metasploit | 82fbb67bf03714661b75a49245c8fe42141e7b68dda3f97f765eb1f2e00a89a9

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	mQxBvlTA.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	mQxBvlTA.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	mQxBvlTA.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation	New Text Document mod.exe

Executes dropped EXE 10 IoCs

pid	Process
2668	mQxBvlTA.exe
3788	xIPJVPDq.exe
8	PoeIrffW.exe
4792	crypted6077866846MVYQY.exe
2420	i1gcbW1E.exe
3600	disable-defender.exe
4304	pclient.exe
4592	responsibilitylead.exe
5000	MStore.exe
1816	Props.exe

Themida packer 3 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral7/files/0x000900000002311e-7.dat	themida
behavioral7/memory/2668-60-0x00000000005F0000-0x000000000170C000-memory.dmp	themida
behavioral7/memory/2668-62-0x00000000005F0000-0x000000000170C000-memory.dmp	themida

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	pclient.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	mQxBvlTA.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
25	raw.githubusercontent.com
26	raw.githubusercontent.com
38	pastebin.com
40	pastebin.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
124	ip-api.com

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral7/files/0x00070000000231fa-131.dat	autoit_exe
behavioral7/files/0x0008000000023229-601.dat	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2668	mQxBvlTA.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 6 IoCs

pid	pid_target	Process	procid_target
2880	3756	WerFault.exe	113
384	4912	WerFault.exe	128
5344	2888	WerFault.exe	152
5580	640	WerFault.exe	121
5908	4336	WerFault.exe	138
5224	1656	WerFault.exe	181

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

pid	Process
5360	schtasks.exe
2624	schtasks.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
5136	PING.EXE
5240	PING.EXE

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
3788	xIPJVPDq.exe
3788	xIPJVPDq.exe
3788	xIPJVPDq.exe
3788	xIPJVPDq.exe
8	PoeIrffW.exe
8	PoeIrffW.exe
8	PoeIrffW.exe
8	PoeIrffW.exe
4792	crypted6077866846MVYQY.exe
3600	disable-defender.exe
3600	disable-defender.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	1652	New Text Document mod.exe
Token: SeDebugPrivilege	3788	xIPJVPDq.exe
Token: SeDebugPrivilege	8	PoeIrffW.exe
Token: SeDebugPrivilege	4792	crypted6077866846MVYQY.exe
Token: SeDebugPrivilege	3600	disable-defender.exe
Token: SeImpersonatePrivilege	3600	disable-defender.exe
Token: SeDebugPrivilege	4592	responsibilitylead.exe
Token: SeDebugPrivilege	2668	mQxBvlTA.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 1652 wrote to memory of 2668	1652	New Text Document mod.exe	91
PID 1652 wrote to memory of 2668	1652	New Text Document mod.exe	91
PID 1652 wrote to memory of 2668	1652	New Text Document mod.exe	91
PID 1652 wrote to memory of 3788	1652	New Text Document mod.exe	92
PID 1652 wrote to memory of 3788	1652	New Text Document mod.exe	92
PID 1652 wrote to memory of 3788	1652	New Text Document mod.exe	92
PID 3788 wrote to memory of 8	3788	xIPJVPDq.exe	93
PID 3788 wrote to memory of 8	3788	xIPJVPDq.exe	93
PID 1652 wrote to memory of 4792	1652	New Text Document mod.exe	94
PID 1652 wrote to memory of 4792	1652	New Text Document mod.exe	94
PID 1652 wrote to memory of 4792	1652	New Text Document mod.exe	94
PID 1652 wrote to memory of 2420	1652	New Text Document mod.exe	96
PID 1652 wrote to memory of 2420	1652	New Text Document mod.exe	96
PID 1652 wrote to memory of 3600	1652	New Text Document mod.exe	98
PID 1652 wrote to memory of 3600	1652	New Text Document mod.exe	98
PID 1652 wrote to memory of 4304	1652	New Text Document mod.exe	100
PID 1652 wrote to memory of 4304	1652	New Text Document mod.exe	100
PID 4304 wrote to memory of 4592	4304	pclient.exe	101
PID 4304 wrote to memory of 4592	4304	pclient.exe	101
PID 1652 wrote to memory of 5000	1652	New Text Document mod.exe	102
PID 1652 wrote to memory of 5000	1652	New Text Document mod.exe	102
PID 1652 wrote to memory of 1816	1652	New Text Document mod.exe	104
PID 1652 wrote to memory of 1816	1652	New Text Document mod.exe	104
PID 5000 wrote to memory of 3200	5000	MStore.exe	105
PID 5000 wrote to memory of 3200	5000	MStore.exe	105
PID 3200 wrote to memory of 2372	3200	cmd.exe	109
PID 3200 wrote to memory of 2372	3200	cmd.exe	109

