darkcomet | 90609bc1ea530df6692c767ed364797cc03c1348fabc0b5ea244f8764c41b6f3

Processes:

10e976814722aec669c98ca54c27d9d6_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\svchost.exe"	10e976814722aec669c98ca54c27d9d6_JaffaCakes118.exe

Modifies security service 2 TTPs 1 IoCs
evasion

Modify Registry
T1112

Windows Service
T1543.003

Processes:

svchost.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" svchost.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	svchost.exe

Windows security bypass 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

Processes:

svchost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	svchost.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

10e976814722aec669c98ca54c27d9d6_JaffaCakes118.exesvchost.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	10e976814722aec669c98ca54c27d9d6_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

10e976814722aec669c98ca54c27d9d6_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Control Panel\International\Geo\Nation	10e976814722aec669c98ca54c27d9d6_JaffaCakes118.exe

Executes dropped EXE 3 IoCs

Processes:

svchost.exesvchost.exesvchost.exe

pid process

3132 svchost.exe
2156 svchost.exe
2624 svchost.exe

pid	process
3132	svchost.exe
2156	svchost.exe
2624	svchost.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

Processes:

svchost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	svchost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

Processes:

10e976814722aec669c98ca54c27d9d6_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\svchost.exe"	10e976814722aec669c98ca54c27d9d6_JaffaCakes118.exe

Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

Processes:

10e976814722aec669c98ca54c27d9d6_JaffaCakes118.exesvchost.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	10e976814722aec669c98ca54c27d9d6_JaffaCakes118.exe
File opened for modification	\??\PhysicalDrive0	svchost.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

10e976814722aec669c98ca54c27d9d6_JaffaCakes118.exe10e976814722aec669c98ca54c27d9d6_JaffaCakes118.exesvchost.exesvchost.exe

description	pid	process	target process
PID 2716 set thread context of 2804	2716	10e976814722aec669c98ca54c27d9d6_JaffaCakes118.exe	10e976814722aec669c98ca54c27d9d6_JaffaCakes118.exe
PID 2804 set thread context of 1768	2804	10e976814722aec669c98ca54c27d9d6_JaffaCakes118.exe	10e976814722aec669c98ca54c27d9d6_JaffaCakes118.exe
PID 3132 set thread context of 2156	3132	svchost.exe	svchost.exe
PID 2156 set thread context of 2624	2156	svchost.exe	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

svchost.exe10e976814722aec669c98ca54c27d9d6_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	svchost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	10e976814722aec669c98ca54c27d9d6_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	10e976814722aec669c98ca54c27d9d6_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	10e976814722aec669c98ca54c27d9d6_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	10e976814722aec669c98ca54c27d9d6_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	svchost.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

System Information Discovery

Processes:

10e976814722aec669c98ca54c27d9d6_JaffaCakes118.exesvchost.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	10e976814722aec669c98ca54c27d9d6_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	svchost.exe

Modifies registry class 1 IoCs

Processes:

10e976814722aec669c98ca54c27d9d6_JaffaCakes118.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	10e976814722aec669c98ca54c27d9d6_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

Processes:

