Execution and Persistence: Concrete Artifacts

• Execution: cmd.exe / powershell.exe spawned by the sample; wscript.exe running a dropped script.
• Persistence -- Run keys: HKCU\textbackslash ...\textbackslash CurrentVersion \textbackslash Run new value.
• Persistence -- Scheduled task: schtasks /create or a new file under Windows\textbackslash Tasks.
• Persistence -- Service: new key under HKLM\textbackslash SYSTEM\textbackslash ...\textbackslash Services.
• Persistence -- Startup folder: file dropped in Start Menu\textbackslash ...\textbackslash Startup.