Windows Analysis Report
ZDhoKQk8G6.docx

Overview

General Information

Sample Name: ZDhoKQk8G6.docx
Analysis ID: 645905
MD5: b64108b4dbb4cc0ceeca091289d3c3e6
SHA1: ad1eb7107e76f8d75cdb2c3a8cc39179dd490ef0
SHA256: 52b48c4b2f4a63fc6611dea7e9146a440d41e306143788ea20c56c3ab292cf00
Tags: docdocxFollina
Infos:

Detection

Follina CVE-2022-30190
Score: 84
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Multi AV Scanner detection for submitted file
Yara detected Microsoft Office Exploit Follina CVE-2022-30190
Malicious sample detected (through community Yara rule)
Snort IDS alert for network traffic
Contains an external reference to another file
Uses known network protocols on non-standard ports
Detected suspicious Microsoft Office reference URL
Yara signature match
Potential document exploit detected (unknown TCP traffic)
Uses a known web browser user agent for HTTP communication
Detected TCP or UDP traffic on non-standard ports
Internet Provider seen in connection with other malware
Potential document exploit detected (performs HTTP gets)
Document misses a certain OLE stream usually present in this Microsoft Office document type

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: ZDhoKQk8G6.docx Virustotal: Detection: 25% Perma Link
Source: ZDhoKQk8G6.docx ReversingLabs: Detection: 17%

Exploits
barindex
Yara detected Microsoft Office Exploit Follina CVE-2022-30190
Source: Yara match File source: dump.pcap, type: PCAP
Source: Yara match File source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\exploit[1].htm, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\7341AC3F.htm, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\722BFA5.htm, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\exploit[1].htm, type: DROPPED
Detected suspicious Microsoft Office reference URL
Source: document.xml.rels Extracted files from sample: http://117.48.146.246:8008/exploit.htm!
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Potential document exploit detected (unknown TCP traffic)
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 117.48.146.246:8008
Potential document exploit detected (performs HTTP gets)
Source: global traffic TCP traffic: 192.168.2.22:49178 -> 117.48.146.246:8008

