Persistence
T1574 dropper_dll: Creates DLL, which is then loaded into the process
Privilege Escalation
T1574 dropper_dll: Creates DLL, which is then loaded into the process
T1134 sets_privilegies_via_adjusttokenprivileges: Sets process privilege via AdjustTokenPrivileges
T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process
Defense Evasion
T1497.002 antisandbox_mouse_hook: Installs a hook to monitor mouse movements
T1562.001 office_security: Attempts to modify Microsoft Office security settings
T1222 icacls: May obtain or change Discretionary access control lists (DACLs)
T1574 dropper_dll: Creates DLL, which is then loaded into the process
T1497 office_security_check: Checks Microsoft Office security settings
T1497.001 antivm_network_adapters: Checks NIC addresses
T1134 sets_privilegies_via_adjusttokenprivileges: Sets process privilege via AdjustTokenPrivileges
T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process
T1497.001 antivm_queries_computername: Retrieves the computer name
T1497.003 antisandbox_sleep: The process attempted to slow down analysis
Credential Access
T1056.001 infostealer_keylogger: Keylogger (intercepts keystrokes)
Discovery
T1497.002 antisandbox_mouse_hook: Installs a hook to monitor mouse movements
T1497 office_security_check: Checks Microsoft Office security settings
T1057 process_interest: Enumerates processes
T1497.001 antivm_network_adapters: Checks NIC addresses
T1497.001 antivm_queries_computername: Retrieves the computer name
T1497.003 antisandbox_sleep: The process attempted to slow down analysis
T1082 fingerprint_to_file: Collects data about system and user and writes it to a text file
Collection
T1056.001 infostealer_keylogger: Keylogger (intercepts keystrokes)
Other
yara_rules: Static rules
network_bind: Starts servers listening at 0.0.0.0:19528, 0.0.0.0:23452
creates_exe: Creates executable files in the file system
executes_dropped_exe: Executes dropped exe files
unsigned_driver_drop: Sample is not signed and drops a device driver
create_rpc_bindings: Creates RPC connection
has_pdb: This executable file has a PDB path
pe_overlay_not_run: PE file contains executable files in overlay, which were not run
get_policy_info: Retrieves information about a Policy object
test_check_service: Starts services
antisandbox_check_graphics_card: Uses CreateDXGIFactory, potentially to detect graphics card
checktokenmembership: Checks user token with CheckTokenMembership call
pe_overlay: PE file contains overlay
open_winlogon_process: Trying to open winlogon process