NoEscape .exe File Association Hijack via exefile\shell Registry Keys

Subhankar H@Andrewsec57

•updated Jul 20, 2026•0•0•5

Detects modifications to Windows Registry keys associated with executable file handling (exefile\shell\open\command, etc.) that set the handler to 'winnt32.exe'. This technique is used by the NoEscape ransomware to hijack the execution of legitimate programs and force the execution of its own malicious binary whenever an executable is run, ensuring persistence and impact.