phorphiex | 1f2e9724dfb091059ae16c305601e21d64b5308df76ddef6b394573e576ef1ff

Windows Service

T1543.003

Processes:

sysvplervcs.exesysvplervcs.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	sysvplervcs.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	sysvplervcs.exe

Phorphiex payload 1 IoCs

Processes:

resource	yara_rule
C:\Windows\sysvplervcs.exe	family_phorphiex

Phorphiex, Phorpiex
Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
worm trojan loader phorphiex

Windows security bypass 2 TTPs 12 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

Processes:

sysvplervcs.exesysvplervcs.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysvplervcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysvplervcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysvplervcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysvplervcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysvplervcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysvplervcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysvplervcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysvplervcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysvplervcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysvplervcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysvplervcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysvplervcs.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exe

pid process

4356 powershell.exe
3580 powershell.exe
Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

pid	process
4356	powershell.exe
3580	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

sysvplervcs.exesysvplervcs.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	sysvplervcs.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	sysvplervcs.exe

Executes dropped EXE 3 IoCs

Processes:

sysvplervcs.exe194991000.exesysvplervcs.exe

pid process

888 sysvplervcs.exe
3088 194991000.exe
4804 sysvplervcs.exe

pid	process
888	sysvplervcs.exe
3088	194991000.exe
4804	sysvplervcs.exe

Windows security modification 2 TTPs 14 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

Processes:

sysvplervcs.exesysvplervcs.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysvplervcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysvplervcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysvplervcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1"	sysvplervcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysvplervcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1"	sysvplervcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysvplervcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysvplervcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysvplervcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysvplervcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysvplervcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysvplervcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysvplervcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysvplervcs.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

Processes:

1F2E9724DFB091059AE16C305601E21D64B5308DF76DDEF6B394573E576EF1FF.exe194991000.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sysvplervcs.exe"	1F2E9724DFB091059AE16C305601E21D64B5308DF76DDEF6B394573E576EF1FF.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Users\\Admin\\sysvplervcs.exe"	194991000.exe

Drops file in Windows directory 3 IoCs

Processes:

1F2E9724DFB091059AE16C305601E21D64B5308DF76DDEF6B394573E576EF1FF.exe194991000.exe

description	ioc	process
File created	C:\Windows\sysvplervcs.exe	1F2E9724DFB091059AE16C305601E21D64B5308DF76DDEF6B394573E576EF1FF.exe
File opened for modification	C:\Windows\sysvplervcs.exe	1F2E9724DFB091059AE16C305601E21D64B5308DF76DDEF6B394573E576EF1FF.exe
File created	C:\Windows\sysvplervcs.exe	194991000.exe

Launches sc.exe 10 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exe

pid process

3928 sc.exe
3336 sc.exe
748 sc.exe
1336 sc.exe
2320 sc.exe
1980 sc.exe
4948 sc.exe
3588 sc.exe
1764 sc.exe
2708 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
3928	sc.exe
3336	sc.exe
748	sc.exe
1336	sc.exe
2320	sc.exe
1980	sc.exe
4948	sc.exe
3588	sc.exe
1764	sc.exe
2708	sc.exe

System Location Discovery: System Language Discovery 1 TTPs 20 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

cmd.exesc.exesc.execmd.exesc.execmd.exesysvplervcs.exesysvplervcs.exesc.exesc.exesc.exesc.exesc.exe194991000.exe1F2E9724DFB091059AE16C305601E21D64B5308DF76DDEF6B394573E576EF1FF.execmd.exepowershell.exepowershell.exesc.exesc.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sysvplervcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sysvplervcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	194991000.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1F2E9724DFB091059AE16C305601E21D64B5308DF76DDEF6B394573E576EF1FF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

powershell.exepowershell.exe

pid process

4356 powershell.exe
4356 powershell.exe
3580 powershell.exe
3580 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 4356 powershell.exe
Token: SeDebugPrivilege 3580 powershell.exe

pid	process
4356	powershell.exe
4356	powershell.exe
3580	powershell.exe
3580	powershell.exe

description	pid	process
Token: SeDebugPrivilege	4356	powershell.exe
Token: SeDebugPrivilege	3580	powershell.exe

