Tofsee

An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture.

Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.

Adversaries may interact with the Windows Registry as part of a variety of other techniques to aid in defense evasion, persistence, and execution.

Adversaries may stop or disable services on a system to render those services unavailable to legitimate users.

Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence.

Adversaries may establish persistence by executing malicious content triggered by Netsh Helper DLLs.

Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key.

Adversaries may maliciously modify components of a victim environment in order to hinder or disable defensive mechanisms.

Adversaries may disable or modify system firewalls in order to bypass controls limiting network usage.

Adversaries may abuse the Windows service control manager to execute malicious commands or payloads.

Adversaries may attempt to gather information about the system language of a victim in order to infer the geographical location of that host.