Managed XDR

vtdl_1748258304_8c3zrf02 — malware analysis report

File info

Filename
vtdl_1748258304_8c3zrf02
File type
MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has command line arguments, Icon number=30, Archive, ctime=Fri Nov 21 04:59:32 2014, mtime=Fri Nov 21 04:59:32 2014, atime=Fri Nov 21 04:59:32 2014, length=315392, window=hidenormalshowminimized
File size
2.5 KB
First seen
Last seen

Environment

win7/x86 en

Hashes

SHA1
689b4f4638de462760d433e1ee1587f99ced0739
SHA256
a7937686280e9e9a89fb129cecef85fc6da786f3cdd9aeec40b3fa3dfcfaf853
MD5
17bd71a8c866b0775d6e4d3530c65fe9

Signatures

Execution

T1204 suspicious_lnk: LNK file with suspicious content

Privilege Escalation

T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process

Defense Evasion

T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process

Other

yara_rules: Static rules
unexpected_exception: Unexpected exception
no_graphical_activity: No graphic activity
creates_suspended_process: Creates suspended process
get_policy_info: Retrieves information about a Policy object