amadey | 1bca90670ea01a05472c06449066d4a8ba53619a22b1ab993efe27e7326d0f9d

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	1bca90670ea01a05472c06449066d4a8ba53619a22b1ab993efe27e7326d0f9d.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	1bca90670ea01a05472c06449066d4a8ba53619a22b1ab993efe27e7326d0f9d.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	1bca90670ea01a05472c06449066d4a8ba53619a22b1ab993efe27e7326d0f9d.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MindLynx.url	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MindLynx.url	cmd.exe

Executes dropped EXE 10 IoCs

pid	Process
2732	axplong.exe
2576	GOLD.exe
3016	crypteda.exe
2412	newalp.exe
1684	Hkbsse.exe
2320	06082025.exe
2084	stealc_default.exe
3032	runtime.exe
1368	MYNEWRDX.exe
2808	Beijing.pif

Identifies Wine through registry keys 2 TTPs 2 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Wine	1bca90670ea01a05472c06449066d4a8ba53619a22b1ab993efe27e7326d0f9d.exe
Key opened	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Wine	axplong.exe

Loads dropped DLL 21 IoCs

pid	Process
2488	1bca90670ea01a05472c06449066d4a8ba53619a22b1ab993efe27e7326d0f9d.exe
2732	axplong.exe
2732	axplong.exe
2628	WerFault.exe
2628	WerFault.exe
2628	WerFault.exe
2732	axplong.exe
2732	axplong.exe
2732	axplong.exe
2412	newalp.exe
2732	axplong.exe
904	WerFault.exe
904	WerFault.exe
904	WerFault.exe
2732	axplong.exe
2732	axplong.exe
2732	axplong.exe
2732	axplong.exe
2972	cmd.exe
2084	stealc_default.exe
2084	stealc_default.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
2712	tasklist.exe
2300	tasklist.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2488	1bca90670ea01a05472c06449066d4a8ba53619a22b1ab993efe27e7326d0f9d.exe
2732	axplong.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\ExplorerProprietary	runtime.exe
File created	C:\Windows\Tasks\Hkbsse.job	newalp.exe
File opened for modification	C:\Windows\EquationExplorer	runtime.exe
File opened for modification	C:\Windows\SysOrleans	runtime.exe
File opened for modification	C:\Windows\HostelGalleries	runtime.exe
File created	C:\Windows\Tasks\axplong.job	1bca90670ea01a05472c06449066d4a8ba53619a22b1ab993efe27e7326d0f9d.exe
File opened for modification	C:\Windows\ChestAntique	runtime.exe
File opened for modification	C:\Windows\TreeProfessor	runtime.exe
File opened for modification	C:\Windows\ConfiguringUps	runtime.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2628	2576	WerFault.exe	29
904	3016	WerFault.exe	33

System Location Discovery: System Language Discovery 1 TTPs 23 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axplong.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GOLD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	06082025.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	stealc_default.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Beijing.pif
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1bca90670ea01a05472c06449066d4a8ba53619a22b1ab993efe27e7326d0f9d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	newalp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	crypteda.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hkbsse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	runtime.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MYNEWRDX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	stealc_default.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	stealc_default.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
1568	schtasks.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
2488	1bca90670ea01a05472c06449066d4a8ba53619a22b1ab993efe27e7326d0f9d.exe
2732	axplong.exe
2084	stealc_default.exe
2808	Beijing.pif
2808	Beijing.pif
2808	Beijing.pif
2808	Beijing.pif
2808	Beijing.pif
2808	Beijing.pif
2808	Beijing.pif
2808	Beijing.pif
2808	Beijing.pif
2808	Beijing.pif
2808	Beijing.pif
2808	Beijing.pif
2808	Beijing.pif
2808	Beijing.pif
2808	Beijing.pif
2808	Beijing.pif
2808	Beijing.pif
2808	Beijing.pif
2084	stealc_default.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2300	tasklist.exe
Token: SeDebugPrivilege	2712	tasklist.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
2488	1bca90670ea01a05472c06449066d4a8ba53619a22b1ab993efe27e7326d0f9d.exe
2412	newalp.exe
2808	Beijing.pif
2808	Beijing.pif
2808	Beijing.pif

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2808	Beijing.pif
2808	Beijing.pif
2808	Beijing.pif

