Procedure examples

Prestige has used the `Wow64DisableWow64FsRedirection()` and `Wow64RevertWow64FsRedirection()` functions to disable and restore file system redirection.

Bankshot creates processes using the Windows API calls: CreateProcessA() and CreateProcessAsUserA().

SharpDisco can leverage Native APIs through plugins including `GetLogicalDrives`.

xCaon has leveraged native OS function calls to retrieve victim's network adapter's information using GetAdapterInfo() API.

Pony has used several Windows functions for various purposes.

Nebulae has the ability to use CreateProcess to execute a process.

TONESHELL has utilized Native Windows API functions such as `WriteProcessMemory` and `CreateRemoteThreadEx`. TONESHELL has also utilized Windows API functions for creating seed values including `CoCreateGuid` and `GetTickCount`. TONESHELL has leveraged the legitimate API function `EnumSystemLocalesA` to run its shellcode through the callback function.

Medusa Ransomware has leveraged Windows Native API functions to execute payloads.

The file collection tool used by RainyDay can utilize native API including ReadDirectoryChangeW for folder monitoring.

AppleSeed has the ability to use multiple dynamically resolved API calls.

NETWIRE can use Native API including CreateProcess GetProcessById, and WriteProcessMemory.

TinyTurla has used `WinHTTP`, `CreateProcess`, and other APIs for C2 communications and other functions.

BOOKWORM has used various Windows API calls during execution and defense evasion. BOOKWORM has created a buffer on the heap using `HeapCreate` and `HeapAlloc` which allows for copying of shell code and then execution on the heap is initiated through callback function of legitimate API functions such as `EnumChildWindows` or `EnumSystemLanguageGroupsA`.

HyperStack can use Windows API's ConnectNamedPipe and WNetAddConnection2 to detect incoming connections and connect to remote shares.

Bad Rabbit has used various Windows API calls.

IMAPLoader imports native Windows APIs such as `GetConsoleWindow` and `ShowWindow`.

Aria-body has the ability to launch files using ShellExecute.

Emotet has used `CreateProcess` to create a new process to run its executable and `WNetEnumResourceW` to enumerate non-hidden shares.

DynoWiper has used multiple native Windows functions, such as `GetLogicalDrives` and `FindNextFile` for discovery and file deletion.

BADHATCH can utilize Native API functions such as, `ToolHelp32` and `Rt1AdjustPrivilege` to enable `SeDebugPrivilege` on a compromised machine.

PUBLOAD has used various Windows API calls during execution, when establishing persistence and defense evasion. PUBLOAD stager leveraged Windows API functions with callback including `GrayStringW`, `EnumDateFormatsA`, and `LineDDA` to bypass anti-virus monitoring. PUBLOAD has also utilized other native windows API functions with callback functions such as `EnumChildWindows` and `EnumSystemLanguageGroupsA`.

SystemBC has utilized native Windows API functions such as `EnumWindows`and `GetVolumeInformationA` during discovery activities.

Woody RAT can use multiple native APIs, including `WriteProcessMemory`, `CreateProcess`, and `CreateRemoteThread` for process injection.

Mafalda can use a variety of API calls.

CANONSTAGER has leveraged Native API calls to execute code within the victim’s system including `GetCurrentDirectoryW`, `RegisterClassW` and `CreateWindowExW`. CANONSTAGER also created a new overlapped window that initiates callback functions to a windows procedure that processes Windows messages until a designated message type of 0x0018 WM_SHOWWINDOW is observed which then initiates the deployment of a subsequent malicious payload.

PolyglotDuke can use LoadLibraryW and CreateProcess to load and execute code.

SombRAT has the ability to respawn itself using ShellExecuteW and CreateProcessW.

ODAgent can pass commands using native APIs.

GuLoader can use a number of different APIs for discovery and execution.

WastedLocker's custom crypter, CryptOne, leveraged the VirtualAlloc() API function to help execute the payload.

InvisiMole can use winapiexec tool for indirect execution of ShellExecuteW and CreateProcessA.

CLAIMLOADER has used various Windows API calls during execution, when establishing persistence and defense evasion. CLAIMLOADER has also leveraged the legitimate API functions to run its shellcode through the callback function, including `GetDC()` and `EnumFontsW()`. CLAIMLOADER established persistence by utilizing the API `SHSetValue()`. CLAIMLOADER has utilized APIs with callback functions such as `EnumpropsExW`, `EnumSystemLanguageGroupsA`, and `EnumCalendarInfoExW`.

Volgmer executes payloads using the Windows API call CreateProcessW().

WhisperGate has used the `ExitWindowsEx` to flush file buffers to disk and stop running processes and other API calls.

Conti has used API calls during execution.

Mispadu has used a variety of Windows API calls, including ShellExecute and WriteProcessMemory.

Diavol has used several API calls like `GetLogicalDriveStrings`, `SleepEx`, `SystemParametersInfoAPI`, `CryptEncrypt`, and others to execute parts of its attack.

Siloscape makes various native API calls.

RustyWater has used `CreateObject` to instantiate a WScript.Shell Component Object Model (COM) object.  Additionally, RustyWater has used `VirtualAllocEx` and `WriteProcessMemory` to inject shellcode into explorer.exe.

IcedID has called ZwWriteVirtualMemory, ZwProtectVirtualMemory, ZwQueueApcThread, and NtResumeThread to inject itself into a remote process.

HTTPTroy has leveraged Windows Native API calls, including `GetProcAddress` to execute functions in memory.

MarkiRAT can run the ShellExecuteW API via the Windows Command Shell.

CHIMNEYSWEEP can use Windows APIs including `LoadLibrary` and `GetProcAddress`.

FatDuke can call ShellExecuteW to open the default browser on the URL localhost.

DCSrv has used various Windows API functions, including `DeviceIoControl`, as part of its encryption process.

DRATzarus can use various API calls to see if it is running in a sandbox.

Rising Sun used dynamic API resolutions to various Windows APIs by leveraging `LoadLibrary()` and `GetProcAddress()`.

ShimRat has used Windows API functions to install the service and shim.

Chrommme can use Windows API including `WinExec` for execution.

Avaddon has used the Windows Crypto API to generate an AES key.