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe
"C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1652
- C:\Users\Admin\AppData\Local\Temp\a\mQxBvlTA.exe
  "C:\Users\Admin\AppData\Local\Temp\a\mQxBvlTA.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of AdjustPrivilegeToken
  PID:2668
- C:\Users\Admin\AppData\Local\Temp\a\xIPJVPDq.exe
  "C:\Users\Admin\AppData\Local\Temp\a\xIPJVPDq.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3788
- - C:\Users\Admin\AppData\Local\Temp\PoeIrffW.exe
    "C:\Users\Admin\AppData\Local\Temp\PoeIrffW.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:8
- C:\Users\Admin\AppData\Local\Temp\a\crypted6077866846MVYQY.exe
  "C:\Users\Admin\AppData\Local\Temp\a\crypted6077866846MVYQY.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4792
- C:\Users\Admin\AppData\Local\Temp\a\i1gcbW1E.exe
  "C:\Users\Admin\AppData\Local\Temp\a\i1gcbW1E.exe"
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Users\Admin\AppData\Local\Temp\a\disable-defender.exe
  "C:\Users\Admin\AppData\Local\Temp\a\disable-defender.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3600
- C:\Users\Admin\AppData\Local\Temp\a\pclient.exe
  "C:\Users\Admin\AppData\Local\Temp\a\pclient.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4304
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\responsibilitylead.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\responsibilitylead.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:4592
- C:\Users\Admin\AppData\Local\Temp\a\MStore.exe
  "C:\Users\Admin\AppData\Local\Temp\a\MStore.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5000
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell Add-MpPreference -ExclusionExtension .exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3200
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Add-MpPreference -ExclusionExtension .exe
      4⤵
      PID:2372
- - C:\Windows\Temp\Temp.exe
    "C:\Windows\Temp\Temp.exe" -s
    3⤵
    PID:4324
  - - C:\Windows\Temp\Temp.exe
      C:\Windows\Temp\Temp.exe -s
      4⤵
      PID:1148
- - C:\Windows\SysWOW64\MService.exe
    "C:\Windows\SysWOW64\MService.exe"
    3⤵
    PID:4780
- C:\Users\Admin\AppData\Local\Temp\a\Props.exe
  "C:\Users\Admin\AppData\Local\Temp\a\Props.exe"
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Users\Admin\AppData\Local\Temp\a\wininit.exe
  "C:\Users\Admin\AppData\Local\Temp\a\wininit.exe"
  2⤵
  PID:1084
- C:\Users\Admin\AppData\Local\Temp\a\1234.exe
  "C:\Users\Admin\AppData\Local\Temp\a\1234.exe"
  2⤵
  PID:3068
- C:\Users\Admin\AppData\Local\Temp\a\ISetup8.exe
  "C:\Users\Admin\AppData\Local\Temp\a\ISetup8.exe"
  2⤵
  PID:3756
- - C:\Users\Admin\AppData\Local\Temp\u2wc.0.exe
    "C:\Users\Admin\AppData\Local\Temp\u2wc.0.exe"
    3⤵
    PID:640
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\FCGCFCAFII.exe"
      4⤵
      PID:5452
    - - C:\Users\Admin\AppData\Local\Temp\FCGCFCAFII.exe
        
        "C:\Users\Admin\AppData\Local\Temp\FCGCFCAFII.exe"
        5⤵
        
        PID:5684
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C ping 2.2.2.2 -n 1 -w 3000 > Nul & Del C:\Users\Admin\AppData\Local\Temp\FCGCFCAFII.exe
        6⤵
        
        PID:4184
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 2.2.2.2 -n 1 -w 3000
        7⤵
        Runs ping.exe
        
