Managed XDR

autorecovery-save-of-infected-file.asd — отчёт о динамическом анализе вредоносного файла

Информация о файле

Имя файла
autorecovery-save-of-infected-file.asd
Тип файла
Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1252, Author: Campbell Longmire, Template: Normal.dotm, Last Saved By: Campbell Longmire, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Total Editing Time: 01:00, Create Time/Date: Mon Jul 28 23:39:00 2025, Last Saved Time/Date: Mon Jul 28 23:40:00 2025, Number of Pages: 1, Number of Words: 2, Number of Characters: 18, Security: 0
Размер файла
29 KB
Первое обнаружение
Последнее обнаружение

Окружение

w10/x86 en

Хеши

SHA1
08b9c4fabcf36663bb990185c92485508b341e3e
SHA256
1a91138e8020055117319f33417b106f26506a8ddf5b68f49e4097f559bd0de4
MD5
4eff3ac0e1320f8f89017340379f36df

Сигнатуры

Execution

T1204.002 office_com_load: Microsoft Office loads COM DLL files (indicator of COM usage in macros)

Credential Access

T1555.004 windows_credential_manager: Acquire credentials from the Windows Credential Manager

Other

yara_rules: Static rules
test_check_service: Starts services
writes_data: Writes big amount of data to disk
Managed XDR