Executes dropped EXE

Writes a Windows system DLL name to a user directory

A module named after a system DLL outside System32 can be loaded instead of the real one by a program searching that directory.

Enumerates connected drives

Attempts to read the root path of hard drives other than the default C: drive.

Network Service Discovery

Attempt to gather information on host's network.

Writes to the Master Boot Record (MBR)

Bootkits write to the MBR to gain persistence at a level below the operating system.