Managed XDR

autorecovery-save-of-m...port_2025_february.asd — malware analysis report

File info

Filename
autorecovery-save-of-monetary_policy_report_2025_february.asd
File type
Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1252, Title: Monetary Policy Report February 2025, Author: Central Bank of Sri Lanka, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Total Editing Time: 16:00, Create Time/Date: Fri Jan 31 06:42:00 2025, Last Saved Time/Date: Fri Jan 31 06:42:00 2025, Number of Pages: 48, Number of Words: 13005, Number of Characters: 74132, Security: 0
File size
860 KB
First seen
Last seen

Environment

win7/x86 en

Hashes

SHA1
d37299af4d65a64668c49d10537975f0c0cda096
SHA256
1a192857a84efbe5ca81c0a954c3b3496026d0b1745fb576e07dd3a4c09e26bf
MD5
b75deade21c8646ea78839833ede7af5

Signatures

Privilege Escalation

T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process

Defense Evasion

T1497 evasion_trustrecords: Attempts to detect Sandbox exploring trusted documents
T1497.001 antivm_queries_computername: Retrieves the computer name
T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process

Discovery

T1497 evasion_trustrecords: Attempts to detect Sandbox exploring trusted documents
T1497.001 antivm_queries_computername: Retrieves the computer name
T1135 server_share_info: Retrieves information about each shared resource on a server

Other

yara_rules: Static rules
create_rpc_bindings: Creates RPC connection
get_policy_info: Retrieves information about a Policy object
test_check_service: Starts services
office_links: Office file contains external links
antisandbox_check_graphics_card: Uses CreateDXGIFactory, potentially to detect graphics card