Managed XDR

vtdl_m7cgw5js — malware analysis report

File info

Filename
vtdl_m7cgw5js
File type
Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1251, Author: , Template: Normal.dotm, Last Saved By: , Revision Number: 2, Name of Creating Application: Microsoft Office Word, Last Printed: Mon Jan 16 08:14:00 2017, Create Time/Date: Thu Mar 30 11:16:00 2017, Last Saved Time/Date: Thu Mar 30 11:16:00 2017, Number of Pages: 2, Number of Words: 454, Number of Characters: 2588, Security: 4
File size
92 KB
First seen
Last seen

Environment

win7/x86 en

Hashes

SHA1
826d66b95067a82efee52728d56ce817c428e77d
SHA256
bfe7cfdcb864909bb1113972a7a0a380c8b7d967cf22d72342d1897aa16f7424
MD5
fccd0d398ef57450240269ec0f16c2a6

Signatures

Privilege Escalation

T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process

Defense Evasion

T1497.001 antivm_queries_computername: Retrieves the computer name
T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process

Credential Access

T1555.003 cookie_files: Accesses cookie files
T1552 cookie_files: Accesses cookie files

Discovery

T1497.001 antivm_queries_computername: Retrieves the computer name

Other

yara_rules: Static rules
create_rpc_bindings: Creates RPC connection
get_policy_info: Retrieves information about a Policy object
test_check_service: Starts services
antisandbox_check_graphics_card: Uses CreateDXGIFactory, potentially to detect graphics card