First, the malware checks for the existence of a Mutex value, “EKANS”, on the victim. Primary functionality on victim systems is achieved via Windows Management Interface (WMI) calls, which begins executing encryption operations and removes Volume Shadow Copy backups on the victim