10e976814722aec669c98ca54c27d9d6_JaffaCakes118.exesvchost.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	1768	10e976814722aec669c98ca54c27d9d6_JaffaCakes118.exe
Token: SeSecurityPrivilege	1768	10e976814722aec669c98ca54c27d9d6_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	1768	10e976814722aec669c98ca54c27d9d6_JaffaCakes118.exe
Token: SeLoadDriverPrivilege	1768	10e976814722aec669c98ca54c27d9d6_JaffaCakes118.exe
Token: SeSystemProfilePrivilege	1768	10e976814722aec669c98ca54c27d9d6_JaffaCakes118.exe
Token: SeSystemtimePrivilege	1768	10e976814722aec669c98ca54c27d9d6_JaffaCakes118.exe
Token: SeProfSingleProcessPrivilege	1768	10e976814722aec669c98ca54c27d9d6_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	1768	10e976814722aec669c98ca54c27d9d6_JaffaCakes118.exe
Token: SeCreatePagefilePrivilege	1768	10e976814722aec669c98ca54c27d9d6_JaffaCakes118.exe
Token: SeBackupPrivilege	1768	10e976814722aec669c98ca54c27d9d6_JaffaCakes118.exe
Token: SeRestorePrivilege	1768	10e976814722aec669c98ca54c27d9d6_JaffaCakes118.exe
Token: SeShutdownPrivilege	1768	10e976814722aec669c98ca54c27d9d6_JaffaCakes118.exe
Token: SeDebugPrivilege	1768	10e976814722aec669c98ca54c27d9d6_JaffaCakes118.exe
Token: SeSystemEnvironmentPrivilege	1768	10e976814722aec669c98ca54c27d9d6_JaffaCakes118.exe
Token: SeChangeNotifyPrivilege	1768	10e976814722aec669c98ca54c27d9d6_JaffaCakes118.exe
Token: SeRemoteShutdownPrivilege	1768	10e976814722aec669c98ca54c27d9d6_JaffaCakes118.exe
Token: SeUndockPrivilege	1768	10e976814722aec669c98ca54c27d9d6_JaffaCakes118.exe
Token: SeManageVolumePrivilege	1768	10e976814722aec669c98ca54c27d9d6_JaffaCakes118.exe
Token: SeImpersonatePrivilege	1768	10e976814722aec669c98ca54c27d9d6_JaffaCakes118.exe
Token: SeCreateGlobalPrivilege	1768	10e976814722aec669c98ca54c27d9d6_JaffaCakes118.exe
Token: 33	1768	10e976814722aec669c98ca54c27d9d6_JaffaCakes118.exe
Token: 34	1768	10e976814722aec669c98ca54c27d9d6_JaffaCakes118.exe
Token: 35	1768	10e976814722aec669c98ca54c27d9d6_JaffaCakes118.exe
Token: 36	1768	10e976814722aec669c98ca54c27d9d6_JaffaCakes118.exe
Token: SeIncreaseQuotaPrivilege	2624	svchost.exe
Token: SeSecurityPrivilege	2624	svchost.exe
Token: SeTakeOwnershipPrivilege	2624	svchost.exe
Token: SeLoadDriverPrivilege	2624	svchost.exe
Token: SeSystemProfilePrivilege	2624	svchost.exe
Token: SeSystemtimePrivilege	2624	svchost.exe
Token: SeProfSingleProcessPrivilege	2624	svchost.exe
Token: SeIncBasePriorityPrivilege	2624	svchost.exe
Token: SeCreatePagefilePrivilege	2624	svchost.exe
Token: SeBackupPrivilege	2624	svchost.exe
Token: SeRestorePrivilege	2624	svchost.exe
Token: SeShutdownPrivilege	2624	svchost.exe
Token: SeDebugPrivilege	2624	svchost.exe
Token: SeSystemEnvironmentPrivilege	2624	svchost.exe
Token: SeChangeNotifyPrivilege	2624	svchost.exe
Token: SeRemoteShutdownPrivilege	2624	svchost.exe
Token: SeUndockPrivilege	2624	svchost.exe
Token: SeManageVolumePrivilege	2624	svchost.exe
Token: SeImpersonatePrivilege	2624	svchost.exe
Token: SeCreateGlobalPrivilege	2624	svchost.exe
Token: 33	2624	svchost.exe
Token: 34	2624	svchost.exe
Token: 35	2624	svchost.exe
Token: 36	2624	svchost.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

10e976814722aec669c98ca54c27d9d6_JaffaCakes118.exe10e976814722aec669c98ca54c27d9d6_JaffaCakes118.exesvchost.exesvchost.exe

pid process

2716 10e976814722aec669c98ca54c27d9d6_JaffaCakes118.exe
2804 10e976814722aec669c98ca54c27d9d6_JaffaCakes118.exe
3132 svchost.exe
2156 svchost.exe

pid	process
2716	10e976814722aec669c98ca54c27d9d6_JaffaCakes118.exe
2804	10e976814722aec669c98ca54c27d9d6_JaffaCakes118.exe
3132	svchost.exe
2156	svchost.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

