Checks BIOS information in registry

BIOS information is often read in order to detect sandboxing environments.

Modifies file permissions

Command and Scripting Interpreter: PowerShell

Using powershell.exe command.

File and Directory Permissions Modification: Windows File and Directory Permissions Modification

Maps connected drives based on registry

Disk information is often read in order to detect sandboxing environments.

Remote Services: SMB/Windows Admin Shares

Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB).