Defense Evasion
T1027.002 unnamed_memory_regions: Code was executed in unnamed regions
T1497.001 antisandbox_script_timer: Detected script timer window (indicative of sleep style evasion)
Discovery
T1497.001 antisandbox_script_timer: Detected script timer window (indicative of sleep style evasion)
Other
yara_rules: Static rules
unexpected_exception: Unexpected exception
no_graphical_activity: No graphic activity
creates_suspended_process: Creates suspended process