Executes dropped EXE

Prevents Microsoft Defender from scanning certain paths by adding an exclusion.

Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.

Hide Artifacts: Hidden Window

Windows that would typically be displayed when an application carries out an operation can be hidden.

Indicator Removal: Clear Persistence

Clear artifacts associated with previously established persistence like scheduletasks on a host.

Writes to the Master Boot Record (MBR)

Bootkits write to the MBR to gain persistence at a level below the operating system.

Hide Artifacts: Hidden Files and Directories