Managed XDR

autorecovery-save-of-malicious-file.asd — malware analysis report

File info

Filename
autorecovery-save-of-malicious-file.asd
File type
Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1252, Author: fqknkjq, Template: Normal.dotm, Last Saved By: Windows User, Revision Number: 20, Name of Creating Application: Microsoft Office Word, Total Editing Time: Sun Feb 15 21:36:00 9767, Create Time/Date: Mon Feb 9 12:16:00 2015, Last Saved Time/Date: Mon Jun 19 21:28:00 2017, Number of Pages: 10, Number of Words: 1975, Number of Characters: 38745, Security: 0
File size
210.5 KB
First seen
Last seen

Environment

win7/x86 en

Hashes

SHA1
02896f661e4777779424621229613521fe2ab5bc
SHA256
fabc5491ea0013fcb4fa51e9d20a05b9a59a4feb00690fa87a11f2e83b402af6
MD5
755a7905d92e3096cc2cfc838b2095d2

Signatures

Privilege Escalation

T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process

Defense Evasion

T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process
T1497.001 antivm_queries_computername: Retrieves the computer name

Discovery

T1497.001 antivm_queries_computername: Retrieves the computer name

Other

yara_rules: Static rules
get_policy_info: Retrieves information about a Policy object
test_check_service: Starts services
office_links: Office file contains external links
antisandbox_check_graphics_card: Uses CreateDXGIFactory, potentially to detect graphics card
Managed XDR