Executes dropped EXE

Prevents Microsoft Defender from scanning certain paths by adding an exclusion.

Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.

Drops desktop.ini file(s)

Enumerates connected drives

Attempts to read the root path of hard drives other than the default C: drive.

Hide Artifacts: Hidden Window

Windows that would typically be displayed when an application carries out an operation can be hidden.

Indicator Removal: Clear Persistence

Clear artifacts associated with previously established persistence like scheduletasks on a host.

Checks system information in the registry

System information is often read in order to detect sandboxing environments.

Hide Artifacts: Hidden Files and Directories