Managed XDR

cv_vitaliy_klymenko_da_27.11.pdf.lnk — malware analysis report

File info

Filename
cv_vitaliy_klymenko_da_27.11.pdf.lnk
File type
MS Windows shortcut, Has Description string, Has command line arguments, Icon number=11, ctime=Mon Jan 1 00:00:00 1601, mtime=Mon Jan 1 00:00:00 1601, atime=Mon Jan 1 00:00:00 1601, length=0, window=hidenormalshowminimized
File size
1.6 MB
First seen
Last seen

Environment

win7/x86 en

Hashes

SHA1
277de4c4dfac1cf0c481247902d34388c1bf44bb
SHA256
d0a6c1f647ae9f21789bc12f88f00e44f0e92c77cb901f3f80da08b033aa9f36
MD5
a7e7a70c6548b4e49709719f2d1734f0

Signatures

Execution

T1059.001 suspicious_powershell: Creates suspicious powershell process
T1059.001 suspicious_process: Spawns a suspicious process

Privilege Escalation

T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process

Defense Evasion

T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process

Other

unexpected_exception: Unexpected exception
no_graphical_activity: No graphic activity
creates_suspended_process: Creates suspended process
get_policy_info: Retrieves information about a Policy object
yara_rules: Static rules