Pay2Key Disables Start Menu Shutdown via shutdownwithoutlogon Registry Key
Detects a registry modification where Pay2Key ransomware sets the 'shutdownwithoutlogon' value to 0 under 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System'. This action disables the shutdown option in the Windows Start menu, a tactic used by the ransomware to maintain access to the infected system and ensure encryption processes are not interrupted by a reboot.
YARA-L
