Procedure examples

EKANS stops database, data backup solution, antivirus, and ICS-related processes.

BRICKSTORM has terminated an existing process to ensure that its own new process can execute.

AvosLocker has terminated specific processes before encryption.

RobbinHood stops 181 Windows services on the system before beginning the encryption process.

RansomHub has the ability to terminate specified services.

Prestige has attempted to stop the MSSQL Windows service to ensure successful encryption using `C:\Windows\System32\net.exe stop MSSQLSERVER`.

InvisibleFerret has terminated Chrome and Brave browsers using the `taskkill` command on Windows and the `killall` command on other systems such as Linux and macOS. InvisibleFerret has also utilized it’s `ssh_kill` command to terminate Chrome and Brave browser processes.

Hannotog can stop Windows services.

Medusa Ransomware has the capability to terminate services related to backups, security, databases, communication, filesharing and websites. Medusa Ransomware has also utilized the `taskkill /F /IM <process> /T` command to stop targeted processes and `net stop <process>` command to stop designated services.

Olympic Destroyer uses the API call ChangeServiceConfigW to disable all services on the affected system.

BlackByte 2.0 Ransomware can terminate running services.

Conti can stop up to 146 Windows services related to security, backup, database, and email solutions through the use of net stop.

Megazord has the ability to terminate a list of services and processes.

Diavol will terminate services using the Service Control Manager (SCM) API.

BlackCat has the ability to stop VM services on compromised networks.

Ragnar Locker has attempted to stop services associated with business applications and databases to release the lock on files used by these applications so they may be encrypted.

Avaddon looks for and attempts to stop database processes.

Cheerscrypt has the ability to terminate VM processes on compromised hosts through execution of `esxcli vm process kill`.

Babuk can stop specific services related to backups.

Cuba has a hardcoded list of services and processes to terminate.

LockBit 3.0 can terminate targeted processes and services related to security, backup, database management, and other applications that could stop or interfere with encryption.

Netwalker can terminate system processes and services, some of which relate to backup software.

WannaCry attempts to kill processes associated with Exchange, Microsoft SQL Server, and MySQL to make it possible to encrypt their data stores.

Pay2Key can stop the MS SQL service at the end of the encryption process to release files locked by the service.

Royal can use `RmShutDown` to kill applications and services using the resources that are targeted for encryption.

Embargo has terminated active processes and services based on a hardcoded list using the `CloseServiceHandle()` function. Embargo has also leveraged MS4Killer to terminate processes contained in an embedded list of security software process names that were XOR-encrypted.

MegaCortex can stop and disable services on the system.

Akira _v2 can stop running virtual machines.

Ryuk has called kill.bat for stopping services, disabling services and killing processes.

HermeticWiper has the ability to stop the Volume Shadow Copy service.

Pysa can stop services and processes.

LockBit 2.0 can automatically terminate processes that may interfere with the encryption or file extraction processes.

HotCroissant has the ability to stop services on the infected host.

REvil has the capability to stop services and kill processes.

ROADSWEEP can disable critical services and processes.

LookBack can kill processes and delete services.

PHASEJAM has disabled the `cgi-server` process on Ivanti Connect Secure appliances.

Clop can kill several processes and services related to backups and security solutions.

Meteor can disconnect all network adapters on a compromised host using `powershell -Command "Get-WmiObject -class Win32_NetworkAdapter | ForEach { If ($.NetEnabled) { $.Disable() } }" > NUL`.

Maze has stopped SQL services to ensure it can encrypt any database.

VIRTUALPITA can start and stop the `vmsyslogd` service.

KillDisk terminates various processes to get the user to reboot the victim machine.

Qilin can terminate specific services on compromised hosts.

Industroyer’s data wiper module writes zeros into the registry keys in SYSTEM\CurrentControlSet\Services to render a system inoperable.

DRYHOOK has terminated all instances of the `cgi-server` process before activating the modified DSAuth.pm file.

INC Ransomware can issue a command to kill a process on compromised hosts.

SLOTHFULMEDIA has the capability to stop processes and services.