It has used services.exe to execute scripts and executables during lateral movement within a victim's network. It has also used batch scripts that leverage PsExec to execute a previously transferred ransomware payload on a victim's network.