Forum Discussion

netcat's avatar
netcat
Icon for Bronze III rankBronze III
3 months ago
Solved

Ransomware: Bad Rabbit - Registry key

Hi the question is: What is the full registry key path which gets registered in regard to the "cscc" service? The obvious answer is: HKLM\System\CurrentControlSet\Services\cscc You find it it on...
help & support
  • autom8on's avatar
    autom8on
    3 months ago

    So - I managed to work out the answer using OSINT, since the lab didn't seem to be working at the time I looked at it (August). Though, annoyingly, I didn't record specifically where I found it. The actual answer, is like your obvious answer, but with another word (technically, two words added together like "TwoWords") added after "...Services\cscc\". 

    My notes from the time:

    "Cheated. ;-p  Googled and found something saying you can find it in the results of searching for "cscc registry" - however, that search returns zero hits for me... is this lab still working?". 

    Checking today - that search does return results which seem to include the answer you need...

KieranRowley's avatar
KieranRowley
Icon for Community Manager rankCommunity Manager
3 months ago

autom8on I love the fact that you have such in depth notes going back so far!

  • autom8on's avatar
    autom8on
    Icon for Bronze III rankBronze III
    3 months ago

    My colleagues are less keen on my incessant lectures on the importance of keeping good notes. ;-p  However, I continue to go on about it, to their annoyance. Many many times it's proved useful long after the fact to have contemporaneous notes to aid my appalling memory. I was a scientist first, and what's science if not noting down observations and the results of things for future reference? ;-)