Drops startup file

Executes dropped EXE

Reads user/profile data of web browsers

Infostealers often target stored browser data, which can include saved credentials etc.

Stops running service(s)

Adds Run key to start application

Contacts third-party web service commonly abused for C2

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Creates a large amount of network flows

This may indicate a network scan to discover remotely running services.

Drops desktop.ini file(s)

Indicator Removal: Clear Persistence

Clear artifacts associated with previously established persistence like scheduletasks on a host.

Indicator Removal: File Deletion

Adversaries may delete files left behind by the actions of their intrusion activity.

Power Settings

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

Creates a new local user account

Uses net.exe to create a new local user account, often for persistence or a backdoor account.