Suspicious use of WriteProcessMemory 57 IoCs

Processes:

1F2E9724DFB091059AE16C305601E21D64B5308DF76DDEF6B394573E576EF1FF.exesysvplervcs.execmd.execmd.exe194991000.exesysvplervcs.execmd.execmd.exe

description	pid	process	target process
PID 264 wrote to memory of 888	264	1F2E9724DFB091059AE16C305601E21D64B5308DF76DDEF6B394573E576EF1FF.exe	sysvplervcs.exe
PID 264 wrote to memory of 888	264	1F2E9724DFB091059AE16C305601E21D64B5308DF76DDEF6B394573E576EF1FF.exe	sysvplervcs.exe
PID 264 wrote to memory of 888	264	1F2E9724DFB091059AE16C305601E21D64B5308DF76DDEF6B394573E576EF1FF.exe	sysvplervcs.exe
PID 888 wrote to memory of 2776	888	sysvplervcs.exe	cmd.exe
PID 888 wrote to memory of 2776	888	sysvplervcs.exe	cmd.exe
PID 888 wrote to memory of 2776	888	sysvplervcs.exe	cmd.exe
PID 888 wrote to memory of 2104	888	sysvplervcs.exe	cmd.exe
PID 888 wrote to memory of 2104	888	sysvplervcs.exe	cmd.exe
PID 888 wrote to memory of 2104	888	sysvplervcs.exe	cmd.exe
PID 2776 wrote to memory of 4356	2776	cmd.exe	powershell.exe
PID 2776 wrote to memory of 4356	2776	cmd.exe	powershell.exe
PID 2776 wrote to memory of 4356	2776	cmd.exe	powershell.exe
PID 2104 wrote to memory of 1980	2104	cmd.exe	sc.exe
PID 2104 wrote to memory of 1980	2104	cmd.exe	sc.exe
PID 2104 wrote to memory of 1980	2104	cmd.exe	sc.exe
PID 2104 wrote to memory of 3928	2104	cmd.exe	sc.exe
PID 2104 wrote to memory of 3928	2104	cmd.exe	sc.exe
PID 2104 wrote to memory of 3928	2104	cmd.exe	sc.exe
PID 2104 wrote to memory of 4948	2104	cmd.exe	sc.exe
PID 2104 wrote to memory of 4948	2104	cmd.exe	sc.exe
PID 2104 wrote to memory of 4948	2104	cmd.exe	sc.exe
PID 2104 wrote to memory of 3336	2104	cmd.exe	sc.exe
PID 2104 wrote to memory of 3336	2104	cmd.exe	sc.exe
PID 2104 wrote to memory of 3336	2104	cmd.exe	sc.exe
PID 2104 wrote to memory of 3588	2104	cmd.exe	sc.exe
PID 2104 wrote to memory of 3588	2104	cmd.exe	sc.exe
PID 2104 wrote to memory of 3588	2104	cmd.exe	sc.exe
PID 888 wrote to memory of 3088	888	sysvplervcs.exe	194991000.exe
PID 888 wrote to memory of 3088	888	sysvplervcs.exe	194991000.exe
PID 888 wrote to memory of 3088	888	sysvplervcs.exe	194991000.exe
PID 3088 wrote to memory of 4804	3088	194991000.exe	sysvplervcs.exe
PID 3088 wrote to memory of 4804	3088	194991000.exe	sysvplervcs.exe
PID 3088 wrote to memory of 4804	3088	194991000.exe	sysvplervcs.exe
PID 4804 wrote to memory of 4764	4804	sysvplervcs.exe	cmd.exe
PID 4804 wrote to memory of 4764	4804	sysvplervcs.exe	cmd.exe
PID 4804 wrote to memory of 4764	4804	sysvplervcs.exe	cmd.exe
PID 4804 wrote to memory of 4796	4804	sysvplervcs.exe	cmd.exe
PID 4804 wrote to memory of 4796	4804	sysvplervcs.exe	cmd.exe
PID 4804 wrote to memory of 4796	4804	sysvplervcs.exe	cmd.exe
PID 4764 wrote to memory of 3580	4764	cmd.exe	powershell.exe
PID 4764 wrote to memory of 3580	4764	cmd.exe	powershell.exe
PID 4764 wrote to memory of 3580	4764	cmd.exe	powershell.exe
PID 4796 wrote to memory of 1764	4796	cmd.exe	sc.exe
PID 4796 wrote to memory of 1764	4796	cmd.exe	sc.exe
PID 4796 wrote to memory of 1764	4796	cmd.exe	sc.exe
PID 4796 wrote to memory of 2708	4796	cmd.exe	sc.exe
PID 4796 wrote to memory of 2708	4796	cmd.exe	sc.exe
PID 4796 wrote to memory of 2708	4796	cmd.exe	sc.exe
PID 4796 wrote to memory of 748	4796	cmd.exe	sc.exe
PID 4796 wrote to memory of 748	4796	cmd.exe	sc.exe
PID 4796 wrote to memory of 748	4796	cmd.exe	sc.exe
PID 4796 wrote to memory of 2320	4796	cmd.exe	sc.exe
PID 4796 wrote to memory of 2320	4796	cmd.exe	sc.exe
PID 4796 wrote to memory of 2320	4796	cmd.exe	sc.exe
PID 4796 wrote to memory of 1336	4796	cmd.exe	sc.exe
PID 4796 wrote to memory of 1336	4796	cmd.exe	sc.exe
PID 4796 wrote to memory of 1336	4796	cmd.exe	sc.exe

