Managed XDR

641eb6e1de81757c31d711...11490803321582320-.asd — malware analysis report

File info

Filename
641eb6e1de81757c31d711df1cd01f5858814091d8655ca1e6-autosaved-311490803321582320-.asd
File type
Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1252, Title: ljw, Subject: iobp, Author: a1pl, Comments: pq, Template: Normal.dotm, Last Saved By: 4qvn, Revision Number: 9, Name of Creating Application: Microsoft Office Word, Total Editing Time: 10:00, Create Time/Date: Fri Apr 12 12:50:00 2013, Last Saved Time/Date: Wed May 8 18:29:00 2013, Number of Pages: 1, Number of Words: 16, Number of Characters: 93, Security: 0
File size
21.5 KB
First seen
Last seen

Environment

winxp/x86 en

Hashes

SHA1
4884589411c9371539e5ad2e073469b70367b353
SHA256
dc2c5382995b42feef2fa58c6a8859420a653a9426632f2c9507e4df88005b82
MD5
00421a8ce38c937107ffe8fdfa0c896b

Signatures

Privilege Escalation

T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process

Defense Evasion

T1497 evasion_runmru: Attempts to detect Sandbox by Run MRU
T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process

Credential Access

T1555.003 cookie_files: Accesses cookie files
T1552 cookie_files: Accesses cookie files

Discovery

T1518 locates_browser: Attempts to identify where browsers are installed
T1497 evasion_runmru: Attempts to detect Sandbox by Run MRU

Command and Control

T1071.001 network_http: Performs HTTP requests

Other

yara_rules: Static rules
creates_in_programdata: Creates files in the ProgramData directory