darkcomet | e4c9e8116827030fee7a80a2d2fbbadb2f0b0fc353dbe8833e57f7852ea86810

Processes:

service.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\MSDCSC\\msdcsc.exe"	service.exe

Modifies firewall policy service 3 TTPs 3 IoCs

evasion

Modify Registry

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

Processes:

msdcsc.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0"	msdcsc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	msdcsc.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	msdcsc.exe

Modifies security service 2 TTPs 1 IoCs
evasion

Modify Registry
T1112

Windows Service
T1543.003

Processes:

msdcsc.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" msdcsc.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	msdcsc.exe

Windows security bypass 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

Processes:

msdcsc.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	msdcsc.exe

Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exeattrib.exe

pid process

2124 attrib.exe
1548 attrib.exe

pid	process
2124	attrib.exe
1548	attrib.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

085a4a5430ccb482aaf5e1f428b2e035_JaffaCakes118.exeservice.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	085a4a5430ccb482aaf5e1f428b2e035_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	service.exe

Executes dropped EXE 8 IoCs

Processes:

service.exeservice.exeservice.exeSERVICES.EXEWINDOWSLOGIN.EXEmsdcsc.exemsdcsc.exemsdcsc.exe

pid process

384 service.exe
4864 service.exe
1768 service.exe
2352 SERVICES.EXE
224 WINDOWSLOGIN.EXE
2932 msdcsc.exe
4132 msdcsc.exe
4508 msdcsc.exe

pid	process
384	service.exe
4864	service.exe
1768	service.exe
2352	SERVICES.EXE
224	WINDOWSLOGIN.EXE
2932	msdcsc.exe
4132	msdcsc.exe
4508	msdcsc.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

Processes:

msdcsc.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	msdcsc.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

Processes:

reg.exeservice.exemsdcsc.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\service.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\MSDCSC\\msdcsc.exe"	service.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\MSDCSC\\msdcsc.exe"	msdcsc.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

service.exeservice.exemsdcsc.exemsdcsc.exe

description	pid	process	target process
PID 384 set thread context of 4864	384	service.exe	service.exe
PID 4864 set thread context of 1768	4864	service.exe	service.exe
PID 2932 set thread context of 4132	2932	msdcsc.exe	msdcsc.exe
PID 4132 set thread context of 4508	4132	msdcsc.exe	msdcsc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

dw20.exedw20.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

System Information Discovery

Processes:

dw20.exedw20.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

msdcsc.exe

pid process

4508 msdcsc.exe

pid	process
4508	msdcsc.exe

Suspicious use of AdjustPrivilegeToken 52 IoCs

Processes:

service.exedw20.exedw20.exemsdcsc.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	1768	service.exe
Token: SeSecurityPrivilege	1768	service.exe
Token: SeTakeOwnershipPrivilege	1768	service.exe
Token: SeLoadDriverPrivilege	1768	service.exe
Token: SeSystemProfilePrivilege	1768	service.exe
Token: SeSystemtimePrivilege	1768	service.exe
Token: SeProfSingleProcessPrivilege	1768	service.exe
Token: SeIncBasePriorityPrivilege	1768	service.exe
Token: SeCreatePagefilePrivilege	1768	service.exe
Token: SeBackupPrivilege	1768	service.exe
Token: SeRestorePrivilege	1768	service.exe
Token: SeShutdownPrivilege	1768	service.exe
Token: SeDebugPrivilege	1768	service.exe
Token: SeSystemEnvironmentPrivilege	1768	service.exe
Token: SeChangeNotifyPrivilege	1768	service.exe
Token: SeRemoteShutdownPrivilege	1768	service.exe
Token: SeUndockPrivilege	1768	service.exe
Token: SeManageVolumePrivilege	1768	service.exe
Token: SeImpersonatePrivilege	1768	service.exe
Token: SeCreateGlobalPrivilege	1768	service.exe
Token: 33	1768	service.exe
Token: 34	1768	service.exe
Token: 35	1768	service.exe
Token: 36	1768	service.exe
Token: SeBackupPrivilege	2440	dw20.exe
Token: SeBackupPrivilege	2440	dw20.exe
Token: SeBackupPrivilege	2428	dw20.exe
Token: SeBackupPrivilege	2428	dw20.exe
Token: SeIncreaseQuotaPrivilege	4508	msdcsc.exe
Token: SeSecurityPrivilege	4508	msdcsc.exe
Token: SeTakeOwnershipPrivilege	4508	msdcsc.exe
Token: SeLoadDriverPrivilege	4508	msdcsc.exe
Token: SeSystemProfilePrivilege	4508	msdcsc.exe
Token: SeSystemtimePrivilege	4508	msdcsc.exe
Token: SeProfSingleProcessPrivilege	4508	msdcsc.exe
Token: SeIncBasePriorityPrivilege	4508	msdcsc.exe
Token: SeCreatePagefilePrivilege	4508	msdcsc.exe
Token: SeBackupPrivilege	4508	msdcsc.exe
Token: SeRestorePrivilege	4508	msdcsc.exe
Token: SeShutdownPrivilege	4508	msdcsc.exe
Token: SeDebugPrivilege	4508	msdcsc.exe
Token: SeSystemEnvironmentPrivilege	4508	msdcsc.exe
Token: SeChangeNotifyPrivilege	4508	msdcsc.exe
Token: SeRemoteShutdownPrivilege	4508	msdcsc.exe
Token: SeUndockPrivilege	4508	msdcsc.exe
Token: SeManageVolumePrivilege	4508	msdcsc.exe
Token: SeImpersonatePrivilege	4508	msdcsc.exe
Token: SeCreateGlobalPrivilege	4508	msdcsc.exe
Token: 33	4508	msdcsc.exe
Token: 34	4508	msdcsc.exe
Token: 35	4508	msdcsc.exe
Token: 36	4508	msdcsc.exe

