Procedure examples

BitPaymer can enumerate existing Windows services on the host that are configured to run as LocalSystem.

BitPaymer can use the RegEnumKeyW to iterate through Registry keys.

BitPaymer can use net view to discover remote systems.

BitPaymer has used RC4-encrypted strings and string hashes to avoid identifiable strings within the binary.

BitPaymer can modify the timestamp of an executable so that it can be identified and restored by the decryption tool.

BitPaymer can enumerate the sessions for each user logged onto the infected host.

BitPaymer has used dynamic API resolution to avoid identifiable strings within the binary, including RegEnumKeyW.

BitPaymer can set values in the Registry to help in execution.

BitPaymer can use the tokens of users to create processes on infected systems.

BitPaymer can search for network shares on the domain or workgroup using net view <host>.

BitPaymer can use icacls /reset and takeown /F to reset a targeted executable's permissions and then take ownership.

BitPaymer compares file names and paths to a list of excluded names and directory names during encryption.

BitPaymer can import a hard-coded RSA 1024-bit public key, generate a 128-bit RC4 key for each file, and encrypt the file in place, appending .locked to the filename.

BitPaymer attempts to remove the backup shadow files from the host using vssadmin.exe Delete Shadows /All /Quiet.

BitPaymer has attempted to install itself as a service to maintain persistence.

BitPaymer has set the run key HKCU\Software\Microsoft\Windows\CurrentVersion\Run for persistence.

BitPaymer can suppress UAC prompts by setting the HKCU\Software\Classes\ms-settings\shell\open\command registry key on Windows 10 or HKCU\Software\Classes\mscfile\shell\open\command on Windows 7 and launching the eventvwr.msc process, which launches BitPaymer with elevated privileges.

BitPaymer has copied itself to the :bin alternate data stream of a newly created file.