Managed XDR

6708c6dc4a4ed4feda5b8448b3e495e5.virus — malware analysis report

File info

Filename
6708c6dc4a4ed4feda5b8448b3e495e5.virus
File type
MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has command line arguments, Icon number=-166, Archive, ctime=Fri Apr 9 13:56:07 2021, mtime=Sat Mar 9 20:00:52 2024, atime=Fri Apr 9 13:56:08 2021, length=236544, window=hidenormalshowminimized
File size
5.5 KB
First seen
Last seen

Environment

win7/x86 en

Hashes

SHA1
ec290a6df2f6e7033c4df1fe083a2a3e45146180
SHA256
82ecad07077f12eeae002ea1d2485a571312e64ecf88a27cdc9a4553d6aa0729
MD5
6708c6dc4a4ed4feda5b8448b3e495e5

Signatures

Execution

T1204 suspicious_lnk: LNK file with suspicious content

Privilege Escalation

T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process

Defense Evasion

T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process

Other

yara_rules: Static rules
unexpected_exception: Unexpected exception
creates_suspended_process: Creates suspended process
get_policy_info: Retrieves information about a Policy object