Managed XDR

c-users-user-appdata-l...dfb4b171f24f21b714.tmp — malware analysis report

File info

Filename
c-users-user-appdata-local-temp-dfb4b171f24f21b714.tmp
File type
Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 950, Title: 20231124174046_R(), Author: Joseph, Template: Normal, Last Saved By: X L, Revision Number: 2, Name of Creating Application: Microsoft Office Word, Total Editing Time: Mon Feb 16 03:28:00 9767, Create Time/Date: Fri Nov 24 01:41:00 2023, Last Saved Time/Date: Tue Dec 24 03:04:00 2024, Number of Pages: 7, Number of Words: 907, Number of Characters: 5175, Security: 0
File size
400 KB
First seen
Last seen

Environment

w10/x86 en

Hashes

SHA1
274a0d78d617ebb8987f3d6f059cce7efe0c0db6
SHA256
dbac11673cece159dcde4e4e9730f08b8736a23d894cd8dffa37d4a516b06c82
MD5
012e826ca8e23abf81ce5668782105de

Signatures

Execution

T1203 exploit_CVE_2017_11882: Exploits CVE-2017-11882 vulnerability
T1064 office_macros: The document contains macro
T1204.002 office_vb_load: Microsoft Office is loading VB DLL files (macros usage indicator)
T1204.002 office_com_load: Microsoft Office loads COM DLL files (indicator of COM usage in macros)

Defense Evasion

T1064 office_macros: The document contains macro

Other

dead_host: Connects to IP addresses that do not respond to requests
process_crashed: One of the processes has failed
unexpected_exception: Unexpected exception
creates_suspended_process: Creates suspended process
break_limit_exceeded: Warning: function calls limit has been exceeded
message_box: Displays a message
test_check_service: Starts services