Checks BIOS information in registry

BIOS information is often read in order to detect sandboxing environments.

Executes dropped EXE

Reads user/profile data of web browsers

Infostealers often target stored browser data, which can include saved credentials etc.

Adds Run key to start application

Drops desktop.ini file(s)

Obfuscated Files or Information: Command Obfuscation

Adversaries may obfuscate content during command execution to impede detection.

Discovers running processes

Running process information can be used to identify security tools or plan follow-on actions.

Suspicious use of NtSetInformationThreadHideFromDebugger