b19bfd2492d6af96ba02f9e9f247de6974b3cf16a8571d751f54a6ef5de2fe6a

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	2026-09-10_a3fc082593f45770dd02ef75833ac0f9_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	2026-09-10_a3fc082593f45770dd02ef75833ac0f9_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3536	powershell.exe
2792	powershell.exe
3808	powershell.exe
3572	powershell.exe
2120	powershell.exe
4540	powershell.exe
892	powershell.exe
2160	powershell.exe

Looks for VMWare Tools registry key 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

persistence privilege_escalation

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	2026-09-10_a3fc082593f45770dd02ef75833ac0f9_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	2026-09-10_a3fc082593f45770dd02ef75833ac0f9_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

Registry Run Keys / Startup Folder

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdater.exe	2026-09-10_a3fc082593f45770dd02ef75833ac0f9_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsUpdater = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-09-10_a3fc082593f45770dd02ef75833ac0f9_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe"	2026-09-10_a3fc082593f45770dd02ef75833ac0f9_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsUpdater = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-09-10_a3fc082593f45770dd02ef75833ac0f9_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe"	2026-09-10_a3fc082593f45770dd02ef75833ac0f9_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe

Looks up external IP address via web service 1 TTPs 7 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
49	api.ipify.org
60	api.ipify.org
67	api.ipify.org
5	api.ipify.org
6	api.ipify.org
16	checkip.amazonaws.com
17	checkip.amazonaws.com

