Persistence
T1574 dropper_dll: Creates DLL, which is then loaded into the process
T1574.011 persistence_services: Modifies Services registry key
T1543.003 persistence_services: Modifies Services registry key
Privilege Escalation
T1574 dropper_dll: Creates DLL, which is then loaded into the process
T1574.011 persistence_services: Modifies Services registry key
T1543.003 persistence_services: Modifies Services registry key
T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process
Defense Evasion
T1112 creates_largekey: Saves very large data in the registry, can be used to save the configuration or body of the malware
T1497.001 antivm_directory_objects: Scans directory objects, possibly to find VM indicators
T1027.002 packer_entropy: Probably contains compressed or encrypted data
T1574 dropper_dll: Creates DLL, which is then loaded into the process
T1574.011 persistence_services: Modifies Services registry key
T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process
T1070 stealth_window: A process created a hidden window
Discovery
T1497.001 antivm_directory_objects: Scans directory objects, possibly to find VM indicators
T1518 locates_browser: Attempts to identify where browsers are installed
T1082 recon_systeminfo: Collects system information (ipconfig, netstat, systeminfo, net)
T1082 sysenv_get: Gets environment variables
Other
writes_pe_file_in_regkey: Writes PE file into regkey
driver_load: Loads a driver
creates_exe: Creates executable files in the file system
executes_dropped_exe: Executes dropped exe files
process_crashed: One of the processes has failed
unsigned_driver_drop: Sample is not signed and drops a device driver
require_administrator: Requests administrator privileges
get_policy_info: Retrieves information about a Policy object
test_check_service: Starts services