Managed XDR

autorecovery-save-of-design.asd (Loki PWS, Loki Bot) — malware analysis report

File info

Filename
autorecovery-save-of-design.asd
File type
Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1252, Author: VICTOR PC, Template: Normal.dotm, Last Saved By: VICTOR PC, Revision Number: 2, Name of Creating Application: Microsoft Office Word, Total Editing Time: 05:00, Create Time/Date: Tue Apr 18 16:09:00 2017, Last Saved Time/Date: Tue Apr 18 16:14:00 2017, Number of Pages: 1, Number of Words: 7, Number of Characters: 43, Security: 0
File size
612 KB
First seen
Last seen

Environment

win7/x86 en

Hashes

SHA1
bb5954541c5703ec7ce359139bab0e156a9d366f
SHA256
2767dfe4bc923425951480fbaa544ff614c9df7c351cc52e7317d76f07b8becf
MD5
0d04b35b0baecdb2fbecdccfbdcc8d63

Malwares

  • Loki PWS
  • Loki Bot

Signatures

Execution

T1059.005 obfuscated_vbs: Detected obfuscated VBS
T1059 wscript_info_discovery: Collects info about system with Wscript.Shell

Privilege Escalation

T1134 sets_privilegies_via_adjusttokenprivileges: Sets process privilege via AdjustTokenPrivileges
T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process

Defense Evasion

T1112 loki_cnc_in_registry: Loki Bot detected (not available CnC checked in registry)
T1564.001 stealth_file: Creates hidden or system files
T1497.001 antivm_disk_size: Checks the amount of free disk space
T1027 obfuscated_vbs: Detected obfuscated VBS
T1134 sets_privilegies_via_adjusttokenprivileges: Sets process privilege via AdjustTokenPrivileges
T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process
T1497.001 antisandbox_script_timer: Detected script timer window (indicative of sleep style evasion)
T1497.001 antivm_queries_computername: Retrieves the computer name
T1497.003 antisandbox_sleep: The process attempted to slow down analysis

Credential Access

T1552 infostealer_browser: Retrieves personal information from local Internet browsers
T1503 infostealer_browser: Retrieves personal information from local Internet browsers
T1552 infostealer_ftp: Collects data from local FTP clients
T1552 infostealer_applications: Collects data from local applications
T1552 infostealer_mail: Collects personal data from local email clients
T1552 infostealer_im: Collects information about installed messengers
T1552.002 infostealer_tc: Attempts to collect information from total commander
T1555.003 cookie_files: Accesses cookie files
T1555.004 windows_credential_manager: Acquire credentials from the Windows Credential Manager
T1552 cookie_files: Accesses cookie files

Discovery

T1497.001 antivm_disk_size: Checks the amount of free disk space
T1518 locates_browser: Attempts to identify where browsers are installed
T1497.001 antisandbox_script_timer: Detected script timer window (indicative of sleep style evasion)
T1497.001 antivm_queries_computername: Retrieves the computer name
T1497.003 antisandbox_sleep: The process attempted to slow down analysis
T1033 wscript_info_discovery: Collects info about system with Wscript.Shell

Collection

T1114 infostealer_mail: Collects personal data from local email clients

Other

yara_rules: Static rules
executes_dropped_exe: Executes dropped exe files
ce_info: Loki Bot Configuration Data found
office_embedded: Office document contains embedded executable file(s)
creates_exe: Creates executable files in the file system
dead_host: Connects to IP addresses that do not respond to requests
create_rpc_bindings: Creates RPC connection
break_limit_exceeded: Warning: function calls limit has been exceeded
get_policy_info: Retrieves information about a Policy object
creates_in_programdata: Creates files in the ProgramData directory
test_check_service: Starts services
antisandbox_check_graphics_card: Uses CreateDXGIFactory, potentially to detect graphics card
checktokenmembership: Checks user token with CheckTokenMembership call

Related reports