Joe Sandbox Cloud Basic

Want to search on specific fields?


Try our:

Advanced Search

Want to search in depth on all Cloud Basic reports?

Try: Joe Sandbox View

Register Login
sloganpng
top title background image
flash

3BgX69C870.docx

Status: finished
Submission Time: 2022-08-18 10:12:11 +02:00
Malicious
Exploiter
Evader
Follina CVE-2022-30190

Comments

Tags

  • docx

Details

  • Analysis ID:
    686208
  • API (Web) ID:
    1053672
  • Analysis Started:
    2022-08-18 10:44:00 +02:00
  • Analysis Finished:
    2022-08-18 10:50:02 +02:00
  • MD5:
    d805b55d60f9ca73ae71ed68ff692175
  • SHA1:
    947691dbba33dfeb974babcb43d3ceb7991dae29
  • SHA256:
    6a0acf2389d95abc590c8b6a327521312c4de176efce271468817c840745a096
  • Technologies:

Joe Sandbox

Engine Download Report Detection Info
Full Report Management Report IOC Report
malicious
Score: 100
System: Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)

Third Party Analysis Engines

Open Full Report
malicious
Score: 7/35
malicious
Score: 17/26
malicious
malicious

IPs

IP Country Detection
50.31.246.2
 United States

Domains

Name IP Detection
ascota.cc
 50.31.246.2

URLs

Name Detection
https://ascota.cc/index.html
https://ascota.cc/index.htmlyX

Dropped files

Name File Type Hashes Detection
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\index[1].htm
 HTML document, ASCII text
 #
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\951D3BEA.htm
 HTML document, ASCII text
 #
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\DB03D47C.htm
 HTML document, ASCII text
 #
Click to see the 16 hidden entries
C:\Users\user\Desktop\~$gX69C870.docx
 data
 #
C:\Users\user\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSD-CNRY.FSD
 data
 #
C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm
 data
 #
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat
 ASCII text, with CRLF line terminators
 #
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\3BgX69C870.LNK
 MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Thu Aug 18 16:44:03 2022, mtime=Thu Aug 18 16:44:03 2022, atime=Thu Aug 18 16:44:14 2022, length=15283, window=hide
 #
C:\Users\user\AppData\Local\Temp\{3030D6C8-DC9E-4CCC-8285-A68F140AE3A2}
 data
 #
C:\Users\user\AppData\Local\Temp\{1745517E-048D-4BB7-909A-157B39D88B65}
 data
 #
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{5F4EA255-C5EC-4225-B349-94755FC9E7B4}.tmp
 data
 #
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{27621888-E8BB-4FE6-AECB-5EEE72734B15}.tmp
 data
 #
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{CAFD337F-CA0A-421A-962F-5A83F314B963}.tmp
 Composite Document File V2 Document, Cannot read section info
 #
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\739101BE.emf
 Windows Enhanced Metafile (EMF) image data version 0x10000
 #
C:\Users\user\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSF-{0E1EEE64-E8C6-4E2A-9759-63CF07FD8988}.FSF
 data
 #
C:\Users\user\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSD-{1B7B41A5-9895-47A6-B199-1C3C2D73F38A}.FSD
 data
 #
C:\Users\user\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSD-CNRY.FSD
 data
 #
C:\Users\user\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSF-CTBL.FSF
 data
 #
C:\Users\user\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSD-{18325489-8F7D-4DDB-A0BA-943F66DE838D}.FSD
 data
 #