Boot or Logon Autostart Execution: Print Processors

Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/or privilege escalation.

Checks BIOS information in registry

BIOS information is often read in order to detect sandboxing environments.

Checks computer location settings

Looks up country code configured in the registry, likely geofence.

Executes dropped EXE

Loads dropped DLL

Modifies file permissions

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

Adds Run key to start application

Checks installed software on the system

Looks up Uninstall key entries in the registry to enumerate software on the system.

Checks whether UAC is enabled

Drops desktop.ini file(s)

Legitimate hosting services abused for malware hosting/C2

Network Share Discovery

Attempt to gather information on host network.

Power Settings

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

Drops autorun.inf file

Malware can abuse Windows Autorun to spread further via attached volumes.

Drops file in System32 directory

Modifies termsrv.dll

Commonly used to allow simultaneous RDP sessions.