Loads dropped DLL

Command and Scripting Interpreter: PowerShell

Using powershell.exe command.

Password Policy Discovery

Attempt to access detailed information about the password policy used within an enterprise network.

Power Settings

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

Writes to the Master Boot Record (MBR)

Bootkits write to the MBR to gain persistence at a level below the operating system.

Discovers running processes

Running process information can be used to identify security tools or plan follow-on actions.

Executes a VBScript file via the Windows Script Host.

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.