Checks BIOS information in registry

BIOS information is often read in order to detect sandboxing environments.

Creates a file in the Startup directory

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

Executes dropped EXE

Identifies Wine through registry keys

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

Adds Run key to start application

Discovers running processes

Running process information can be used to identify security tools or plan follow-on actions.

Suspicious use of NtSetInformationThreadHideFromDebugger