Managed XDR

vtdl_bg7bdt7t — malware analysis report

File info

Filename
vtdl_bg7bdt7t
File type
Composite Document File V2 Document, Little Endian, Os 0, Version: 3.10, Template: C:\MSOFFICE\WINWORD\NORMAL.DOT, Title: SURVEY, Subject: 170 14-FCP 107 229/SP4, Keywords: Internal information, Comments: PA1, Author: NA/EBC/FMD/G Elisabeth Pierre, Last Saved By: Ericsson, Create Time/Date: Sun Feb 2 15:37:00 1997, Last Saved Time/Date: Sun Feb 2 18:08:00 1997, Number of Words: 0, Number of Characters: 0, Total Editing Time: 01:37:00, Name of Creating Application: Microsoft Word 6.0, Number of Pages: 3, Revision Number: 12, Security: 0
File size
19.5 KB
First seen
Last seen

Environment

win7/x86 en

Hashes

SHA1
3d66eeeb709539d4903ac2c4833e36993dcdae52
SHA256
5aee17191a5355532a8737e128a7683643b75371c55757417d6ac9a4477dd91b
MD5
145f9b98a40553658dc82f757bfdae51

Signatures

Execution

T1204.002 office_vb_load: Microsoft Office is loading VB DLL files (macros usage indicator)

Privilege Escalation

T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process

Defense Evasion

T1096 persistence_ads: Creates Alternate Data Stream (ADS)
T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process

Discovery

T1083 checks_recent_files: Attempt to check recently opened files through registry

Other

yara_rules: Static rules
office_summary: The document contains suspicious metadata
creates_suspended_process: Creates suspended process
get_policy_info: Retrieves information about a Policy object
test_check_service: Starts services
antisandbox_check_graphics_card: Uses CreateDXGIFactory, potentially to detect graphics card