Managed XDR

vtdl_1752033861_j_ywts5b — malware analysis report

File info

Filename
vtdl_1752033861_j_ywts5b
File type
Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 936, Template: Normal.dot, Last Saved By: X, Revision Number: 4, Name of Creating Application: Microsoft Office Word, Total Editing Time: 11:00, Create Time/Date: Sat Jun 18 02:40:00 2011, Last Saved Time/Date: Wed Feb 29 06:48:00 2012, Number of Pages: 2, Number of Words: 51, Number of Characters: 292, Security: 0
File size
168.5 KB
First seen
Last seen

Environment

win7/x86 en

Hashes

SHA1
b93b67d035d6bf6b6467ae086c0262ab49e88bfe
SHA256
f37e7c0214c2dadadfd3914bf80e38cc5813ec601eb588339cf90d278e368690
MD5
a102b1f6cb0a13c328f60690a27ef440

Signatures

Privilege Escalation

T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process

Defense Evasion

T1497 evasion_trustrecords: Attempts to detect Sandbox exploring trusted documents
T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process

Discovery

T1083 checks_recent_files: Attempt to check recently opened files through registry
T1497 evasion_trustrecords: Attempts to detect Sandbox exploring trusted documents

Other

yara_rules: Static rules
get_policy_info: Retrieves information about a Policy object
test_check_service: Starts services
antisandbox_check_graphics_card: Uses CreateDXGIFactory, potentially to detect graphics card