Managed XDR

template_injection.rtf — malware analysis report

File info

Filename
template_injection.rtf
File type
Rich Text Format data, version 1, unknown character set
File size
58.5 KB
First seen
Last seen

Environment

win7/x86 en

Hashes

SHA1
48928cbb1c1b7c775ddb3f51c2682b2ceff09d57
SHA256
b2e950ee271875743e04b8c30891538536357d06d6aa894e0c556cfd8141abfb
MD5
d17678ac016a8ab0aeb2d53fb2c297f8

Signatures

Execution

T1559.001 com_exec: Execution of Win32_Process.Create COM Method
T1204.002 office_wmi_load: Microsoft Office loads WMI DLL files (WMI usage indicator in macroes)
T1204.002 office_vb_load: Microsoft Office is loading VB DLL files (macros usage indicator)
T1204.002 mimics_extension: Attempts to mimic the file extension

Privilege Escalation

T1134 sets_privilegies_via_adjusttokenprivileges: Sets process privilege via AdjustTokenPrivileges
T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process

Defense Evasion

T1218 suspicious_cmdline: Executes a suspicious command
T1497 debugs_self: Creates a process and debugs it
T1036 mimics_extension: Attempts to mimic the file extension
T1497.001 antivm_queries_computername: Retrieves the computer name
T1134 sets_privilegies_via_adjusttokenprivileges: Sets process privilege via AdjustTokenPrivileges
T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process

Credential Access

T1555.003 cookie_files: Accesses cookie files
T1552 cookie_files: Accesses cookie files

Discovery

T1497 debugs_self: Creates a process and debugs it
T1083 checks_recent_files: Attempt to check recently opened files through registry
T1497.001 antivm_queries_computername: Retrieves the computer name
T1135 server_share_info: Retrieves information about each shared resource on a server

Command and Control

T1071.001 network_http: Performs HTTP requests
T1071.001 winhttp_https: Performs HTTP/HTTPS requests using WinHttp
T1071.001 wininet_https: Performs HTTP/HTTPS requests using WinInet

Other

suspicious_process: Spawns a suspicious process
suspicious_process_network: Unusual process network activity detected
creates_doc: Creates (office) documents in the file system
create_rpc_bindings: Creates RPC connection
get_policy_info: Retrieves information about a Policy object
test_check_service: Starts services
antisandbox_check_graphics_card: Uses CreateDXGIFactory, potentially to detect graphics card
suricata_alert: Malicious traffic detected
yara_rules: Static rules