Discovers running processes 1 TTPs 4 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
3392	tasklist.exe
1236	tasklist.exe
3028	tasklist.exe
1060	tasklist.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3260	cmd.exe
3472	cmd.exe
3896	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
2124	schtasks.exe
4384	schtasks.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
892	powershell.exe
892	powershell.exe
2160	powershell.exe
2160	powershell.exe
3536	powershell.exe
3536	powershell.exe
2792	powershell.exe
2792	powershell.exe
3808	powershell.exe
3808	powershell.exe
3572	powershell.exe
3572	powershell.exe
2120	powershell.exe
2120	powershell.exe
4540	powershell.exe
4540	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1060	tasklist.exe
Token: SeIncreaseQuotaPrivilege	928	wmic.exe
Token: SeSecurityPrivilege	928	wmic.exe
Token: SeTakeOwnershipPrivilege	928	wmic.exe
Token: SeLoadDriverPrivilege	928	wmic.exe
Token: SeSystemProfilePrivilege	928	wmic.exe
Token: SeSystemtimePrivilege	928	wmic.exe
Token: SeProfSingleProcessPrivilege	928	wmic.exe
Token: SeIncBasePriorityPrivilege	928	wmic.exe
Token: SeCreatePagefilePrivilege	928	wmic.exe
Token: SeBackupPrivilege	928	wmic.exe
Token: SeRestorePrivilege	928	wmic.exe
Token: SeShutdownPrivilege	928	wmic.exe
Token: SeDebugPrivilege	928	wmic.exe
Token: SeSystemEnvironmentPrivilege	928	wmic.exe
Token: SeRemoteShutdownPrivilege	928	wmic.exe
Token: SeUndockPrivilege	928	wmic.exe
Token: SeManageVolumePrivilege	928	wmic.exe
Token: 33	928	wmic.exe
Token: 34	928	wmic.exe
Token: 35	928	wmic.exe
Token: 36	928	wmic.exe
Token: SeIncreaseQuotaPrivilege	928	wmic.exe
Token: SeSecurityPrivilege	928	wmic.exe
Token: SeTakeOwnershipPrivilege	928	wmic.exe
Token: SeLoadDriverPrivilege	928	wmic.exe
Token: SeSystemProfilePrivilege	928	wmic.exe
Token: SeSystemtimePrivilege	928	wmic.exe
Token: SeProfSingleProcessPrivilege	928	wmic.exe
Token: SeIncBasePriorityPrivilege	928	wmic.exe
Token: SeCreatePagefilePrivilege	928	wmic.exe
Token: SeBackupPrivilege	928	wmic.exe
Token: SeRestorePrivilege	928	wmic.exe
Token: SeShutdownPrivilege	928	wmic.exe
Token: SeDebugPrivilege	928	wmic.exe
Token: SeSystemEnvironmentPrivilege	928	wmic.exe
Token: SeRemoteShutdownPrivilege	928	wmic.exe
Token: SeUndockPrivilege	928	wmic.exe
Token: SeManageVolumePrivilege	928	wmic.exe
Token: 33	928	wmic.exe
Token: 34	928	wmic.exe
Token: 35	928	wmic.exe
Token: 36	928	wmic.exe
Token: SeIncreaseQuotaPrivilege	2156	wmic.exe
Token: SeSecurityPrivilege	2156	wmic.exe
Token: SeTakeOwnershipPrivilege	2156	wmic.exe
Token: SeLoadDriverPrivilege	2156	wmic.exe
Token: SeSystemProfilePrivilege	2156	wmic.exe
Token: SeSystemtimePrivilege	2156	wmic.exe
Token: SeProfSingleProcessPrivilege	2156	wmic.exe
Token: SeIncBasePriorityPrivilege	2156	wmic.exe
Token: SeCreatePagefilePrivilege	2156	wmic.exe
Token: SeBackupPrivilege	2156	wmic.exe
Token: SeRestorePrivilege	2156	wmic.exe
Token: SeShutdownPrivilege	2156	wmic.exe
Token: SeDebugPrivilege	2156	wmic.exe
Token: SeSystemEnvironmentPrivilege	2156	wmic.exe
Token: SeRemoteShutdownPrivilege	2156	wmic.exe
Token: SeUndockPrivilege	2156	wmic.exe
Token: SeManageVolumePrivilege	2156	wmic.exe
Token: 33	2156	wmic.exe
Token: 34	2156	wmic.exe
Token: 35	2156	wmic.exe
Token: 36	2156	wmic.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 4656 wrote to memory of 1772	4656	2026-09-10_a3fc082593f45770dd02ef75833ac0f9_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	85
PID 4656 wrote to memory of 1060	4656	2026-09-10_a3fc082593f45770dd02ef75833ac0f9_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	86
PID 4656 wrote to memory of 928	4656	2026-09-10_a3fc082593f45770dd02ef75833ac0f9_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	89
PID 4656 wrote to memory of 2156	4656	2026-09-10_a3fc082593f45770dd02ef75833ac0f9_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	91
PID 4656 wrote to memory of 3032	4656	2026-09-10_a3fc082593f45770dd02ef75833ac0f9_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	93
PID 4656 wrote to memory of 1096	4656	2026-09-10_a3fc082593f45770dd02ef75833ac0f9_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	95
PID 4656 wrote to memory of 3392	4656	2026-09-10_a3fc082593f45770dd02ef75833ac0f9_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	98
PID 4656 wrote to memory of 5020	4656	2026-09-10_a3fc082593f45770dd02ef75833ac0f9_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	100
PID 4656 wrote to memory of 1436	4656	2026-09-10_a3fc082593f45770dd02ef75833ac0f9_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	109
PID 4656 wrote to memory of 1972	4656	2026-09-10_a3fc082593f45770dd02ef75833ac0f9_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	112
PID 4656 wrote to memory of 3260	4656	2026-09-10_a3fc082593f45770dd02ef75833ac0f9_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	114
PID 4656 wrote to memory of 3472	4656	2026-09-10_a3fc082593f45770dd02ef75833ac0f9_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	116
PID 4656 wrote to memory of 892	4656	2026-09-10_a3fc082593f45770dd02ef75833ac0f9_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	118
PID 4656 wrote to memory of 2160	4656	2026-09-10_a3fc082593f45770dd02ef75833ac0f9_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	120
PID 4656 wrote to memory of 3536	4656	2026-09-10_a3fc082593f45770dd02ef75833ac0f9_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	122
PID 4656 wrote to memory of 2792	4656	2026-09-10_a3fc082593f45770dd02ef75833ac0f9_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	124
PID 4656 wrote to memory of 2124	4656	2026-09-10_a3fc082593f45770dd02ef75833ac0f9_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	126
PID 712 wrote to memory of 1568	712	2026-09-10_a3fc082593f45770dd02ef75833ac0f9_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	130
PID 712 wrote to memory of 1236	712	2026-09-10_a3fc082593f45770dd02ef75833ac0f9_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	131
PID 712 wrote to memory of 5020	712	2026-09-10_a3fc082593f45770dd02ef75833ac0f9_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	133
PID 712 wrote to memory of 4020	712	2026-09-10_a3fc082593f45770dd02ef75833ac0f9_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	135
PID 712 wrote to memory of 5092	712	2026-09-10_a3fc082593f45770dd02ef75833ac0f9_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	137
PID 712 wrote to memory of 1264	712	2026-09-10_a3fc082593f45770dd02ef75833ac0f9_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	139
PID 712 wrote to memory of 3028	712	2026-09-10_a3fc082593f45770dd02ef75833ac0f9_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	141
PID 712 wrote to memory of 3964	712	2026-09-10_a3fc082593f45770dd02ef75833ac0f9_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	143
PID 712 wrote to memory of 2892	712	2026-09-10_a3fc082593f45770dd02ef75833ac0f9_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	145
PID 712 wrote to memory of 3896	712	2026-09-10_a3fc082593f45770dd02ef75833ac0f9_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	147
PID 712 wrote to memory of 3808	712	2026-09-10_a3fc082593f45770dd02ef75833ac0f9_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	149
PID 712 wrote to memory of 3572	712	2026-09-10_a3fc082593f45770dd02ef75833ac0f9_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	151
PID 712 wrote to memory of 2120	712	2026-09-10_a3fc082593f45770dd02ef75833ac0f9_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	153
PID 712 wrote to memory of 4540	712	2026-09-10_a3fc082593f45770dd02ef75833ac0f9_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	155
PID 712 wrote to memory of 4384	712	2026-09-10_a3fc082593f45770dd02ef75833ac0f9_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	157

