Procedure examples

UPPERCUT can use a sleep function to delay execution.

TeamPCP Cloud Stealer has leveraged a persistence script that will sleep for five minutes before additional execution.

InvisibleFerret has the capability to scan for file names, file extensions, and avoids pre-designated path names and file types.

Medusa Ransomware has avoided specified files, file extensions and folders to ensure successful execution of the payload and continued operations of the impacted device.

DynoWiper has recursively enumerated directories with the exception of the following: System32, Windows, Program Files, Program Files(x86), Temp, Recycle.Bin, $Recycle.Bin, Boot, PerfLogs, AppData, Documents and Settings.

SameCoin can avoid overwriting file names that contain “desktop.ini” and “conf.conf."

Embargo has avoided encrypting specific files and directories by leveraging a regular expression within the ransomware binary.

LazyWiper can enumerate the hostname of the system to determine if it is a domain controller and exclude it from being wiped if so.

BLINDINGCAN has collected disk information, including type and free space available.

Ninja can obtain information on physical drives from targeted hosts.

Proxysvc collects volume information for all drives on the system.

Torisma can use `GetlogicalDrives` to get a bitmask of all drives available on a compromised system. It can also use `GetDriveType` to determine if a new drive is a CD-ROM drive.

NOKKI can gather information on drives on the victim’s machine.

yty gathers the the serial number of the main disk volume.

KOPILUWAK can discover logical drive information on compromised hosts.

Sardonic has the ability to collect the C:\ drive serial number from a compromised machine.

KEYMARBLE has the capability to collect information on disk devices.

Bankshot gathers disk type and disk free space.

SharpDisco can use a plugin to enumerate system drives.

StrongPity can identify the hard disk volume serial number on a compromised host.

Nebulae can discover logical drive information including the drive type, free space, and volume information.

TONESHELL has retrieved the disk serial number of the device using WMI query `SELECT volumeserialnumber FROM win32_logicaldisk where Name =’C:` to identify the victim machine.

Medusa Ransomware has enumerated logical drives on infected hosts.

macOS.OSAMiner has checked to ensure there is enough disk space using the Unix utility `df`.

Aria-body has the ability to identify disk information on a compromised host.

Crimson contains a command to collect disk drive information.

DynoWiper has used the Microsoft Windows native `GetLogicalDrives()` and `GetDriveType()` functions to enumerate all the drives visible to the system.

Avenger has the ability to identify the host volume ID.

PUBLOAD has leveraged `wmic logicaldisk get` to map local network drives.

Woody RAT can retrieve information about storage drives from an infected machine.

Mafalda can enumerate all drives on a compromised host.

MoonWind can obtain the number of drives on the victim machine.

HOPLIGHT has been observed collecting victim machine volume information.

InvisiMole can gather information on the mapped drives and system volume serial number.

WhisperGate has the ability to enumerate fixed logical drives on a targeted system.

BlackCat can enumerate local drives.

Nightdoor can collect information about disk drives, their total and free space, and file system type.

Kazuar gathers information on local drives.

Rising Sun can detect drive information, including drive type, total number of bytes on disk, total number of free bytes on disk, and name of a specified volume.

Chrommme has the ability to list drives.

HELLOKITTY can enumerate logical drives on a target system.

CORESHELL collects the volume serial number from the victim and sends the information to its C2 server.

RunningRAT gathers logical drives information and volume information.

Babuk can enumerate disk volumes, get disk information, and query service status.

BlackMould can enumerate local drives on a compromised host.

PlugX has collected a list of all mapped drives on the infected host.

Reaver collects volume serial number from the victim.

Epic collects disk space information.

Cuba can enumerate local drives, disk type, and disk free space.

DEATHRANSOM can enumerate logical drives on a target system.