Managed XDR

emily-resume.doc — отчёт о динамическом анализе вредоносного файла

Информация о файле

Имя файла
emily-resume.doc
Тип файла
Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1252, Locale ID: 1033, Author: dazom, Subject: dlnwfkxw
Размер файла
31.5 KB
Первое обнаружение
Последнее обнаружение

Окружение

win7/x86 en

Хеши

SHA1
5b92830a14df707ec08b1f43eb5df0c101d393e1
SHA256
e893979638ec1c049da6ea00a6c420a5a66e25f2e8d20c7fe405611f3ead0a55
MD5
24951f76c21791263fdc3598b8178f48

Сигнатуры

Execution

T1203 office_exploit_creates_cmd: The document exhibits suspicious behaviour (creates a cmd.exe process)
T1203 office_exploit_http: The document exhibits suspicious behaviour (performs HTTP requests)
T1059.001 url_cmdline: Cmdline of process contains URL
T1059.003 url_cmdline: Cmdline of process contains URL
T1204.002 office_vb_load: Microsoft Office is loading VB DLL files (macros usage indicator)
T1106 susp_callbacks: Suspicious usage of some WinAPI with callbacks
T1064 office_macros: The document contains macro
T1064 office_macros_autoexec: The document contains an auto-start macro

Persistence

T1197 bitsadmin_download: Downloads a file using bitsadmin

Privilege Escalation

T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process

Defense Evasion

T1197 bitsadmin_download: Downloads a file using bitsadmin
T1070 stealth_window: A process created a hidden window
T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process
T1497 evasion_trustrecords: Attempts to detect Sandbox exploring trusted documents
T1497.001 antivm_queries_computername: Retrieves the computer name
T1064 office_macros: The document contains macro
T1064 office_macros_autoexec: The document contains an auto-start macro

Discovery

T1497 evasion_trustrecords: Attempts to detect Sandbox exploring trusted documents
T1497.001 antivm_queries_computername: Retrieves the computer name
T1135 server_share_info: Retrieves information about each shared resource on a server

Collection

T1560.001 archive_via_utility: Detected archiving data via utility

Command and Control

T1071.001 office_exploit_http: The document exhibits suspicious behaviour (performs HTTP requests)
T1071.004 office_exploit_dns: The document exhibits suspicious behaviour (performs DNS requests)
T1071.001 winhttp_https: Performs HTTP/HTTPS requests using WinHttp

Other

yara_rules: Static rules
dns_without_resolve: DNS query without a response
unexpected_exception: Unexpected exception
office_summary: The document contains suspicious metadata
create_rpc_bindings: Creates RPC connection
get_policy_info: Retrieves information about a Policy object
test_check_service: Starts services
antisandbox_check_graphics_card: Uses CreateDXGIFactory, potentially to detect graphics card
checktokenmembership: Checks user token with CheckTokenMembership call
Managed XDR