Managed XDR

exploit-autosaved-311640583456272832-.asd — malware analysis report

File info

Filename
exploit-autosaved-311640583456272832-.asd
File type
Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1252, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Mon Feb 24 16:45:00 2025, Number of Pages: 1, Number of Words: 8, Number of Characters: 47, Security: 0
File size
1 MB
First seen
Last seen

Environment

win7/x64 en

Hashes

SHA1
793568fd8635f4fd288b519d6b908bcba3ba1c94
SHA256
f2a2e62d8d7ba182a8b172976c600020567033741c21b2de8a8ce6dd93edce04
MD5
26e943b762f4287f3f18a6d1ddacb903

Signatures

Persistence

T1547.001 persistence_autorun: Makes itself run automatically on Windows startup
T1574 dropper_dll: Creates DLL, which is then loaded into the process

Privilege Escalation

T1134.004 ppid_spoofing: Parent pid spoofing detected
T1547.001 persistence_autorun: Makes itself run automatically on Windows startup
T1574 dropper_dll: Creates DLL, which is then loaded into the process
T1134 sets_privilegies_via_adjusttokenprivileges: Sets process privilege via AdjustTokenPrivileges
T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process

Defense Evasion

T1134.004 ppid_spoofing: Parent pid spoofing detected
T1497 evasion_trustrecords: Attempts to detect Sandbox exploring trusted documents
T1497 checks_firmware: Attempts to read firmware information (potentially for evasion)
T1497.001 antivm_queries_computername: Retrieves the computer name
T1134 sets_privilegies_via_adjusttokenprivileges: Sets process privilege via AdjustTokenPrivileges
T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process
T1574 dropper_dll: Creates DLL, which is then loaded into the process

Discovery

T1057 process_interest: Enumerates processes
T1497 evasion_trustrecords: Attempts to detect Sandbox exploring trusted documents
T1497 checks_firmware: Attempts to read firmware information (potentially for evasion)
T1497.001 antivm_queries_computername: Retrieves the computer name
T1082 checks_firmware: Attempts to read firmware information (potentially for evasion)
T1135 server_share_info: Retrieves information about each shared resource on a server

Command and Control

T1071.001 winhttp_https: Performs HTTP/HTTPS requests using WinHttp

Other

yara_rules: Static rules
office_embedded: Office document contains embedded executable file(s)
modifies_certs: Attempts to generate or modify system certificates
suspicious_process: Spawns a suspicious process
valid_authenticode: The digital signature has been verified
create_rpc_bindings: Creates RPC connection
has_pdb: This executable file has a PDB path
get_policy_info: Retrieves information about a Policy object
test_check_service: Starts services
antisandbox_check_graphics_card: Uses CreateDXGIFactory, potentially to detect graphics card
pe_overlay: PE file contains overlay