10e976814722aec669c98ca54c27d9d6_JaffaCakes118.exe10e976814722aec669c98ca54c27d9d6_JaffaCakes118.exe10e976814722aec669c98ca54c27d9d6_JaffaCakes118.exesvchost.exesvchost.exe

description	pid	process	target process
PID 2716 wrote to memory of 2804	2716	10e976814722aec669c98ca54c27d9d6_JaffaCakes118.exe	10e976814722aec669c98ca54c27d9d6_JaffaCakes118.exe
PID 2716 wrote to memory of 2804	2716	10e976814722aec669c98ca54c27d9d6_JaffaCakes118.exe	10e976814722aec669c98ca54c27d9d6_JaffaCakes118.exe
PID 2716 wrote to memory of 2804	2716	10e976814722aec669c98ca54c27d9d6_JaffaCakes118.exe	10e976814722aec669c98ca54c27d9d6_JaffaCakes118.exe
PID 2716 wrote to memory of 2804	2716	10e976814722aec669c98ca54c27d9d6_JaffaCakes118.exe	10e976814722aec669c98ca54c27d9d6_JaffaCakes118.exe
PID 2716 wrote to memory of 2804	2716	10e976814722aec669c98ca54c27d9d6_JaffaCakes118.exe	10e976814722aec669c98ca54c27d9d6_JaffaCakes118.exe
PID 2716 wrote to memory of 2804	2716	10e976814722aec669c98ca54c27d9d6_JaffaCakes118.exe	10e976814722aec669c98ca54c27d9d6_JaffaCakes118.exe
PID 2716 wrote to memory of 2804	2716	10e976814722aec669c98ca54c27d9d6_JaffaCakes118.exe	10e976814722aec669c98ca54c27d9d6_JaffaCakes118.exe
PID 2716 wrote to memory of 2804	2716	10e976814722aec669c98ca54c27d9d6_JaffaCakes118.exe	10e976814722aec669c98ca54c27d9d6_JaffaCakes118.exe
PID 2804 wrote to memory of 1768	2804	10e976814722aec669c98ca54c27d9d6_JaffaCakes118.exe	10e976814722aec669c98ca54c27d9d6_JaffaCakes118.exe
PID 2804 wrote to memory of 1768	2804	10e976814722aec669c98ca54c27d9d6_JaffaCakes118.exe	10e976814722aec669c98ca54c27d9d6_JaffaCakes118.exe
PID 2804 wrote to memory of 1768	2804	10e976814722aec669c98ca54c27d9d6_JaffaCakes118.exe	10e976814722aec669c98ca54c27d9d6_JaffaCakes118.exe
PID 2804 wrote to memory of 1768	2804	10e976814722aec669c98ca54c27d9d6_JaffaCakes118.exe	10e976814722aec669c98ca54c27d9d6_JaffaCakes118.exe
PID 2804 wrote to memory of 1768	2804	10e976814722aec669c98ca54c27d9d6_JaffaCakes118.exe	10e976814722aec669c98ca54c27d9d6_JaffaCakes118.exe
PID 2804 wrote to memory of 1768	2804	10e976814722aec669c98ca54c27d9d6_JaffaCakes118.exe	10e976814722aec669c98ca54c27d9d6_JaffaCakes118.exe
PID 2804 wrote to memory of 1768	2804	10e976814722aec669c98ca54c27d9d6_JaffaCakes118.exe	10e976814722aec669c98ca54c27d9d6_JaffaCakes118.exe
PID 2804 wrote to memory of 1768	2804	10e976814722aec669c98ca54c27d9d6_JaffaCakes118.exe	10e976814722aec669c98ca54c27d9d6_JaffaCakes118.exe
PID 2804 wrote to memory of 1768	2804	10e976814722aec669c98ca54c27d9d6_JaffaCakes118.exe	10e976814722aec669c98ca54c27d9d6_JaffaCakes118.exe
PID 2804 wrote to memory of 1768	2804	10e976814722aec669c98ca54c27d9d6_JaffaCakes118.exe	10e976814722aec669c98ca54c27d9d6_JaffaCakes118.exe
PID 2804 wrote to memory of 1768	2804	10e976814722aec669c98ca54c27d9d6_JaffaCakes118.exe	10e976814722aec669c98ca54c27d9d6_JaffaCakes118.exe
PID 2804 wrote to memory of 1768	2804	10e976814722aec669c98ca54c27d9d6_JaffaCakes118.exe	10e976814722aec669c98ca54c27d9d6_JaffaCakes118.exe
PID 2804 wrote to memory of 1768	2804	10e976814722aec669c98ca54c27d9d6_JaffaCakes118.exe	10e976814722aec669c98ca54c27d9d6_JaffaCakes118.exe
PID 2804 wrote to memory of 1768	2804	10e976814722aec669c98ca54c27d9d6_JaffaCakes118.exe	10e976814722aec669c98ca54c27d9d6_JaffaCakes118.exe
PID 1768 wrote to memory of 884	1768	10e976814722aec669c98ca54c27d9d6_JaffaCakes118.exe	explorer.exe
PID 1768 wrote to memory of 884	1768	10e976814722aec669c98ca54c27d9d6_JaffaCakes118.exe	explorer.exe
