Boot or Logon Autostart Execution: Print Processors

Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/or privilege escalation.

Checks computer location settings

Looks up country code configured in the registry, likely geofence.

Credentials from Password Stores: Windows Credential Manager

Suspicious access to Credentials History.

Executes dropped EXE

Indicator Removal: Clear Windows Event Logs

Clear Windows Event Logs to hide the activity of an intrusion.

Loads dropped DLL

Reads user/profile data of web browsers

Infostealers often target stored browser data, which can include saved credentials etc.

Legitimate hosting services abused for malware hosting/C2

Drops autorun.inf file

Malware can abuse Windows Autorun to spread further via attached volumes.

Drops file in System32 directory

Modifies termsrv.dll

Commonly used to allow simultaneous RDP sessions.