Execution
T1204 suspicious_lnk: LNK file with suspicious content
T1059.003 suspicious_cmd_process: Cmd.exe without commandline launches a new process
T1059.003 suspicious_cmd_process_2: Cmd.exe performs suspicious activity (stdout)
Defense Evasion
T1497.001 antisandbox_script_timer: Detected script timer window (indicative of sleep style evasion)
Discovery
T1497.001 antisandbox_script_timer: Detected script timer window (indicative of sleep style evasion)
Other
yara_rules: Static rules
unexpected_exception: Unexpected exception
no_graphical_activity: No graphic activity
creates_suspended_process: Creates suspended process