Managed XDR
Group-IB MDP Report
File info
Filename: c-users-user-desktop-readme.doc-copy
File Type: Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: -535, Template: sour.mgf, Last Saved By: george, Revision Number: 7, Name of Creating Application: Microsoft Office Word, Total Editing Time: 50:00, Last Printed: Fri Dec 2 19:38:00 2022, Create Time/Date: Fri Dec 2 18:28:00 2022, Last Saved Time/Date: Tue Jan 28 13:00:00 2025, Number of Pages: 4, Number of Words: 608, Number of Characters: 3469, Security: 0
File Size: 40.5 KB
Env info
win7/x86 en
Hashes
SHA1: 951c19b5a12635f3456e61bc1073617f21fe1ea1
SHA256: 47f3b0ceb8089a622e8ac66a2bfd41f325ea869d65730e5c7c8abd0b27a1b466
MD5: 8ec93ae7e37a89a62dfd392697331f4a
Signatures
Privilege Escalation
T1134 sets_privilegies_via_adjusttokenprivileges: Sets process privilege via AdjustTokenPrivileges
T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process
Defense Evasion
T1221 office_attached_template: Office file attempts to download a suspicious template from the Internet
T1134 sets_privilegies_via_adjusttokenprivileges: Sets process privilege via AdjustTokenPrivileges
T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process
T1497.001 antivm_queries_computername: Retrieves the computer name
Credential Access
T1555.003 cookie_files: Accesses cookie files
T1552 cookie_files: Accesses cookie files
Discovery
T1497.001 antivm_queries_computername: Retrieves the computer name
Command and Control
T1071.001 winhttp_https: Performs HTTP/HTTPS requests using WinHttp
T1071.001 wininet_https: Performs HTTP/HTTPS requests using WinInet
Other
yara_rules: Static rules
dns_without_resolve: DNS query without a response
create_rpc_bindings: Creates RPC connection
get_policy_info: Retrieves information about a Policy object
test_check_service: Starts services
antisandbox_check_graphics_card: Uses CreateDXGIFactory, potentially to detect graphics card
Managed XDR