Trend Micro Agenda Ransomware AUG 2022

Qilin can identify specific services for termination or to be left running at execution.

Qilin can check `HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control SystemStartOptions` to determine if a machine is running in safe mode.

Qilin can accept a command line argument identifying specific IPs.

Qilin has pushed scheduled tasks via Group Policy Objects (GPOs) for execution. Qilin has also created a scheduled task named TVInstallRestore, configured to run at logon using the `/SC ONLOGON` argument.

Qilin can inject pwndll.dll, a patched DLL from the legitimate DLL WICloader.dll, into svchost.exe for continuous execution.

Qilin can define specific processes to be terminated or left alone at execution.

Qilin can exclude specific directories and files from encryption.

Qilin can list all local users found on a targeted system.

Qilin can attempt to log on to the local computer via `LogonUserW` and use `GetLogicalDrives()` and `EnumResourceW()` for discovery.

Qilin has the ability to list network drives.

Qilin has pushed a scheduled task via a Group Policy Object for payload execution.

Qilin can use AES-256 or ChaCha20 for domain-wide encryption of victim servers and workstations and RSA-4096 or RSA-2048 to secure generated encryption keys.

Qilin can terminate specific services on compromised hosts.

Qilin can execute `vssadmin.exe delete shadows /all /quiet` to remove volume shadow copies and can disable High Availability (HA) and Distributed Resource Scheduler (DRS) in vCenter clusters.

Qilin has created a RunOnce autostart entry at `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce*aster = %Public%\enc.exe` pointing to a dropped copy of itself in the Public folder.

Qilin can configure a Winlogon registry entry.

Qilin can terminate antivirus-related processes and services.

Qilin can reboot targeted systems in safe mode to avoid detection.