Execution
T1559 suspicious_process: Spawns a suspicious process
T1064 office_macros: The document contains macroses (total: 2)
T1064 office_macros_autoexec: The document contains an auto-start macro
T1204.002 office_vb_load: Microsoft Office is loading VB DLL files (macros usage indicator)
T1204.002 office_com_load: Microsoft Office loads COM DLL files (indicator of COM usage in macros)
Persistence
T1574.011 persistence_services: Modifies Services registry key
T1543.003 persistence_services: Modifies Services registry key
Privilege Escalation
T1502 stealth_childproc: Changes the parent of the spawned process
T1543.003 persistence_services: Modifies Services registry key
T1574.011 persistence_services: Modifies Services registry key
Defense Evasion
T1502 stealth_childproc: Changes the parent of the spawned process
T1574.011 persistence_services: Modifies Services registry key
T1064 office_macros: The document contains macroses (total: 2)
T1064 office_macros_autoexec: The document contains an auto-start macro
T1497.001 antivm_generic_productname: Checks system product name in registry, possibly for anti-virtualization
Credential Access
T1056.001 infostealer_keylogger: Keylogger (intercepts keystrokes)
Discovery
T1083 checks_recent_files: Attempt to check recently opened files through registry
T1497.001 antivm_generic_productname: Checks system product name in registry, possibly for anti-virtualization
Collection
T1560.001 archive_via_utility: Detected archiving data via utility
T1056.001 infostealer_keylogger: Keylogger (intercepts keystrokes)
Impact
T1486 modifies_files2: Cryptolocker indicators detected (100 or more files are modified)
T1529 shutdown_system: Shuts the system down
Other
creates_many_processes: Spawns a lot of processes (over 70)
unexpected_exception: Unexpected exception
creates_suspended_process: Creates suspended process
message_box: Displays a message
test_check_service: Starts services