Unveiling the Mechanisms of Automated Abuse
Upon decryption, the configuration reveals a meticulously crafted sequence of actions that encompass file and directory deletions, file relocations, and various registry operations. These operations present a range of possibilities, including the deletion of registry keys and values, modification of existing registry values, and even potential tampering with persistence mechanisms or security controls.
Particularly noteworthy is the file-move primitive, which, when directed to the System32 directory, transforms into a powerful arbitrary file-write capability, as highlighted by Vinopal. This transformation underscores the potential risks associated with such operations, particularly in sensitive system areas.
The automation of these abusive actions is facilitated through a tool known as BTRCLI. This tool streamlines the process by extracting a legitimate driver from the local Windows Defender installation, constructing an encrypted transaction, and subsequently loading the driver. By utilizing the target machine's own version of BTR.sys, BTRCLI cleverly circumvents the need for introducing external drivers, a common tactic in traditional “Bring Your Own Vulnerable Driver” (BYOVD) attacks, as noted by CPR.