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2488 wrote to memory of 2732	2488	1bca90670ea01a05472c06449066d4a8ba53619a22b1ab993efe27e7326d0f9d.exe	28
PID 2488 wrote to memory of 2732	2488	1bca90670ea01a05472c06449066d4a8ba53619a22b1ab993efe27e7326d0f9d.exe	28
PID 2488 wrote to memory of 2732	2488	1bca90670ea01a05472c06449066d4a8ba53619a22b1ab993efe27e7326d0f9d.exe	28
PID 2488 wrote to memory of 2732	2488	1bca90670ea01a05472c06449066d4a8ba53619a22b1ab993efe27e7326d0f9d.exe	28
PID 2732 wrote to memory of 2576	2732	axplong.exe	29
PID 2732 wrote to memory of 2576	2732	axplong.exe	29
PID 2732 wrote to memory of 2576	2732	axplong.exe	29
PID 2732 wrote to memory of 2576	2732	axplong.exe	29
PID 2576 wrote to memory of 2628	2576	GOLD.exe	32
PID 2576 wrote to memory of 2628	2576	GOLD.exe	32
PID 2576 wrote to memory of 2628	2576	GOLD.exe	32
PID 2576 wrote to memory of 2628	2576	GOLD.exe	32
PID 2732 wrote to memory of 3016	2732	axplong.exe	33
PID 2732 wrote to memory of 3016	2732	axplong.exe	33
PID 2732 wrote to memory of 3016	2732	axplong.exe	33
PID 2732 wrote to memory of 3016	2732	axplong.exe	33
PID 2732 wrote to memory of 2412	2732	axplong.exe	35
PID 2732 wrote to memory of 2412	2732	axplong.exe	35
PID 2732 wrote to memory of 2412	2732	axplong.exe	35
PID 2732 wrote to memory of 2412	2732	axplong.exe	35
PID 2412 wrote to memory of 1684	2412	newalp.exe	36
PID 2412 wrote to memory of 1684	2412	newalp.exe	36
PID 2412 wrote to memory of 1684	2412	newalp.exe	36
PID 2412 wrote to memory of 1684	2412	newalp.exe	36
PID 2732 wrote to memory of 2320	2732	axplong.exe	37
PID 2732 wrote to memory of 2320	2732	axplong.exe	37
PID 2732 wrote to memory of 2320	2732	axplong.exe	37
PID 2732 wrote to memory of 2320	2732	axplong.exe	37
PID 3016 wrote to memory of 904	3016	crypteda.exe	38
PID 3016 wrote to memory of 904	3016	crypteda.exe	38
PID 3016 wrote to memory of 904	3016	crypteda.exe	38
PID 3016 wrote to memory of 904	3016	crypteda.exe	38
PID 2732 wrote to memory of 2084	2732	axplong.exe	39
PID 2732 wrote to memory of 2084	2732	axplong.exe	39
PID 2732 wrote to memory of 2084	2732	axplong.exe	39
PID 2732 wrote to memory of 2084	2732	axplong.exe	39
PID 2732 wrote to memory of 3032	2732	axplong.exe	41
PID 2732 wrote to memory of 3032	2732	axplong.exe	41
PID 2732 wrote to memory of 3032	2732	axplong.exe	41
PID 2732 wrote to memory of 3032	2732	axplong.exe	41
PID 3032 wrote to memory of 2972	3032	runtime.exe	42
PID 3032 wrote to memory of 2972	3032	runtime.exe	42
PID 3032 wrote to memory of 2972	3032	runtime.exe	42
PID 3032 wrote to memory of 2972	3032	runtime.exe	42
PID 2732 wrote to memory of 1368	2732	axplong.exe	44
PID 2732 wrote to memory of 1368	2732	axplong.exe	44
PID 2732 wrote to memory of 1368	2732	axplong.exe	44
PID 2732 wrote to memory of 1368	2732	axplong.exe	44
PID 2972 wrote to memory of 2300	2972	cmd.exe	45
PID 2972 wrote to memory of 2300	2972	cmd.exe	45
PID 2972 wrote to memory of 2300	2972	cmd.exe	45
PID 2972 wrote to memory of 2300	2972	cmd.exe	45
PID 2972 wrote to memory of 2324	2972	cmd.exe	46
PID 2972 wrote to memory of 2324	2972	cmd.exe	46
PID 2972 wrote to memory of 2324	2972	cmd.exe	46
PID 2972 wrote to memory of 2324	2972	cmd.exe	46
PID 2972 wrote to memory of 2712	2972	cmd.exe	48
PID 2972 wrote to memory of 2712	2972	cmd.exe	48
PID 2972 wrote to memory of 2712	2972	cmd.exe	48
PID 2972 wrote to memory of 2712	2972	cmd.exe	48
PID 2972 wrote to memory of 2676	2972	cmd.exe	49
PID 2972 wrote to memory of 2676	2972	cmd.exe	49
PID 2972 wrote to memory of 2676	2972	cmd.exe	49
PID 2972 wrote to memory of 2676	2972	cmd.exe	49

