Managed XDR

autorecovery-save-of-infected-file.asd — malware analysis report

File info

Filename
autorecovery-save-of-infected-file.asd
File type
Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1252, Author: Campbell Longmire, Template: Normal.dotm, Last Saved By: Campbell Longmire, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Total Editing Time: 01:00, Create Time/Date: Mon Jul 28 23:39:00 2025, Last Saved Time/Date: Mon Jul 28 23:40:00 2025, Number of Pages: 1, Number of Words: 2, Number of Characters: 18, Security: 0
File size
29 KB
First seen
Last seen

Environment

w10/x86 en

Hashes

SHA1
08b9c4fabcf36663bb990185c92485508b341e3e
SHA256
1a91138e8020055117319f33417b106f26506a8ddf5b68f49e4097f559bd0de4
MD5
4eff3ac0e1320f8f89017340379f36df

Signatures

Execution

T1204.002 office_com_load: Microsoft Office loads COM DLL files (indicator of COM usage in macros)

Credential Access

T1555.004 windows_credential_manager: Acquire credentials from the Windows Credential Manager

Other

yara_rules: Static rules
test_check_service: Starts services
writes_data: Writes big amount of data to disk
Managed XDR