dd2b75cb2df230a562fb1d1cac43a847b63bf6658ac7fe36de316fbd2bc5610a

pid	Process
4336	bcdedit.exe
2496	bcdedit.exe
4376	bcdedit.exe
4352	bcdedit.exe

Renames multiple (391) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Deletes backup catalog 3 TTPs 2 IoCs

Uses wbadmin.exe to inhibit system recovery.

ransomware

Command and Scripting Interpreter

T1059

File Deletion

T1070.004

Inhibit System Recovery

pid	Process
4480	wbadmin.exe
3916	wbadmin.exe

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\Control Panel\International\Geo\Nation	Runtime Broker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\Control Panel\International\Geo\Nation	._cache_Synaptics.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\Control Panel\International\Geo\Nation	1d854192e5aac93a950c60e013a8f08283ad81f841dd90da9326198f37c8adda.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\Control Panel\International\Geo\Nation	Synaptics.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\Control Panel\International\Geo\Nation	._cache_1d854192e5aac93a950c60e013a8f08283ad81f841dd90da9326198f37c8adda.exe

Executes dropped EXE 4 IoCs

pid	Process
704	._cache_1d854192e5aac93a950c60e013a8f08283ad81f841dd90da9326198f37c8adda.exe
1452	Synaptics.exe
1872	Runtime Broker.exe
4548	._cache_Synaptics.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\????? = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	1d854192e5aac93a950c60e013a8f08283ad81f841dd90da9326198f37c8adda.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Readme = "C:\\Users\\Admin\\AppData\\Local\\Runtime Broker.exe"	Runtime Broker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Readme = "C:\\Users\\Admin\\AppData\\Local\\Temp\\._cache_Synaptics.exe"	._cache_Synaptics.exe

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kQeklXsgj.jpg"	._cache_Synaptics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\9P7qhh6BW.jpg"	Runtime Broker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	vds.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE

Interacts with shadow copies 2 TTPs 2 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