Networking
barindex
Snort IDS alert for network traffic
Source: Traffic Snort IDS: 2023942 ET TROJAN Possibly Malicious Base64 Unicode WebClient DownloadString M2 117.48.146.246:8008 -> 192.168.2.22:49178
Source: Traffic Snort IDS: 2023941 ET TROJAN Possibly Malicious Base64 Unicode WebClient DownloadString M1 117.48.146.246:8008 -> 192.168.2.22:49178
Source: Traffic Snort IDS: 2036726 ET EXPLOIT Possible Microsoft Support Diagnostic Tool Exploitation Inbound (CVE-2022-30190) 117.48.146.246:8008 -> 192.168.2.22:49178
Source: Traffic Snort IDS: 2023942 ET TROJAN Possibly Malicious Base64 Unicode WebClient DownloadString M2 117.48.146.246:8008 -> 192.168.2.22:49181
Source: Traffic Snort IDS: 2023941 ET TROJAN Possibly Malicious Base64 Unicode WebClient DownloadString M1 117.48.146.246:8008 -> 192.168.2.22:49181
Source: Traffic Snort IDS: 2036726 ET EXPLOIT Possible Microsoft Support Diagnostic Tool Exploitation Inbound (CVE-2022-30190) 117.48.146.246:8008 -> 192.168.2.22:49181
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 49173 -> 8008
Source: unknown Network traffic detected: HTTP traffic on port 8008 -> 49173
Source: unknown Network traffic detected: HTTP traffic on port 49174 -> 8008
Source: unknown Network traffic detected: HTTP traffic on port 8008 -> 49174
Source: unknown Network traffic detected: HTTP traffic on port 49175 -> 8008
Source: unknown Network traffic detected: HTTP traffic on port 8008 -> 49175
Source: unknown Network traffic detected: HTTP traffic on port 8008 -> 49176
Source: unknown Network traffic detected: HTTP traffic on port 8008 -> 49177
Source: unknown Network traffic detected: HTTP traffic on port 49178 -> 8008
Source: unknown Network traffic detected: HTTP traffic on port 8008 -> 49178
Source: unknown Network traffic detected: HTTP traffic on port 49179 -> 8008
Source: unknown Network traffic detected: HTTP traffic on port 8008 -> 49179
Source: unknown Network traffic detected: HTTP traffic on port 49180 -> 8008
Source: unknown Network traffic detected: HTTP traffic on port 8008 -> 49180
Source: unknown Network traffic detected: HTTP traffic on port 49181 -> 8008
Source: unknown Network traffic detected: HTTP traffic on port 8008 -> 49181
Source: unknown Network traffic detected: HTTP traffic on port 49182 -> 8008
Source: unknown Network traffic detected: HTTP traffic on port 8008 -> 49182
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /exploit.htm HTTP/1.1Accept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; ms-office; MSOffice 14)UA-CPU: AMD64Accept-Encoding: gzip, deflateHost: 117.48.146.246:8008Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /exploit.htm HTTP/1.1Accept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; ms-office; MSOffice 14)UA-CPU: AMD64Accept-Encoding: gzip, deflateHost: 117.48.146.246:8008Connection: Keep-Alive
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 117.48.146.246:8008
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: CHINA169-BACKBONECHINAUNICOMChina169BackboneCN CHINA169-BACKBONECHINAUNICOMChina169BackboneCN
Source: unknown TCP traffic detected without corresponding DNS query: 117.48.146.246
Source: unknown TCP traffic detected without corresponding DNS query: 117.48.146.246
Source: unknown TCP traffic detected without corresponding DNS query: 117.48.146.246
Source: unknown TCP traffic detected without corresponding DNS query: 117.48.146.246
Source: unknown TCP traffic detected without corresponding DNS query: 117.48.146.246
Source: unknown TCP traffic detected without corresponding DNS query: 117.48.146.246
Source: unknown TCP traffic detected without corresponding DNS query: 117.48.146.246
Source: unknown TCP traffic detected without corresponding DNS query: 117.48.146.246
Source: unknown TCP traffic detected without corresponding DNS query: 117.48.146.246
Source: unknown TCP traffic detected without corresponding DNS query: 117.48.146.246
Source: unknown TCP traffic detected without corresponding DNS query: 117.48.146.246
Source: unknown TCP traffic detected without corresponding DNS query: 117.48.146.246
Source: unknown TCP traffic detected without corresponding DNS query: 117.48.146.246
Source: unknown TCP traffic detected without corresponding DNS query: 117.48.146.246
Source: unknown TCP traffic detected without corresponding DNS query: 117.48.146.246
Source: unknown TCP traffic detected without corresponding DNS query: 117.48.146.246
Source: unknown TCP traffic detected without corresponding DNS query: 117.48.146.246
Source: unknown TCP traffic detected without corresponding DNS query: 117.48.146.246
Source: unknown TCP traffic detected without corresponding DNS query: 117.48.146.246
Source: unknown TCP traffic detected without corresponding DNS query: 117.48.146.246
Source: unknown TCP traffic detected without corresponding DNS query: 117.48.146.246
Source: unknown TCP traffic detected without corresponding DNS query: 117.48.146.246
Source: unknown TCP traffic detected without corresponding DNS query: 117.48.146.246
Source: unknown TCP traffic detected without corresponding DNS query: 117.48.146.246
Source: unknown TCP traffic detected without corresponding DNS query: 117.48.146.246
Source: unknown TCP traffic detected without corresponding DNS query: 117.48.146.246
Source: unknown TCP traffic detected without corresponding DNS query: 117.48.146.246
Source: unknown TCP traffic detected without corresponding DNS query: 117.48.146.246
Source: unknown TCP traffic detected without corresponding DNS query: 117.48.146.246
Source: unknown TCP traffic detected without corresponding DNS query: 117.48.146.246
Source: unknown TCP traffic detected without corresponding DNS query: 117.48.146.246
Source: unknown TCP traffic detected without corresponding DNS query: 117.48.146.246
Source: unknown TCP traffic detected without corresponding DNS query: 117.48.146.246
Source: unknown TCP traffic detected without corresponding DNS query: 117.48.146.246
Source: unknown TCP traffic detected without corresponding DNS query: 117.48.146.246
Source: unknown TCP traffic detected without corresponding DNS query: 117.48.146.246
Source: unknown TCP traffic detected without corresponding DNS query: 117.48.146.246
Source: unknown TCP traffic detected without corresponding DNS query: 117.48.146.246
Source: unknown TCP traffic detected without corresponding DNS query: 117.48.146.246
Source: unknown TCP traffic detected without corresponding DNS query: 117.48.146.246
Source: unknown TCP traffic detected without corresponding DNS query: 117.48.146.246
Source: unknown TCP traffic detected without corresponding DNS query: 117.48.146.246
Source: unknown TCP traffic detected without corresponding DNS query: 117.48.146.246
Source: unknown TCP traffic detected without corresponding DNS query: 117.48.146.246
Source: unknown TCP traffic detected without corresponding DNS query: 117.48.146.246
Source: unknown TCP traffic detected without corresponding DNS query: 117.48.146.246
Source: unknown TCP traffic detected without corresponding DNS query: 117.48.146.246
Source: unknown TCP traffic detected without corresponding DNS query: 117.48.146.246
Source: unknown TCP traffic detected without corresponding DNS query: 117.48.146.246
Source: unknown TCP traffic detected without corresponding DNS query: 117.48.146.246
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 15 Jun 2022 05:10:34 GMTContent-Type: text/plainContent-Length: 0
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 15 Jun 2022 05:10:35 GMTContent-Type: text/plainContent-Length: 0
Source: ~WRF{365EE8EB-26DD-4793-A79E-4CD05254F7C9}.tmp.0.dr String found in binary or memory: http://117.48.146.246:8008/exp
Source: ~WRF{365EE8EB-26DD-4793-A79E-4CD05254F7C9}.tmp.0.dr, ~WRS{E3D2E09D-939E-4CE8-8CEF-3005BD062461}.tmp.0.dr String found in binary or memory: http://117.48.146.246:8008/exploit.htm
Source: ~WRF{365EE8EB-26DD-4793-A79E-4CD05254F7C9}.tmp.0.dr String found in binary or memory: http://117.48.146.246:8008/exploit.htmyX
Source: document.xml String found in binary or memory: https://img1.18183.com/image/20220427/1651040288153109.png
Source: document.xml String found in binary or memory: https://img1.18183.com/image/20220427/1651040297422300.png
Source: document.xml String found in binary or memory: https://img1.18183.com/image/20220427/1651040303449177.png
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{F2A88E0D-A9AE-4C78-97ED-928ECF332904}.tmp Jump to behavior
Source: global traffic HTTP traffic detected: GET /exploit.htm HTTP/1.1Accept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; ms-office; MSOffice 14)UA-CPU: AMD64Accept-Encoding: gzip, deflateHost: 117.48.146.246:8008Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /exploit.htm HTTP/1.1Accept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; ms-office; MSOffice 14)UA-CPU: AMD64Accept-Encoding: gzip, deflateHost: 117.48.146.246:8008Connection: Keep-Alive

