Managed XDR

c-users-user-appdata-l...df85f7b2ae96d7caef.tmp — malware analysis report

File info

Filename
c-users-user-appdata-local-temp-df85f7b2ae96d7caef.tmp
File type
Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 936, Author: Administrator, Template: Normal, Last Saved By: ly, Revision Number: 31, Name of Creating Application: Microsoft Office Word, Total Editing Time: 2d+03:25:00, Last Printed: Thu Apr 1 06:32:00 2021, Create Time/Date: Wed Mar 17 02:50:00 2021, Last Saved Time/Date: Thu Jan 26 03:49:00 2023, Number of Pages: 3, Number of Words: 1243, Number of Characters: 7088, Security: 0
File size
32.5 MB
First seen
Last seen

Environment

win7/x86 en

Hashes

SHA1
53473ac9168ba5f715b4ffd3cdb67e773e18ab62
SHA256
6b905d9d7e6cadc0331bbf462ffa04ae44a36f86b4dbe8cec4a3735213792ac5
MD5
07ecfc05cabcaf05e6fb865f2121910c

Signatures

Execution

T1204.002 office_vb_load: Microsoft Office is loading VB DLL files (macros usage indicator)

Privilege Escalation

T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process

Defense Evasion

T1564 office_vba_stomping: VBA Stomping was detected in the document (the VBA source code and P-code are different)
T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process

Credential Access

T1555.003 cookie_files: Accesses cookie files
T1552 cookie_files: Accesses cookie files

Discovery

T1083 checks_recent_files: Attempt to check recently opened files through registry

Other

yara_rules: Static rules
error_drawtext: An error occured while executing the file
get_policy_info: Retrieves information about a Policy object
test_check_service: Starts services
antisandbox_check_graphics_card: Uses CreateDXGIFactory, potentially to detect graphics card