Managed XDR

vtdl_w4b4un62 (AveMaria) — отчёт о динамическом анализе вредоносного файла

Информация о файле

Имя файла
vtdl_w4b4un62
Тип файла
Rich Text Format data, version 1, unknown character set
Размер файла
135.7 KB
Первое обнаружение
Последнее обнаружение

Окружение

win7/x86 en

Хеши

SHA1
4af6c0e60e5c2c201c899cf99866d22b754dcd40
SHA256
31f380e91dcd3ea59e396a91c5d35d31bdc0a37eae23ece5f31ac74ef2af13af
MD5
e1e1237a89b0786b23f8cfe63fb16bcc

Вредоносное ПО

  • AveMaria

Сигнатуры

Execution

T1203 exploit_CVE_2017_11882: Exploits CVE-2017-11882 vulnerability
T1059.001 suspicious_powershell: Suspicious document behaviour (creates powershell process)
T1053.005 persistence_autorun: Makes itself run automatically on Windows startup
T1203 office_exploit_http: The document exhibits suspicious behaviour (performs HTTP requests)
T1047 has_wmi: Executes one or several WMI requests

Persistence

T1546.010 persistence_autorun: Makes itself run automatically on Windows startup
T1053.005 persistence_autorun: Makes itself run automatically on Windows startup
T1183 persistence_autorun: Makes itself run automatically on Windows startup
T1547 persistence_autorun: Makes itself run automatically on Windows startup
T1547.001 persistence_autorun: Makes itself run automatically on Windows startup
T1547.004 persistence_autorun: Makes itself run automatically on Windows startup

Privilege Escalation

T1053.005 persistence_autorun: Makes itself run automatically on Windows startup
T1183 persistence_autorun: Makes itself run automatically on Windows startup
T1546.010 persistence_autorun: Makes itself run automatically on Windows startup
T1547 persistence_autorun: Makes itself run automatically on Windows startup
T1547.001 persistence_autorun: Makes itself run automatically on Windows startup
T1547.004 persistence_autorun: Makes itself run automatically on Windows startup
T1055 injection_thread: Code injection to a remote process using CreateRemoteThread or NtQueueApcThread
T1055.012 injection_runpe: Injects code into another process
T1055 injection_runpe_2: Executes injected code in another process

Defense Evasion

T1183 persistence_autorun: Makes itself run automatically on Windows startup
T1055 injection_thread: Code injection to a remote process using CreateRemoteThread or NtQueueApcThread
T1055.012 injection_runpe: Injects code into another process
T1055 injection_runpe_2: Executes injected code in another process
T1096 persistence_ads: Creates Alternate Data Stream (ADS)
T1564.004 removes_zoneid_ads: Attempts to hide the indications that the file was downloaded from the Internet
T1027.002 unnamed_memory_regions: Code was executed in unnamed regions
T1027.002 unnamed_memory_regions_contains_pe: One or several unnamed memory regions are PE files
T1497.001 antivm_disk_size: Checks the amount of free disk space
T1497.001 antivm_queries_computername: Retrieves the computer name
T1497.003 antisandbox_sleep: The process attempted to slow down analysis

Credential Access

T1552 infostealer_browser: Retrieves personal information from local Internet browsers
T1503 infostealer_browser: Retrieves personal information from local Internet browsers
T1056.001 infostealer_keylogger: Keylogger (intercepts keystrokes)
T1552 infostealer_mail: Collects personal data from local email clients
T1555.004 windows_credential_manager: Acquire credentials from the Windows Credential Manager

Discovery

T1497.001 antivm_disk_size: Checks the amount of free disk space
T1057 process_interest: Enumerates processes
T1518 locates_browser: Attempts to identify where browsers are installed
T1497.001 antivm_queries_computername: Retrieves the computer name
T1497.003 antisandbox_sleep: The process attempted to slow down analysis
T1083 checks_recent_files: Attempt to check recently opened files through registry

Collection

T1056.001 infostealer_keylogger: Keylogger (intercepts keystrokes)
T1114 infostealer_mail: Collects personal data from local email clients

Command and Control

T1071.001 office_exploit_http: The document exhibits suspicious behaviour (performs HTTP requests)
T1071 network_irc: Connects to the IRC server, probably a botnet part
T1071.004 office_exploit_dns: The document exhibits suspicious behaviour (performs DNS requests)
T1071.001 network_http: Performs HTTP requests
T1071.001 wininet_https: Performs HTTP/HTTPS requests using WinInet

Other

yara_rules: Static rules
suricata_alert: Malicious traffic detected
executes_dropped_exe: Executes dropped exe files
creates_exe: Creates executable files in the file system
suspicious_process_network: Unusual process network activity detected
suspicious_process: Spawns a suspicious process
unexpected_exception: Unexpected exception
get_memory_status: Gets information about the virtual and physical memory of the system
creates_in_programdata: Creates files in the ProgramData directory
get_sid_domain: Get user's SID
get_username: Gets username
accesses_mailslot: Performs a Mailslot ping, possibly used to get Domain Controller information
test_check_service: Starts services
create_rpc_bindings: Creates RPC connection

Похожие отчёты