Tropic Trooper used shellcode with an XOR algorithm to decrypt a payload.

Tropic Trooper also decrypted image files which contained a payload.(Citation: Unit 42 Tropic Trooper Nov 2016)(Citation: TrendMicro Tropic Trooper May 2020)|
|mitre-attack|enterprise-attack|Windows|T1547.004|Winlogon Helper DLL|

Tropic Trooper has created the Registry key

Tropic Trooper is capable of enumerating the running processes on the system using

Tropic Trooper can search for anti-virus software running on the system.(Citation: Unit 42 Tropic Trooper Nov 2016)|