Managed XDR

vtdl_ceqbudgl — malware analysis report

File info

Filename
vtdl_ceqbudgl
File type
MS Windows shortcut, Item id list present, Points to a file or directory, Has command line arguments, Icon number=7, Archive, ctime=Thu Dec 5 01:15:09 2019, mtime=Thu Dec 5 01:15:09 2019, atime=Thu Dec 5 01:15:09 2019, length=280064, window=hidenormalshowminimized
File size
1.7 KB
First seen
Last seen

Environment

win7/x86 en

Hashes

SHA1
3cfce8b51f4346c49f27481526b7bd5b3b7fe659
SHA256
8cbb092f77864664621f05d2b0c0b7331181be1070102fb79bd7977e646d1317
MD5
6659f66a9db311e5a91b7d9fe0119269

Signatures

Execution

T1204 suspicious_lnk: LNK file with suspicious content

Privilege Escalation

T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process

Defense Evasion

T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process

Other

yara_rules: Static rules
unexpected_exception: Unexpected exception
creates_suspended_process: Creates suspended process
get_policy_info: Retrieves information about a Policy object