Managed XDR

66ba3e3d0e0b1f0724f456...8b1bcc8beb153e6c8d40b4 — malware analysis report

File info

Filename
66ba3e3d0e0b1f0724f4562801_6e37e2cb908b1bcc8beb153e6c8d40b4
File type
Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1200, Locale ID: 2052, Author: Kelli, Template: Normal, Revision Number: 3, Total Editing Time: Fri Jan 5 16:00:00 1900, Create Time/Date: Thu Feb 13 07:07:00 2020, Last Saved Time/Date: Fri Aug 2 03:31:15 2024, Last Printed: Thu Feb 13 09:45:00 2020, Number of Pages: 7, Number of Words: 552, Number of Characters: 3149, Name of Creating Application: WPS Office_12.1.0.15712_F1E327B, Security: 0
File size
54.1 KB
First seen
Last seen

Environment

win7/x86 en

Hashes

SHA1
18f2524d6558976af7f0d647128cd61ab4b1a876
SHA256
c9dd76415e0ffecffb90058b5c617f13bf4e492646098061fe961ce710814fa6
MD5
6e37e2cb908b1bcc8beb153e6c8d40b4

Signatures

Execution

T1204.002 office_vb_load: Microsoft Office is loading VB DLL files (macros usage indicator)
T1064 office_macros: The document contains macro
T1064 office_macros_autoexec: The document contains an auto-start macro

Privilege Escalation

T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process

Defense Evasion

T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process
T1064 office_macros: The document contains macro
T1064 office_macros_autoexec: The document contains an auto-start macro

Discovery

T1518 locates_browser: Attempts to identify where browsers are installed

Other

yara_rules: Static rules
error_drawtext: An error occured while executing the file
get_policy_info: Retrieves information about a Policy object
antisandbox_check_graphics_card: Uses CreateDXGIFactory, potentially to detect graphics card
checktokenmembership: Checks user token with CheckTokenMembership call