Техническая информация
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'Ransomware-A6' = '<PATH_SAMPLE>.bat'
- '<SYSTEM32>\taskkill.exe' /im explorer.exe /f
- %WINDIR%\explorer.exe
- <SYSTEM32>\encrypt.sk
- nul
- ClassName: '' WindowName: ''
- '<SYSTEM32>\reg.exe' ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Ransomware-A6 /t REG_SZ /d "<PATH_SAMPLE>.bat"