PID 1768 wrote to memory of 884	1768	10e976814722aec669c98ca54c27d9d6_JaffaCakes118.exe	explorer.exe
PID 1768 wrote to memory of 3132	1768	10e976814722aec669c98ca54c27d9d6_JaffaCakes118.exe	svchost.exe
PID 1768 wrote to memory of 3132	1768	10e976814722aec669c98ca54c27d9d6_JaffaCakes118.exe	svchost.exe
PID 1768 wrote to memory of 3132	1768	10e976814722aec669c98ca54c27d9d6_JaffaCakes118.exe	svchost.exe
PID 3132 wrote to memory of 2156	3132	svchost.exe	svchost.exe
PID 3132 wrote to memory of 2156	3132	svchost.exe	svchost.exe
PID 3132 wrote to memory of 2156	3132	svchost.exe	svchost.exe
PID 3132 wrote to memory of 2156	3132	svchost.exe	svchost.exe
PID 3132 wrote to memory of 2156	3132	svchost.exe	svchost.exe
PID 3132 wrote to memory of 2156	3132	svchost.exe	svchost.exe
PID 3132 wrote to memory of 2156	3132	svchost.exe	svchost.exe
PID 3132 wrote to memory of 2156	3132	svchost.exe	svchost.exe
PID 2156 wrote to memory of 2624	2156	svchost.exe	svchost.exe
PID 2156 wrote to memory of 2624	2156	svchost.exe	svchost.exe
PID 2156 wrote to memory of 2624	2156	svchost.exe	svchost.exe
PID 2156 wrote to memory of 2624	2156	svchost.exe	svchost.exe
PID 2156 wrote to memory of 2624	2156	svchost.exe	svchost.exe
PID 2156 wrote to memory of 2624	2156	svchost.exe	svchost.exe
PID 2156 wrote to memory of 2624	2156	svchost.exe	svchost.exe
PID 2156 wrote to memory of 2624	2156	svchost.exe	svchost.exe
PID 2156 wrote to memory of 2624	2156	svchost.exe	svchost.exe
PID 2156 wrote to memory of 2624	2156	svchost.exe	svchost.exe
PID 2156 wrote to memory of 2624	2156	svchost.exe	svchost.exe
PID 2156 wrote to memory of 2624	2156	svchost.exe	svchost.exe
PID 2156 wrote to memory of 2624	2156	svchost.exe	svchost.exe
PID 2156 wrote to memory of 2624	2156	svchost.exe	svchost.exe

System policy modification 1 TTPs 3 IoCs

evasion

Modify Registry

Processes:

svchost.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern\NoControlPanel = "1"	svchost.exe

C:\Users\Admin\AppData\Local\Temp\10e976814722aec669c98ca54c27d9d6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\10e976814722aec669c98ca54c27d9d6_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2716

C:\Users\Admin\AppData\Local\Temp\10e976814722aec669c98ca54c27d9d6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\10e976814722aec669c98ca54c27d9d6_JaffaCakes118.exe"
2⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2804

C:\Users\Admin\AppData\Local\Temp\10e976814722aec669c98ca54c27d9d6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\10e976814722aec669c98ca54c27d9d6_JaffaCakes118.exe"
3⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Checks computer location settings
- Adds Run key to start application
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1768

C:\Windows\SysWOW64\explorer.exe
"C:\Windows\SysWOW64\explorer.exe"
4⤵
PID:884

C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3132

C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
5⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2156

C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"
6⤵
- Modifies security service
- Windows security bypass
- Checks BIOS information in registry
- Executes dropped EXE
- Windows security modification
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:2624

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

6

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Query Registry

4

System Information Discovery

5