#StopRansomware: Snatch Ransomware

Summary:

Snatch threat actors conduct ransomware execution and data discovery using batch files (.bat). They leverage Windows tools to enumerate systems on the victim's network, compromise domain accounts, and maintain persistence. The actors delete batch files after execution, modify Windows Registry keys, and disable antivirus programs. They also attempt to disable Safe Mode, use brute force to obtain administrator credentials, and interact with the Windows Registry to gather information, search for running processes, and search for files and folders of interest prior to exfiltration.