Managed XDR

c-users-user-desktop-attachment.doc-copy — malware analysis report

File info

Filename
c-users-user-desktop-attachment.doc-copy
File type
Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: -535, Template: Normal.dotm, Last Saved By: Bruno, Revision Number: 2, Name of Creating Application: Microsoft Office Word, Total Editing Time: 01:00, Last Printed: Mon Apr 10 23:58:00 2023, Create Time/Date: Mon Apr 10 23:56:00 2023, Last Saved Time/Date: Wed May 14 18:29:00 2025, Number of Pages: 6, Number of Words: 245, Number of Characters: 1403, Security: 0
File size
38.5 KB
First seen
Last seen

Environment

win7/x86 en

Hashes

SHA1
b3b511adfb124176d22574e46dc8b1ff2d246f6d
SHA256
079270dd592bc918feb6a02612634caaa48b106509ece8f85b8cdbf42d2f7e1d
MD5
9f3f588bd7a785a398b8fd4ca282c28e

Signatures

Execution

T1064 office_macros: The document contains macro
T1064 office_macros_autoexec: The document contains an auto-start macro
T1204.002 office_vb_load: Microsoft Office is loading VB DLL files (macros usage indicator)
T1106 susp_callbacks: Suspicious usage of some WinAPI with callbacks

Privilege Escalation

T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process

Defense Evasion

T1064 office_macros: The document contains macro
T1064 office_macros_autoexec: The document contains an auto-start macro
T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process

Other

yara_rules: Static rules
get_policy_info: Retrieves information about a Policy object
antisandbox_check_graphics_card: Uses CreateDXGIFactory, potentially to detect graphics card
checktokenmembership: Checks user token with CheckTokenMembership call