Managed XDR

autorecovery-save-of-design.asd — malware analysis report

File info

Filename
autorecovery-save-of-design.asd
File type
Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: -535, Author: xp, Template: Normal.dotm, Last Saved By: MC SYSTEM, Revision Number: 2, Name of Creating Application: Microsoft Office Word, Create Time/Date: Sat Jan 20 20:19:00 2007, Last Saved Time/Date: Sat Jan 20 20:19:00 2007, Number of Pages: 6, Number of Words: 519, Number of Characters: 2963, Security: 0
File size
51 KB
First seen
Last seen

Environment

win7/x86 en

Hashes

SHA1
f17eb21b35527d460f5464c21bc8fd6f98b4bc78
SHA256
ab8e07b0a357f0f22f6d750add530e107dd834f857e5ce6d5a0bec888dd638e2
MD5
92c9121cee0f109014ff76b31bc5ed2f

Signatures

Privilege Escalation

T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process

Defense Evasion

T1497.001 antivm_queries_computername: Retrieves the computer name
T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process

Discovery

T1497.001 antivm_queries_computername: Retrieves the computer name

Other

yara_rules: Static rules
get_policy_info: Retrieves information about a Policy object
test_check_service: Starts services
antisandbox_check_graphics_card: Uses CreateDXGIFactory, potentially to detect graphics card