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

085a4a5430ccb482aaf5e1f428b2e035_JaffaCakes118.exeservice.exeservice.exemsdcsc.exemsdcsc.exemsdcsc.exe

pid process

4868 085a4a5430ccb482aaf5e1f428b2e035_JaffaCakes118.exe
384 service.exe
4864 service.exe
2932 msdcsc.exe
4132 msdcsc.exe
4508 msdcsc.exe

pid	process
4868	085a4a5430ccb482aaf5e1f428b2e035_JaffaCakes118.exe
384	service.exe
4864	service.exe
2932	msdcsc.exe
4132	msdcsc.exe
4508	msdcsc.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

085a4a5430ccb482aaf5e1f428b2e035_JaffaCakes118.execmd.exeservice.exeservice.exeservice.execmd.execmd.exemsdcsc.exeSERVICES.EXEWINDOWSLOGIN.EXEmsdcsc.exe

description	pid	process	target process
PID 4868 wrote to memory of 3456	4868	085a4a5430ccb482aaf5e1f428b2e035_JaffaCakes118.exe	cmd.exe
PID 4868 wrote to memory of 3456	4868	085a4a5430ccb482aaf5e1f428b2e035_JaffaCakes118.exe	cmd.exe
PID 4868 wrote to memory of 3456	4868	085a4a5430ccb482aaf5e1f428b2e035_JaffaCakes118.exe	cmd.exe
PID 3456 wrote to memory of 1052	3456	cmd.exe	reg.exe
PID 3456 wrote to memory of 1052	3456	cmd.exe	reg.exe
PID 3456 wrote to memory of 1052	3456	cmd.exe	reg.exe
PID 4868 wrote to memory of 384	4868	085a4a5430ccb482aaf5e1f428b2e035_JaffaCakes118.exe	service.exe
PID 4868 wrote to memory of 384	4868	085a4a5430ccb482aaf5e1f428b2e035_JaffaCakes118.exe	service.exe
PID 4868 wrote to memory of 384	4868	085a4a5430ccb482aaf5e1f428b2e035_JaffaCakes118.exe	service.exe
PID 384 wrote to memory of 4864	384	service.exe	service.exe
PID 384 wrote to memory of 4864	384	service.exe	service.exe
PID 384 wrote to memory of 4864	384	service.exe	service.exe
PID 384 wrote to memory of 4864	384	service.exe	service.exe
PID 384 wrote to memory of 4864	384	service.exe	service.exe
PID 384 wrote to memory of 4864	384	service.exe	service.exe
PID 384 wrote to memory of 4864	384	service.exe	service.exe
PID 384 wrote to memory of 4864	384	service.exe	service.exe
PID 4864 wrote to memory of 1768	4864	service.exe	service.exe
PID 4864 wrote to memory of 1768	4864	service.exe	service.exe
PID 4864 wrote to memory of 1768	4864	service.exe	service.exe
PID 4864 wrote to memory of 1768	4864	service.exe	service.exe
PID 4864 wrote to memory of 1768	4864	service.exe	service.exe
PID 4864 wrote to memory of 1768	4864	service.exe	service.exe
PID 4864 wrote to memory of 1768	4864	service.exe	service.exe
PID 4864 wrote to memory of 1768	4864	service.exe	service.exe
PID 4864 wrote to memory of 1768	4864	service.exe	service.exe
PID 4864 wrote to memory of 1768	4864	service.exe	service.exe
PID 4864 wrote to memory of 1768	4864	service.exe	service.exe
PID 4864 wrote to memory of 1768	4864	service.exe	service.exe
PID 4864 wrote to memory of 1768	4864	service.exe	service.exe
PID 4864 wrote to memory of 1768	4864	service.exe	service.exe
PID 1768 wrote to memory of 4232	1768	service.exe	cmd.exe
PID 1768 wrote to memory of 4232	1768	service.exe	cmd.exe
PID 1768 wrote to memory of 4232	1768	service.exe	cmd.exe
PID 1768 wrote to memory of 3056	1768	service.exe	cmd.exe
PID 1768 wrote to memory of 3056	1768	service.exe	cmd.exe
PID 1768 wrote to memory of 3056	1768	service.exe	cmd.exe
PID 1768 wrote to memory of 2352	1768	service.exe	SERVICES.EXE
PID 1768 wrote to memory of 2352	1768	service.exe	SERVICES.EXE
PID 4232 wrote to memory of 2124	4232	cmd.exe	attrib.exe
PID 4232 wrote to memory of 2124	4232	cmd.exe	attrib.exe
PID 4232 wrote to memory of 2124	4232	cmd.exe	attrib.exe
PID 1768 wrote to memory of 224	1768	service.exe	WINDOWSLOGIN.EXE
PID 1768 wrote to memory of 224	1768	service.exe	WINDOWSLOGIN.EXE
PID 3056 wrote to memory of 1548	3056	cmd.exe	attrib.exe
PID 3056 wrote to memory of 1548	3056	cmd.exe	attrib.exe
PID 3056 wrote to memory of 1548	3056	cmd.exe	attrib.exe
PID 1768 wrote to memory of 2932	1768	service.exe	msdcsc.exe
PID 1768 wrote to memory of 2932	1768	service.exe	msdcsc.exe
PID 1768 wrote to memory of 2932	1768	service.exe	msdcsc.exe
PID 2932 wrote to memory of 4132	2932	msdcsc.exe	msdcsc.exe
PID 2932 wrote to memory of 4132	2932	msdcsc.exe	msdcsc.exe
PID 2932 wrote to memory of 4132	2932	msdcsc.exe	msdcsc.exe
PID 2932 wrote to memory of 4132	2932	msdcsc.exe	msdcsc.exe
PID 2932 wrote to memory of 4132	2932	msdcsc.exe	msdcsc.exe
PID 2932 wrote to memory of 4132	2932	msdcsc.exe	msdcsc.exe
PID 2932 wrote to memory of 4132	2932	msdcsc.exe	msdcsc.exe
PID 2932 wrote to memory of 4132	2932	msdcsc.exe	msdcsc.exe
PID 2352 wrote to memory of 2428	2352	SERVICES.EXE	dw20.exe
PID 2352 wrote to memory of 2428	2352	SERVICES.EXE	dw20.exe
PID 224 wrote to memory of 2440	224	WINDOWSLOGIN.EXE	dw20.exe
PID 224 wrote to memory of 2440	224	WINDOWSLOGIN.EXE	dw20.exe
PID 4132 wrote to memory of 4508	4132	msdcsc.exe	msdcsc.exe
PID 4132 wrote to memory of 4508	4132	msdcsc.exe	msdcsc.exe

