Managed XDR

scratch-zoo-2025-03-21...538b98b799754426964122 — malware analysis report

File info

Filename
scratch-zoo-2025-03-21-6b50377d39538b98b799754426964122
File type
Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 936, Title: 0, Author: Paul, Template: Normal, Last Saved By: Martina, Revision Number: 2, Name of Creating Application: Microsoft Office Word, Last Printed: Tue Oct 29 06:52:00 2019, Create Time/Date: Fri Mar 14 05:22:00 2025, Last Saved Time/Date: Fri Mar 14 05:22:00 2025, Number of Pages: 3, Number of Words: 152, Number of Characters: 870, Security: 0
File size
354 KB
First seen
Last seen

Environment

win7/x86 en

Hashes

SHA1
8b161823fc716aa6b0589892ed6b37700d5c18cb
SHA256
6794e6d4db778dd4567f8b43aa1eb8d75062629e763fc7dc0328976c62ec7ac0
MD5
6b50377d39538b98b799754426964122

Signatures

Execution

T1064 office_macros: The document contains macro
T1064 office_macros_autoexec: The document contains an auto-start macro
T1204.002 office_vb_load: Microsoft Office is loading VB DLL files (macros usage indicator)

Privilege Escalation

T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process

Defense Evasion

T1064 office_macros: The document contains macro
T1064 office_macros_autoexec: The document contains an auto-start macro
T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process

Other

yara_rules: Static rules
get_policy_info: Retrieves information about a Policy object
test_check_service: Starts services
antisandbox_check_graphics_card: Uses CreateDXGIFactory, potentially to detect graphics card
checktokenmembership: Checks user token with CheckTokenMembership call