Writes a Windows system DLL name to a user directory

A module named after a system DLL outside System32 can be loaded instead of the real one by a program searching that directory.

Adds Run key to start application

Downloads MZ/PE file

Enumerates connected drives

Attempts to read the root path of hard drives other than the default C: drive.

Network Service Discovery

Attempt to gather information on host's network.

Event Triggered Execution: Component Object Model Hijacking

Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.