        PID:5240
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 640 -s 2280
      4⤵
      Program crash
      PID:5580
- - C:\Users\Admin\AppData\Local\Temp\u2wc.1.exe
    "C:\Users\Admin\AppData\Local\Temp\u2wc.1.exe"
    3⤵
    PID:4684
  - - C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
      "C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD1
      4⤵
      PID:3572
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3756 -s 1412
    3⤵
    - Program crash
    PID:2880
- C:\Users\Admin\AppData\Local\Temp\a\test2.exe
  "C:\Users\Admin\AppData\Local\Temp\a\test2.exe"
  2⤵
  PID:872
- C:\Users\Admin\AppData\Local\Temp\a\1111.exe
  "C:\Users\Admin\AppData\Local\Temp\a\1111.exe"
  2⤵
  PID:1760
- C:\Users\Admin\AppData\Local\Temp\a\ISetup2.exe
  "C:\Users\Admin\AppData\Local\Temp\a\ISetup2.exe"
  2⤵
  PID:4912
- - C:\Users\Admin\AppData\Local\Temp\u3sg.0.exe
    "C:\Users\Admin\AppData\Local\Temp\u3sg.0.exe"
    3⤵
    PID:4336
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 1256
      4⤵
      Program crash
      PID:5908
- - C:\Users\Admin\AppData\Local\Temp\u3sg.1.exe
    "C:\Users\Admin\AppData\Local\Temp\u3sg.1.exe"
    3⤵
    PID:4136
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4912 -s 1424
    3⤵
    - Program crash
    PID:384
- C:\Users\Admin\AppData\Local\Temp\a\Tester.exe
  "C:\Users\Admin\AppData\Local\Temp\a\Tester.exe"
  2⤵
  PID:4656
- C:\Users\Admin\AppData\Local\Temp\a\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\a\svchost.exe"
  2⤵
  PID:1716
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\Users\Public\svchost.exe"
    3⤵
    - Creates scheduled task(s)
    PID:2624
- C:\Users\Admin\AppData\Local\Temp\a\555.exe
  "C:\Users\Admin\AppData\Local\Temp\a\555.exe"
  2⤵
  PID:2380
- C:\Users\Admin\AppData\Local\Temp\a\Document.exe
  "C:\Users\Admin\AppData\Local\Temp\a\Document.exe"
  2⤵
  PID:3172
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\a\Document.exe"
    3⤵
    PID:5144
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\gYVTyaODtj.exe"
    3⤵
    PID:5336
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gYVTyaODtj" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE493.tmp"
    3⤵
    - Creates scheduled task(s)
    PID:5360
- - C:\Users\Admin\AppData\Local\Temp\a\Document.exe
    "C:\Users\Admin\AppData\Local\Temp\a\Document.exe"
    3⤵
    PID:5432
- - C:\Users\Admin\AppData\Local\Temp\a\Document.exe
    "C:\Users\Admin\AppData\Local\Temp\a\Document.exe"
    3⤵
    PID:5776
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "msdtc" /tr '"C:\Users\Admin\AppData\Roaming\msdtc.exe"' & exit
      4⤵
      PID:5128
- C:\Users\Admin\AppData\Local\Temp\a\BrawlB0t.exe
  "C:\Users\Admin\AppData\Local\Temp\a\BrawlB0t.exe"
  2⤵
  PID:5096
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\a\BrawlB0t.exe'
    3⤵
    PID:4368
- C:\Users\Admin\AppData\Local\Temp\a\medcallaboratory5.exe
  "C:\Users\Admin\AppData\Local\Temp\a\medcallaboratory5.exe"
  2⤵
  PID:3968
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Users\Admin\AppData\Local\Temp\a\medcallaboratory5.exe"
    3⤵
    PID:336
- C:\Users\Admin\AppData\Local\Temp\a\securitycheck.exe
  "C:\Users\Admin\AppData\Local\Temp\a\securitycheck.exe"
  2⤵
  PID:4280
- C:\Users\Admin\AppData\Local\Temp\a\PrintSpoofer.exe
  "C:\Users\Admin\AppData\Local\Temp\a\PrintSpoofer.exe"
  2⤵
  PID:2156
- C:\Users\Admin\AppData\Local\Temp\a\Adobe_update.exe
  "C:\Users\Admin\AppData\Local\Temp\a\Adobe_update.exe"
  2⤵
  PID:2888
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:5248
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2888 -s 816
    3⤵
    - Program crash
    PID:5344
- C:\Users\Admin\AppData\Local\Temp\a\Retailer_prog.exe
  "C:\Users\Admin\AppData\Local\Temp\a\Retailer_prog.exe"
  2⤵
  PID:5712
- C:\Users\Admin\AppData\Local\Temp\a\BroomSetup.exe
  "C:\Users\Admin\AppData\Local\Temp\a\BroomSetup.exe"
  2⤵
  PID:3156
- C:\Users\Admin\AppData\Local\Temp\a\alexxxxxxxx.exe
  "C:\Users\Admin\AppData\Local\Temp\a\alexxxxxxxx.exe"
  2⤵
  PID:5100
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:5732
  - - C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe
      "C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe"
      4⤵
      PID:2688
  - - C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe
      "C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe"
      4⤵
      PID:852
- C:\Users\Admin\AppData\Local\Temp\a\syncUpd.exe
  "C:\Users\Admin\AppData\Local\Temp\a\syncUpd.exe"
  2⤵
  PID:1656
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1656 -s 1020
    3⤵
    - Program crash
    PID:5224
- C:\Users\Admin\AppData\Local\Temp\a\Ledger-Live.exe
  "C:\Users\Admin\AppData\Local\Temp\a\Ledger-Live.exe"
  2⤵
  PID:2784
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C ping 2.2.2.2 -n 1 -w 3000 > Nul & Del C:\Users\Admin\AppData\Local\Temp\a\Ledger-Live.exe
    3⤵
    PID:1440
  - - C:\Windows\SysWOW64\PING.EXE
      ping 2.2.2.2 -n 1 -w 3000
      4⤵
      Runs ping.exe
      PID:5136
- C:\Users\Admin\AppData\Local\Temp\a\new1.exe
  "C:\Users\Admin\AppData\Local\Temp\a\new1.exe"
  2⤵
  PID:5368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 3756 -ip 3756
1⤵
PID:4324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4912 -ip 4912
1⤵
PID:2056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2888 -ip 2888
1⤵
PID:5240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 640 -ip 640
1⤵
PID:5500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4336 -ip 4336
1⤵
PID:5840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 1656 -ip 1656
1⤵
PID:1892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

Remote System Discovery

T1018

System Information Discovery