001 - Registry Run Keys / Startup Folder

    3. REvil (aka Sodin, Sodinokibi ransomware) ...

    T1547.001 - Registry Run Keys / Startup Folder - a couple RunOnce registry keys and then
    immediately rebooted the system into Safe Mode with Networking
    HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\
    aDTFUAIa7j :

    https://malpedia.caad.fkie.fraunhofer.de/details/win.revil

    4. Netwalker (aka Mailto ransomware) ...

    Registry Run Key (T1547.001): Place a value on RunOnce key

    Modify Registry key (T1112): Create its own registry key in \SOFTWARE\
    <uniquename>

    T1547.001: A registry key will be set to maintain persistency of the payload on the host in
    the following: ‘HKLM/software/’ and ‘HKCU/software/’

    T1112 Registry Modification HKLM\Software\CLasses\cmdfile\shell\open\command

    5. Clop ransomware.
    T1562.001: Impair Defenses: Disable or Modify Tools: Clop, disables
    Windows Defender in the beginning of its execution. Cybereason detects the
    malicious commands executed to silently modify related registry keys:

    You might also like