Modifies WinLogon for persistence

Wipelock

Wipelock is an Android trojan with multiple capabilities, such as wiping data, reading and sending SMS messages without the victim's knowledge.

Wipelock Android payload

Grants admin privileges

Uses net.exe to modify the user's privileges.

Remote Service Session Hijacking: RDP Hijacking

Adversaries may hijack a legitimate user's remote desktop session to move laterally within an environment.

Manipulates Digital Signatures

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

Modifies Windows Firewall

Office macro that triggers on suspicious action

Office document macro which triggers in special circumstances - often malicious.

Sets file to hidden

Modifies file attributes to stop it showing in Explorer etc.

Sets service image path in registry

Suspicious Office macro

Office document equipped with macros.