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: document.xml.rels, type: SAMPLE Matched rule: Detects XML relations where an OLE object is refrencing an external target in dropper OOXML documents Author: ditekSHen
Yara signature match
Source: dump.pcap, type: PCAP Matched rule: EXPL_Follina_CVE_2022_30190_Msdt_MSProtocolURI_May22 date = 2022-05-30, author = Tobias Michalski, Christian Burkard, description = Detects the malicious usage of the ms-msdt URI as seen in CVE-2022-30190 / Follina exploitation, reference = https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e, score = , modified = 2022-05-31, hash = 4a24048f81afbe9fb62e7a6a49adbd1faf41f266b5f9feecdceb567aec096784
Source: document.xml.rels, type: SAMPLE Matched rule: SUSP_Doc_WordXMLRels_May22 date = 2022-05-30, author = Tobias Michalski, Christian Burkard, Wojciech Cieslak, description = Detects a suspicious pattern in docx document.xml.rels file as seen in CVE-2022-30190 / Follina exploitation, reference = https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e, score = , modified = 2022-06-02, hash = 62f262d180a5a48f89be19369a8425bec596bc6a02ed23100424930791ae3df0
Source: document.xml.rels, type: SAMPLE Matched rule: INDICATOR_OLE_RemoteTemplate author = ditekSHen, description = Detects XML relations where an OLE object is refrencing an external target in dropper OOXML documents
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\exploit[1].htm, type: DROPPED Matched rule: EXPL_Follina_CVE_2022_30190_Msdt_MSProtocolURI_May22 date = 2022-05-30, author = Tobias Michalski, Christian Burkard, description = Detects the malicious usage of the ms-msdt URI as seen in CVE-2022-30190 / Follina exploitation, reference = https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e, score = , modified = 2022-05-31, hash = 4a24048f81afbe9fb62e7a6a49adbd1faf41f266b5f9feecdceb567aec096784
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\7341AC3F.htm, type: DROPPED Matched rule: EXPL_Follina_CVE_2022_30190_Msdt_MSProtocolURI_May22 date = 2022-05-30, author = Tobias Michalski, Christian Burkard, description = Detects the malicious usage of the ms-msdt URI as seen in CVE-2022-30190 / Follina exploitation, reference = https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e, score = , modified = 2022-05-31, hash = 4a24048f81afbe9fb62e7a6a49adbd1faf41f266b5f9feecdceb567aec096784
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\722BFA5.htm, type: DROPPED Matched rule: EXPL_Follina_CVE_2022_30190_Msdt_MSProtocolURI_May22 date = 2022-05-30, author = Tobias Michalski, Christian Burkard, description = Detects the malicious usage of the ms-msdt URI as seen in CVE-2022-30190 / Follina exploitation, reference = https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e, score = , modified = 2022-05-31, hash = 4a24048f81afbe9fb62e7a6a49adbd1faf41f266b5f9feecdceb567aec096784
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\exploit[1].htm, type: DROPPED Matched rule: EXPL_Follina_CVE_2022_30190_Msdt_MSProtocolURI_May22 date = 2022-05-30, author = Tobias Michalski, Christian Burkard, description = Detects the malicious usage of the ms-msdt URI as seen in CVE-2022-30190 / Follina exploitation, reference = https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e, score = , modified = 2022-05-31, hash = 4a24048f81afbe9fb62e7a6a49adbd1faf41f266b5f9feecdceb567aec096784
Document misses a certain OLE stream usually present in this Microsoft Office document type
Source: ~WRF{365EE8EB-26DD-4793-A79E-4CD05254F7C9}.tmp.0.dr OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: ZDhoKQk8G6.docx Virustotal: Detection: 25%
Source: ZDhoKQk8G6.docx ReversingLabs: Detection: 17%
Source: ZDhoKQk8G6.LNK.0.dr LNK file: ..\..\..\..\..\Desktop\ZDhoKQk8G6.docx
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\Desktop\~$hoKQk8G6.docx Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\AppData\Local\Temp\CVR5F4E.tmp Jump to behavior
Source: classification engine Classification label: mal84.troj.expl.evad.winDOCX@1/22@0/1
Source: ~WRF{365EE8EB-26DD-4793-A79E-4CD05254F7C9}.tmp.0.dr OLE document summary: title field not present or empty
Source: ~WRF{365EE8EB-26DD-4793-A79E-4CD05254F7C9}.tmp.0.dr OLE document summary: author field not present or empty
Source: ~WRF{365EE8EB-26DD-4793-A79E-4CD05254F7C9}.tmp.0.dr OLE document summary: edited time not present or 0
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File read: C:\Users\desktop.ini Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: ~WRF{365EE8EB-26DD-4793-A79E-4CD05254F7C9}.tmp.0.dr Initial sample: OLE indicators vbamacros = False