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-09-10_a3fc082593f45770dd02ef75833ac0f9_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-10_a3fc082593f45770dd02ef75833ac0f9_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe"
1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Creates a file in the Startup directory
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4656
- C:\Users\Admin\AppData\Local\Temp\2026-09-10_a3fc082593f45770dd02ef75833ac0f9_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
  C:\Users\Admin\AppData\Local\Temp\2026-09-10_a3fc082593f45770dd02ef75833ac0f9_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
  2⤵
  PID:1772
- C:\Windows\system32\tasklist.exe
  tasklist /fo csv /nh
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1060
- C:\Windows\System32\Wbem\wmic.exe
  wmic computersystem get manufacturer
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:928
- C:\Windows\System32\Wbem\wmic.exe
  wmic computersystem get model
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2156
- C:\Windows\System32\Wbem\wmic.exe
  wmic diskdrive get model
  2⤵
  PID:3032
- C:\Windows\system32\getmac.exe
  getmac /fo csv /nh
  2⤵
  PID:1096
- C:\Windows\system32\tasklist.exe
  tasklist /fo csv /nh
  2⤵
  - Discovers running processes
  PID:3392
- C:\Windows\system32\curl.exe
  curl -s --max-time 5 https://api.ipify.org
  2⤵
  PID:5020
- C:\Windows\system32\curl.exe
  curl -s --max-time 5 https://checkip.amazonaws.com
  2⤵
  PID:1436
- C:\Windows\System32\Wbem\wmic.exe
  wmic os get lastbootuptime
  2⤵
  PID:1972
- C:\Windows\system32\cmd.exe
  cmd /C ver
  2⤵
  - Executes a command shell one-liner
  PID:3260
- C:\Windows\system32\cmd.exe
  cmd /C ver
  2⤵
  - Executes a command shell one-liner
  PID:3472
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:892
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2160
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3536
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2792
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn WindowsUpdater /tr C:\Users\Admin\AppData\Local\Temp\2026-09-10_a3fc082593f45770dd02ef75833ac0f9_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe /sc onlogon /rl highest /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2124

C:\Users\Admin\AppData\Local\Temp\2026-09-10_a3fc082593f45770dd02ef75833ac0f9_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
C:\Users\Admin\AppData\Local\Temp\2026-09-10_a3fc082593f45770dd02ef75833ac0f9_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:712
- C:\Users\Admin\AppData\Local\Temp\2026-09-10_a3fc082593f45770dd02ef75833ac0f9_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
  C:\Users\Admin\AppData\Local\Temp\2026-09-10_a3fc082593f45770dd02ef75833ac0f9_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
  2⤵
  PID:1568
- C:\Windows\system32\tasklist.exe
  tasklist /fo csv /nh
  2⤵
  - Discovers running processes
  PID:1236
- C:\Windows\System32\Wbem\wmic.exe
  wmic computersystem get manufacturer
  2⤵
  PID:5020
- C:\Windows\System32\Wbem\wmic.exe
  wmic computersystem get model
  2⤵
  PID:4020
- C:\Windows\System32\Wbem\wmic.exe
  wmic diskdrive get model
  2⤵
  PID:5092
- C:\Windows\system32\getmac.exe
  getmac /fo csv /nh
  2⤵
  PID:1264
- C:\Windows\system32\tasklist.exe
  tasklist /fo csv /nh
  2⤵
  - Discovers running processes
  PID:3028
- C:\Windows\system32\curl.exe
  curl -s --max-time 5 https://api.ipify.org
  2⤵
  PID:3964
- C:\Windows\System32\Wbem\wmic.exe
  wmic os get lastbootuptime
  2⤵
  PID:2892
- C:\Windows\system32\cmd.exe
  cmd /C ver
  2⤵
  - Executes a command shell one-liner
  PID:3896
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3808
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3572
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2120
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4540
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn WindowsUpdater /tr C:\Users\Admin\AppData\Local\Temp\2026-09-10_a3fc082593f45770dd02ef75833ac0f9_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe /sc onlogon /rl highest /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4384

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Virtualization/Sandbox Evasion