pid	Process
1440	vssadmin.exe
4200	vssadmin.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	1d854192e5aac93a950c60e013a8f08283ad81f841dd90da9326198f37c8adda.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Synaptics.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3380	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4548	._cache_Synaptics.exe
4548	._cache_Synaptics.exe
4548	._cache_Synaptics.exe
4548	._cache_Synaptics.exe
4548	._cache_Synaptics.exe
4548	._cache_Synaptics.exe
4548	._cache_Synaptics.exe
4548	._cache_Synaptics.exe
4548	._cache_Synaptics.exe
4548	._cache_Synaptics.exe
4548	._cache_Synaptics.exe
4548	._cache_Synaptics.exe
4548	._cache_Synaptics.exe
4548	._cache_Synaptics.exe
4548	._cache_Synaptics.exe
4548	._cache_Synaptics.exe
4548	._cache_Synaptics.exe
4548	._cache_Synaptics.exe
4548	._cache_Synaptics.exe
4548	._cache_Synaptics.exe
4548	._cache_Synaptics.exe
4548	._cache_Synaptics.exe
4548	._cache_Synaptics.exe
4548	._cache_Synaptics.exe
4548	._cache_Synaptics.exe
4548	._cache_Synaptics.exe
4548	._cache_Synaptics.exe
4548	._cache_Synaptics.exe
4548	._cache_Synaptics.exe
4548	._cache_Synaptics.exe
4548	._cache_Synaptics.exe
4548	._cache_Synaptics.exe
4548	._cache_Synaptics.exe
4548	._cache_Synaptics.exe
4548	._cache_Synaptics.exe
4548	._cache_Synaptics.exe
4548	._cache_Synaptics.exe
4548	._cache_Synaptics.exe
4548	._cache_Synaptics.exe
4548	._cache_Synaptics.exe
4548	._cache_Synaptics.exe
4548	._cache_Synaptics.exe
4548	._cache_Synaptics.exe
4548	._cache_Synaptics.exe
4548	._cache_Synaptics.exe
4548	._cache_Synaptics.exe
4548	._cache_Synaptics.exe
4548	._cache_Synaptics.exe
4548	._cache_Synaptics.exe
4548	._cache_Synaptics.exe
1872	Runtime Broker.exe
1872	Runtime Broker.exe
1872	Runtime Broker.exe
1872	Runtime Broker.exe
1872	Runtime Broker.exe
1872	Runtime Broker.exe
1872	Runtime Broker.exe
1872	Runtime Broker.exe
1872	Runtime Broker.exe
1872	Runtime Broker.exe
1872	Runtime Broker.exe
1872	Runtime Broker.exe
1872	Runtime Broker.exe
1872	Runtime Broker.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	704	._cache_1d854192e5aac93a950c60e013a8f08283ad81f841dd90da9326198f37c8adda.exe
Token: SeDebugPrivilege	1872	Runtime Broker.exe
Token: SeDebugPrivilege	4548	._cache_Synaptics.exe
Token: SeBackupPrivilege	4460	vssvc.exe
Token: SeRestorePrivilege	4460	vssvc.exe
Token: SeAuditPrivilege	4460	vssvc.exe
Token: SeIncreaseQuotaPrivilege	1156	WMIC.exe
Token: SeSecurityPrivilege	1156	WMIC.exe
Token: SeTakeOwnershipPrivilege	1156	WMIC.exe
Token: SeLoadDriverPrivilege	1156	WMIC.exe
Token: SeSystemProfilePrivilege	1156	WMIC.exe
Token: SeSystemtimePrivilege	1156	WMIC.exe
Token: SeProfSingleProcessPrivilege	1156	WMIC.exe
Token: SeIncBasePriorityPrivilege	1156	WMIC.exe
Token: SeCreatePagefilePrivilege	1156	WMIC.exe
Token: SeBackupPrivilege	1156	WMIC.exe
Token: SeRestorePrivilege	1156	WMIC.exe
Token: SeShutdownPrivilege	1156	WMIC.exe
Token: SeDebugPrivilege	1156	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1156	WMIC.exe
Token: SeRemoteShutdownPrivilege	1156	WMIC.exe
Token: SeUndockPrivilege	1156	WMIC.exe
Token: SeManageVolumePrivilege	1156	WMIC.exe
Token: 33	1156	WMIC.exe
Token: 34	1156	WMIC.exe
Token: 35	1156	WMIC.exe
Token: 36	1156	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2248	WMIC.exe
Token: SeSecurityPrivilege	2248	WMIC.exe
Token: SeTakeOwnershipPrivilege	2248	WMIC.exe
Token: SeLoadDriverPrivilege	2248	WMIC.exe
Token: SeSystemProfilePrivilege	2248	WMIC.exe
Token: SeSystemtimePrivilege	2248	WMIC.exe
Token: SeProfSingleProcessPrivilege	2248	WMIC.exe
Token: SeIncBasePriorityPrivilege	2248	WMIC.exe
Token: SeCreatePagefilePrivilege	2248	WMIC.exe
Token: SeBackupPrivilege	2248	WMIC.exe
Token: SeRestorePrivilege	2248	WMIC.exe
Token: SeShutdownPrivilege	2248	WMIC.exe
Token: SeDebugPrivilege	2248	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2248	WMIC.exe
Token: SeRemoteShutdownPrivilege	2248	WMIC.exe
Token: SeUndockPrivilege	2248	WMIC.exe
Token: SeManageVolumePrivilege	2248	WMIC.exe
Token: 33	2248	WMIC.exe
Token: 34	2248	WMIC.exe
Token: 35	2248	WMIC.exe
Token: 36	2248	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1156	WMIC.exe
Token: SeSecurityPrivilege	1156	WMIC.exe
Token: SeTakeOwnershipPrivilege	1156	WMIC.exe
Token: SeLoadDriverPrivilege	1156	WMIC.exe
Token: SeSystemProfilePrivilege	1156	WMIC.exe
Token: SeSystemtimePrivilege	1156	WMIC.exe
Token: SeProfSingleProcessPrivilege	1156	WMIC.exe
Token: SeIncBasePriorityPrivilege	1156	WMIC.exe
Token: SeCreatePagefilePrivilege	1156	WMIC.exe
Token: SeBackupPrivilege	1156	WMIC.exe
Token: SeRestorePrivilege	1156	WMIC.exe
Token: SeShutdownPrivilege	1156	WMIC.exe
Token: SeDebugPrivilege	1156	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1156	WMIC.exe
Token: SeRemoteShutdownPrivilege	1156	WMIC.exe
Token: SeUndockPrivilege	1156	WMIC.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3380	EXCEL.EXE
3380	EXCEL.EXE
3380	EXCEL.EXE
3380	EXCEL.EXE

