Managed XDR

c-users-user-desktop-doc.doc-copy — malware analysis report

File info

Filename
c-users-user-desktop-doc.doc-copy
File type
Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: -535, Title: , Author: , Template: relax.mpg, Last Saved By: User, Revision Number: 12, Name of Creating Application: Microsoft Office Word, Total Editing Time: 07:24:00, Last Printed: Tue Oct 7 16:13:00 2025, Create Time/Date: Mon May 26 22:03:00 2025, Last Saved Time/Date: Mon Oct 27 14:08:00 2025, Number of Pages: 1, Number of Words: 300, Number of Characters: 1710, Security: 0
File size
51.5 KB
First seen
Last seen

Environment

w10/x86 en

Hashes

SHA1
15c6ac1ec4641e538a79d113a313869565da03f0
SHA256
67e99f394b6e2258feeaa3d20269aba94b5fb3737b3eb8511a3a5b506cdcf3b2
MD5
6c0de89ed15be7a8428bd101ef7ef35b

Signatures

Execution

T1204.002 office_com_load: Microsoft Office loads COM DLL files (indicator of COM usage in macros)

Defense Evasion

T1221 office_attached_template: Office file attempts to download a suspicious template from the Internet

Credential Access

T1555.003 cookie_files: Accesses cookie files
T1555.004 windows_credential_manager: Acquire credentials from the Windows Credential Manager
T1552 cookie_files: Accesses cookie files
T1056.001 infostealer_keylogger: Keylogger (intercepts keystrokes)

Collection

T1056.001 infostealer_keylogger: Keylogger (intercepts keystrokes)

Command and Control

T1071.001 winhttp_https: Performs HTTP/HTTPS requests using WinHttp
T1071.001 wininet_https: Performs HTTP/HTTPS requests using WinInet

Other

dns_without_resolve: DNS query without a response
creates_suspended_process: Creates suspended process
test_check_service: Starts services
writes_data: Writes big amount of data to disk
Managed XDR