Managed XDR

vtdl__tnpu6pj — malware analysis report

File info

Filename
vtdl__tnpu6pj
File type
Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1252, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 00:00:00 2006, Last Saved Time/Date: Mon Nov 28 17:11:39 2022, Security: 1
File size
813 KB
First seen
Last seen

Environment

win7/x86 en

Hashes

SHA1
40d789b940747f88f40cdd0cbc891486cd0868ec
SHA256
17a8ec56dafaad109906330a0ccef3dbb3592fbf21c33cc26255a154fe3976f7
MD5
b5c98554695c6d71e28bf2ed1a10098a

Signatures

Execution

T1203 exploit_CVE_2017_11882: Exploits CVE-2017-11882 vulnerability
T1203 office_exploit_http: The document exhibits suspicious behaviour (performs HTTP requests)
T1064 office_macros: The document contains macro

Defense Evasion

T1064 office_macros: The document contains macro
T1497 windows_enumthread: Attempts to enumerate windows using EnumThreadWindows and SendMessage for text obtaining

Discovery

T1083 checks_recent_files: Attempt to check recently opened files through registry
T1082 windows_enumthread: Attempts to enumerate windows using EnumThreadWindows and SendMessage for text obtaining
T1497 windows_enumthread: Attempts to enumerate windows using EnumThreadWindows and SendMessage for text obtaining

Command and Control

T1071.001 office_exploit_http: The document exhibits suspicious behaviour (performs HTTP requests)
T1071.004 office_exploit_dns: The document exhibits suspicious behaviour (performs DNS requests)
T1071.001 network_http: Performs HTTP requests
T1071.001 wininet_https: Performs HTTP/HTTPS requests using WinInet

Other

suricata_alert: Malicious traffic detected
creates_exe: Creates executable files in the file system
create_process_failed: Could not start the process
suspicious_process_network: Unusual process network activity detected
unexpected_exception: Unexpected exception
get_memory_status: Gets information about the virtual and physical memory of the system
break_limit_exceeded: Warning: function calls limit has been exceeded
office_summary: The document contains suspicious metadata
get_sid_domain: Get user's SID
get_username: Gets username
test_check_service: Starts services
create_rpc_bindings: Creates RPC connection
yara_rules: Static rules