Managed XDR

design-20kender-20thij...11653644076114256-.asd — malware analysis report

File info

Filename
design-20kender-20thijssen-20v0.2-autosaved-311653644076114256-.asd
File type
Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1252, Title: , Author: Fernando Benvindo, Template: Design document Tele2 zakelijk NL V2.dot, Last Saved By: Wouter Sondermeijer, Revision Number: 2, Name of Creating Application: Microsoft Office Word, Total Editing Time: 06:00, Last Printed: Thu Jan 5 23:29:00 2012, Create Time/Date: Tue Feb 28 06:02:00 2012, Last Saved Time/Date: Tue Feb 28 06:02:00 2012, Number of Pages: 4, Number of Words: 3081, Number of Characters: 17562, Security: 0
File size
1.3 MB
First seen
Last seen

Environment

win7/x86 en

Hashes

SHA1
808e1f01b599f1cda56dca78b1b85549be40d064
SHA256
8e2ecb6bc7738fd06f84b72f9df22ccc34e31bee6c4687a48ced781cb0a75397
MD5
94c605106f015df104e856cb96a2a32c

Signatures

Privilege Escalation

T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process

Defense Evasion

T1497 evasion_trustrecords: Attempts to detect Sandbox exploring trusted documents
T1497.001 antivm_queries_computername: Retrieves the computer name
T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process

Discovery

T1497 evasion_trustrecords: Attempts to detect Sandbox exploring trusted documents
T1497.001 antivm_queries_computername: Retrieves the computer name
T1135 server_share_info: Retrieves information about each shared resource on a server

Other

yara_rules: Static rules
create_rpc_bindings: Creates RPC connection
get_policy_info: Retrieves information about a Policy object
test_check_service: Starts services
antisandbox_check_graphics_card: Uses CreateDXGIFactory, potentially to detect graphics card