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 3460 wrote to memory of 704	3460	1d854192e5aac93a950c60e013a8f08283ad81f841dd90da9326198f37c8adda.exe	87
PID 3460 wrote to memory of 704	3460	1d854192e5aac93a950c60e013a8f08283ad81f841dd90da9326198f37c8adda.exe	87
PID 3460 wrote to memory of 1452	3460	1d854192e5aac93a950c60e013a8f08283ad81f841dd90da9326198f37c8adda.exe	88
PID 3460 wrote to memory of 1452	3460	1d854192e5aac93a950c60e013a8f08283ad81f841dd90da9326198f37c8adda.exe	88
PID 3460 wrote to memory of 1452	3460	1d854192e5aac93a950c60e013a8f08283ad81f841dd90da9326198f37c8adda.exe	88
PID 704 wrote to memory of 1872	704	._cache_1d854192e5aac93a950c60e013a8f08283ad81f841dd90da9326198f37c8adda.exe	89
PID 704 wrote to memory of 1872	704	._cache_1d854192e5aac93a950c60e013a8f08283ad81f841dd90da9326198f37c8adda.exe	89
PID 1452 wrote to memory of 4548	1452	Synaptics.exe	91
PID 1452 wrote to memory of 4548	1452	Synaptics.exe	91
PID 1872 wrote to memory of 4088	1872	Runtime Broker.exe	95
PID 1872 wrote to memory of 4088	1872	Runtime Broker.exe	95
PID 4548 wrote to memory of 756	4548	._cache_Synaptics.exe	97
PID 4548 wrote to memory of 756	4548	._cache_Synaptics.exe	97
PID 4088 wrote to memory of 1440	4088	cmd.exe	100
PID 4088 wrote to memory of 1440	4088	cmd.exe	100
PID 756 wrote to memory of 4200	756	cmd.exe	101
PID 756 wrote to memory of 4200	756	cmd.exe	101
PID 4088 wrote to memory of 1156	4088	cmd.exe	106
PID 4088 wrote to memory of 1156	4088	cmd.exe	106
PID 756 wrote to memory of 2248	756	cmd.exe	107
PID 756 wrote to memory of 2248	756	cmd.exe	107
PID 1872 wrote to memory of 4656	1872	Runtime Broker.exe	108
PID 1872 wrote to memory of 4656	1872	Runtime Broker.exe	108
PID 4548 wrote to memory of 3284	4548	._cache_Synaptics.exe	109
PID 4548 wrote to memory of 3284	4548	._cache_Synaptics.exe	109
PID 3284 wrote to memory of 2496	3284	cmd.exe	112
PID 3284 wrote to memory of 2496	3284	cmd.exe	112
PID 4656 wrote to memory of 4336	4656	cmd.exe	113
PID 4656 wrote to memory of 4336	4656	cmd.exe	113
PID 3284 wrote to memory of 4376	3284	cmd.exe	114
PID 3284 wrote to memory of 4376	3284	cmd.exe	114
PID 4656 wrote to memory of 4352	4656	cmd.exe	115
PID 4656 wrote to memory of 4352	4656	cmd.exe	115
PID 4548 wrote to memory of 4424	4548	._cache_Synaptics.exe	116
PID 4548 wrote to memory of 4424	4548	._cache_Synaptics.exe	116
PID 1872 wrote to memory of 3756	1872	Runtime Broker.exe	117
PID 1872 wrote to memory of 3756	1872	Runtime Broker.exe	117
PID 4424 wrote to memory of 4480	4424	cmd.exe	121
PID 4424 wrote to memory of 4480	4424	cmd.exe	121
PID 3756 wrote to memory of 3916	3756	cmd.exe	120
PID 3756 wrote to memory of 3916	3756	cmd.exe	120

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\1d854192e5aac93a950c60e013a8f08283ad81f841dd90da9326198f37c8adda.exe
"C:\Users\Admin\AppData\Local\Temp\1d854192e5aac93a950c60e013a8f08283ad81f841dd90da9326198f37c8adda.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3460
- C:\Users\Admin\AppData\Local\Temp\._cache_1d854192e5aac93a950c60e013a8f08283ad81f841dd90da9326198f37c8adda.exe
  "C:\Users\Admin\AppData\Local\Temp\._cache_1d854192e5aac93a950c60e013a8f08283ad81f841dd90da9326198f37c8adda.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:704
- - C:\Users\Admin\AppData\Local\Runtime Broker.exe
    "C:\Users\Admin\AppData\Local\Runtime Broker.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Adds Run key to start application
    - Sets desktop wallpaper using registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1872
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4088
    - - C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        5⤵
        Interacts with shadow copies
        
        PID:1440
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic shadowcopy delete
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1156
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4656
    - - C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} bootstatuspolicy ignoreallfailures
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:4336
    - - C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled no
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:4352
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3756
    - - C:\Windows\system32\wbadmin.exe
        
        wbadmin delete catalog -quiet
        5⤵
        Deletes backup catalog
        
        PID:3916
- C:\ProgramData\Synaptics\Synaptics.exe
  "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1452
- - C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
    "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Adds Run key to start application
    - Sets desktop wallpaper using registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4548
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete
      4⤵
      Suspicious use of WriteProcessMemory
      PID:756
    - - C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        5⤵
        Interacts with shadow copies
        
        PID:4200
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic shadowcopy delete
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2248
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3284
    - - C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} bootstatuspolicy ignoreallfailures
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:2496
    - - C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled no
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:4376
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4424
    - - C:\Windows\system32\wbadmin.exe
        
        wbadmin delete catalog -quiet
        5⤵
        Deletes backup catalog
        
        PID:4480

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3380

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4460

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
PID:1292

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:4756

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Checks SCSI registry key(s)
PID:3644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery