LCRYX Ransomware Disabling Admin Tools via Registry to Prevent Remediation

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•1

Detects unauthorized modification of Windows Registry keys intended to disable core administrative tools, including Task Manager, Registry Editor, Command Prompt/Run dialogs, and the Control Panel. Additionally, it identifies the creation of 'DisallowRun' entries used to block security and remediation utilities like Process Explorer, Autoruns, and System Configuration tools.