Persistence
T1574 dropper_dll: Creates DLL, which is then loaded into the process
T1574.011 persistence_services: Modifies Services registry key
T1543.003 persistence_services: Modifies Services registry key
Privilege Escalation
T1574 dropper_dll: Creates DLL, which is then loaded into the process
T1574.011 persistence_services: Modifies Services registry key
T1543.003 persistence_services: Modifies Services registry key
T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process
Defense Evasion
T1112 creates_largekey: Saves very large data in the registry, can be used to save the configuration or body of the malware
T1574 dropper_dll: Creates DLL, which is then loaded into the process
T1574.011 persistence_services: Modifies Services registry key
T1027.002 packer_entropy: Probably contains compressed or encrypted data
T1497.001 antivm_directory_objects: Scans directory objects, possibly to find VM indicators
T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process
T1070 stealth_window: A process created a hidden window
Discovery
T1497.001 antivm_directory_objects: Scans directory objects, possibly to find VM indicators
T1518 locates_browser: Attempts to identify where browsers are installed
T1082 sysenv_get: Gets environment variables
Other
yara_rules: Static rules
writes_pe_file_in_regkey: Writes PE file into regkey
driver_load: Loads a driver
creates_exe: Creates executable files in the file system
executes_dropped_exe: Executes dropped exe files
unsigned_driver_drop: Sample is not signed and drops a device driver
require_administrator: Requests administrator privileges
has_pdb: This executable file has a PDB path
creates_suspended_process: Creates suspended process
break_limit_exceeded: Warning: function calls limit has been exceeded
test_check_service: Starts services