Managed XDR

autorecovery-save-of-9...b879ed50681e7e.rtf.asd — malware analysis report

File info

Filename
autorecovery-save-of-9b3bb7b84b63d897157aaf46460389e69f370df9d6b879ed50681e7e.rtf.asd
File type
Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1252, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Wed Jul 31 23:05:00 2024, Number of Pages: 1, Number of Words: 96, Number of Characters: 550, Security: 0
File size
278 KB
First seen
Last seen

Environment

winxp/x86 en

Hashes

SHA1
e1655ea4f2b1506698bf3f30d6532637f6558e0d
SHA256
62228fb2c224338c9a36fcf257cab63c0b5b2c7cf22867bfb3eccd36096d2243
MD5
25b9c9e3e1cc2460ab9d546ad70b36e7

Signatures

Privilege Escalation

T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process

Defense Evasion

T1497 evasion_runmru: Attempts to detect Sandbox by Run MRU
T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process

Credential Access

T1555.003 cookie_files: Accesses cookie files
T1552 cookie_files: Accesses cookie files

Discovery

T1518 locates_browser: Attempts to identify where browsers are installed
T1497 evasion_runmru: Attempts to detect Sandbox by Run MRU

Command and Control

T1071.001 network_http: Performs HTTP requests

Other

yara_rules: Static rules
creates_in_programdata: Creates files in the ProgramData directory
Managed XDR