Event Triggered Execution: Component Object Model Hijacking

Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

Loads dropped DLL

Checks whether UAC is enabled

Command and Scripting Interpreter: PowerShell

Using powershell.exe command.

Contacts third-party web service commonly abused for C2

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Enumerates connected drives

Attempts to read the root path of hard drives other than the default C: drive.

Indicator Removal: File Deletion

Adversaries may delete files left behind by the actions of their intrusion activity.

Obfuscated Files or Information: Command Obfuscation

Adversaries may obfuscate content during command execution to impede detection.

Power Settings

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.