C:\Users\Admin\AppData\Local\Temp\1F2E9724DFB091059AE16C305601E21D64B5308DF76DDEF6B394573E576EF1FF.exe
"C:\Users\Admin\AppData\Local\Temp\1F2E9724DFB091059AE16C305601E21D64B5308DF76DDEF6B394573E576EF1FF.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:264

C:\Windows\sysvplervcs.exe
C:\Windows\sysvplervcs.exe
2⤵
- Modifies security service
- Windows security bypass
- Checks computer location settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:888

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2776

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
4⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4356

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS /wait
3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2104

C:\Windows\SysWOW64\sc.exe
sc stop UsoSvc
4⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:1980

C:\Windows\SysWOW64\sc.exe
sc stop WaaSMedicSvc
4⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:3928

C:\Windows\SysWOW64\sc.exe
sc stop wuauserv
4⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:4948

C:\Windows\SysWOW64\sc.exe
sc stop DoSvc
4⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:3336

C:\Windows\SysWOW64\sc.exe
sc stop BITS /wait
4⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:3588

C:\Users\Admin\AppData\Local\Temp\194991000.exe
C:\Users\Admin\AppData\Local\Temp\194991000.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3088

C:\Users\Admin\sysvplervcs.exe
C:\Users\Admin\sysvplervcs.exe
4⤵
- Modifies security service
- Windows security bypass
- Checks computer location settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4804

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4764

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
6⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3580

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS /wait
5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4796

C:\Windows\SysWOW64\sc.exe
sc stop UsoSvc
6⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:1764

C:\Windows\SysWOW64\sc.exe
sc stop WaaSMedicSvc
6⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2708

C:\Windows\SysWOW64\sc.exe
sc stop wuauserv
6⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:748

C:\Windows\SysWOW64\sc.exe
sc stop DoSvc
6⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2320

C:\Windows\SysWOW64\sc.exe
sc stop BITS /wait
6⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:1336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

3

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop