Collaborate Disseminate
From what I know, DLL are loaded in this order (simplified) :
Is present in memory ?
KnownDLLs
Curent Application Dir
System32 directory
Etc (not in the question scope)
Step to reproduce the behavior :
Download Process Explorer (Sysinte… Continue reading Why are some DLL not present in KnownDLLs not loaded from current application directory [migrated]
I know that most of the AV are injecting their own DLL in order to do userland API filtering, in functions such as WriteProcessMemory or CreateRemoteThread.
But how can they do that? Because from what I know, the AV dll is not in the proce… Continue reading How does the AV inject their own DLL in each new process?
I wondered what to do if there is a currently ongoing ransomware execution on my computer.
Assuming that I’m "spotting" it while it is encrypting my files, should I power my computer off?
I would say no because it would cancel an… Continue reading If a ransomware is currently encrypting my files, should I power off my computer?
I would like to monitor some COM object/interfaces to identify if a program is using them.
I only managed to monitor the associated DLL loading (with Microsoft-Windows-Kernel-Process) but I can’t go any further. I used python but I also di… Continue reading Is it possible to monitor COM class/interface by using ETW
I wondered why some ransomwares are mounting the EFI partition on Windows.
It’s happening for most ransomware on Windows (blackcat, lockbit, avoslocker …), and it is only accessible through powershell admin console (and not from the expl… Continue reading Why ransomware are mounting EFI partition [closed]
I wondered why some ransomware, such as ALPHV/Blackcat or Lockbit 2.0, mount drive Z:
EFI
Microsoft
…
Boot
…
I found here that it may be related to discovery:
"ALPHV attempts to propagate via mounting hidden partitions th… Continue reading Why some ransomware mount Z: