Disables service(s)

Modifies file permissions

Prevents Microsoft Defender from scanning certain paths by adding an exclusion.

Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.

Stops running service(s)

Contacts third-party web service commonly abused for C2

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Enumerates connected drives

Attempts to read the root path of hard drives other than the default C: drive.

Hide Artifacts: Hidden Window

Windows that would typically be displayed when an application carries out an operation can be hidden.

Indicator Removal: Clear Persistence

Clear artifacts associated with previously established persistence like scheduletasks on a host.

Modifies Security services

Modifies the startup behavior of a security service.

Power Settings

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

Drops file in System32 directory

Suspicious use of NtSetInformationThreadHideFromDebugger