System policy modification 1 TTPs 3 IoCs

evasion

Modify Registry

Processes:

msdcsc.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion	msdcsc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern\NoControlPanel = "1"	msdcsc.exe

Views/modifies file attributes 1 TTPs 2 IoCs
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exeattrib.exe

pid process

2124 attrib.exe
1548 attrib.exe

pid	process
2124	attrib.exe
1548	attrib.exe

C:\Users\Admin\AppData\Local\Temp\085a4a5430ccb482aaf5e1f428b2e035_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\085a4a5430ccb482aaf5e1f428b2e035_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4868

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\240646406.bat" "
2⤵
- Suspicious use of WriteProcessMemory
PID:3456

C:\Windows\SysWOW64\reg.exe
REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Microsoft" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\service.exe" /f
3⤵
- Adds Run key to start application
PID:1052

C:\Users\Admin\AppData\Roaming\Microsoft\service.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\service.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:384

C:\Users\Admin\AppData\Roaming\Microsoft\service.exe
C:\Users\Admin\AppData\Roaming\Microsoft\service.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4864

C:\Users\Admin\AppData\Roaming\Microsoft\service.exe
4⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1768

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
5⤵
- Suspicious use of WriteProcessMemory
PID:4232

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Users\Admin\AppData\Roaming\Microsoft" +s +h
6⤵
- Sets file to hidden
- Views/modifies file attributes
PID:2124

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
5⤵
- Suspicious use of WriteProcessMemory
PID:3056

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Users\Admin\AppData\Roaming\Microsoft" +s +h
6⤵
- Sets file to hidden
- Views/modifies file attributes
PID:1548

C:\Users\Admin\AppData\Local\Temp\SERVICES.EXE
"C:\Users\Admin\AppData\Local\Temp\SERVICES.EXE"
5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
dw20.exe -x -s 1448
6⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:2428

C:\Users\Admin\AppData\Local\Temp\WINDOWSLOGIN.EXE
"C:\Users\Admin\AppData\Local\Temp\WINDOWSLOGIN.EXE"
5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:224

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
dw20.exe -x -s 1432
6⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:2440

C:\MSDCSC\msdcsc.exe
"C:\MSDCSC\msdcsc.exe"
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2932

C:\MSDCSC\msdcsc.exe
C:\MSDCSC\msdcsc.exe
6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4132

C:\MSDCSC\msdcsc.exe
7⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:4508

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4000 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:8
1⤵
PID:4828

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

7

Impair Defenses

3

T1562

Disable or Modify Tools

T1562.001

Disable or Modify System Firewall

T1562.004

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Query Registry

3

System Information Discovery

4