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1208
- C:\Users\Admin\AppData\Local\Temp\1bca90670ea01a05472c06449066d4a8ba53619a22b1ab993efe27e7326d0f9d.exe
  "C:\Users\Admin\AppData\Local\Temp\1bca90670ea01a05472c06449066d4a8ba53619a22b1ab993efe27e7326d0f9d.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Identifies Wine through registry keys
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2488
- - C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
    "C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Loads dropped DLL
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2732
  - - C:\Users\Admin\AppData\Local\Temp\1000002001\GOLD.exe
      "C:\Users\Admin\AppData\Local\Temp\1000002001\GOLD.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2576
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2576 -s 64
        5⤵
        Loads dropped DLL
        Program crash
        
        PID:2628
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3016
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3016 -s 64
        5⤵
        Loads dropped DLL
        Program crash
        
        PID:904
  - - C:\Users\Admin\AppData\Local\Temp\1000005001\newalp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000005001\newalp.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:2412
    - - C:\Users\Admin\AppData\Local\Temp\0ae19c9b3d\Hkbsse.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0ae19c9b3d\Hkbsse.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1684
  - - C:\Users\Admin\AppData\Local\Temp\1000050001\06082025.exe
      "C:\Users\Admin\AppData\Local\Temp\1000050001\06082025.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2320
  - - C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default.exe
      "C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      PID:2084
  - - C:\Users\Admin\AppData\Local\Temp\1000110001\runtime.exe
      "C:\Users\Admin\AppData\Local\Temp\1000110001\runtime.exe"
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3032
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k move Continues Continues.cmd & Continues.cmd & exit
        5⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2972
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:2300
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "wrsa.exe opssvc.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2324
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:2712
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "avastui.exe avgui.exe bdservicehost.exe ekrn.exe nswscsvc.exe sophoshealth.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2676
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c md 40365
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2648
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V "HopeBuildersGeniusIslam" Sonic
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3004
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b ..\Mr + ..\Minister + ..\Template + ..\Dietary + ..\Speak + ..\Mobile + ..\Zinc + ..\Continue s
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1892
      - C:\Users\Admin\AppData\Local\Temp\40365\Beijing.pif
        
        Beijing.pif s
        6⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2808
      - C:\Windows\SysWOW64\choice.exe
        
        choice /d y /t 5
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:560
  - - C:\Users\Admin\AppData\Local\Temp\1000112001\MYNEWRDX.exe
      "C:\Users\Admin\AppData\Local\Temp\1000112001\MYNEWRDX.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1368
- C:\Windows\SysWOW64\cmd.exe
  cmd /c schtasks.exe /create /tn "Invitations" /tr "wscript //B 'C:\Users\Admin\AppData\Local\NeuraMind Innovations\MindLynx.js'" /sc minute /mo 5 /F
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2876
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /create /tn "Invitations" /tr "wscript //B 'C:\Users\Admin\AppData\Local\NeuraMind Innovations\MindLynx.js'" /sc minute /mo 5 /F
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1568
- C:\Windows\SysWOW64\cmd.exe
  cmd /k echo [InternetShortcut] > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MindLynx.url" & echo URL="C:\Users\Admin\AppData\Local\NeuraMind Innovations\MindLynx.js" >> "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MindLynx.url" & exit
  2⤵
  - Drops startup file
  - System Location Discovery: System Language Discovery
  PID:1548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion