Managed XDR

autorecovery-save-of-gehaltsliste2025.asd — malware analysis report

File info

Filename
autorecovery-save-of-gehaltsliste2025.asd
File type
Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1252, Author: Microsoft, Template: Normal.dotm, Last Saved By: Microsoft, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Wed Jan 15 05:40:00 2025, Number of Pages: 1, Number of Words: 13, Number of Characters: 75, Security: 0
File size
21 KB
First seen
Last seen

Environment

win7/x86 en

Hashes

SHA1
4e0144faaf73641567b92682f62cd0b52d1b75b5
SHA256
6ee49bc17dab18973cc0ea2ade6e990084206aeebf350795d953d3f37a581e70
MD5
886375334f134c1afdb5ee9885c15602

Signatures

Privilege Escalation

T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process

Defense Evasion

T1497.001 antivm_queries_computername: Retrieves the computer name
T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process

Discovery

T1497.001 antivm_queries_computername: Retrieves the computer name

Other

yara_rules: Static rules
get_policy_info: Retrieves information about a Policy object
test_check_service: Starts services
antisandbox_check_graphics_card: Uses CreateDXGIFactory, potentially to detect graphics card