The dropper installs 2 files:netwf.bat : executes netwf.dllnetwf.dll : the payloadThe dropper implements 2 persistence mechanisms:HKCU\Environment\UserInitMprLogonScript to execute the netwf.bat fileCOM Object hijack of the following CLSID: {BCDE0395-E52F-467C-8E3D-C4579291692E}, the CLSID of the class MMDeviceEnumerator.These 2 techniques have also been previously used by this actor.Finally the payload is executed by rundll32.exe (and the ordinal #1 in argument) or by explorer.exe if the COM Object hijack is performed
Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The dropper installs 2 files:netwf.bat : executes netwf.dllnetwf.dll : the payloadThe dropper implements 2 persistence mechanisms:HKCU\Environment\UserInitMprLogonScript to execute the netwf.bat fileCOM Object hijack of the following CLSID: {BCDE0395-E52F-467C-8E3D-C4579291692E}, the CLSID of the class MMDeviceEnumerator.These 2 techniques have also been previously used by this actor.Finally the payload is executed by rundll32.exe (and the ordinal #1 in argument) or by explorer.exe if the COM Object hijack is performed ### Response: T1218.011.