Persistence and Installation Behavior
barindex
Contains an external reference to another file
Source: document.xml.rels Extracted files from sample: http://117.48.146.246:8008/exploit.htm!

Hooking and other Techniques for Hiding and Protection
barindex
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 49173 -> 8008
Source: unknown Network traffic detected: HTTP traffic on port 8008 -> 49173
Source: unknown Network traffic detected: HTTP traffic on port 49174 -> 8008
Source: unknown Network traffic detected: HTTP traffic on port 8008 -> 49174
Source: unknown Network traffic detected: HTTP traffic on port 49175 -> 8008
Source: unknown Network traffic detected: HTTP traffic on port 8008 -> 49175
Source: unknown Network traffic detected: HTTP traffic on port 8008 -> 49176
Source: unknown Network traffic detected: HTTP traffic on port 8008 -> 49177
Source: unknown Network traffic detected: HTTP traffic on port 49178 -> 8008
Source: unknown Network traffic detected: HTTP traffic on port 8008 -> 49178
Source: unknown Network traffic detected: HTTP traffic on port 49179 -> 8008
Source: unknown Network traffic detected: HTTP traffic on port 8008 -> 49179
Source: unknown Network traffic detected: HTTP traffic on port 49180 -> 8008
Source: unknown Network traffic detected: HTTP traffic on port 8008 -> 49180
Source: unknown Network traffic detected: HTTP traffic on port 49181 -> 8008
Source: unknown Network traffic detected: HTTP traffic on port 8008 -> 49181
Source: unknown Network traffic detected: HTTP traffic on port 49182 -> 8008
Source: unknown Network traffic detected: HTTP traffic on port 8008 -> 49182
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 645905 Sample: ZDhoKQk8G6.docx Startdate: 15/06/2022 Architecture: WINDOWS Score: 84 17 Snort IDS alert for network traffic 2->17 19 Malicious sample detected (through community Yara rule) 2->19 21 Multi AV Scanner detection for submitted file 2->21 23 4 other signatures 2->23 5 WINWORD.EXE 503 59 2->5         started        process3 dnsIp4 15 117.48.146.246, 49173, 49174, 49175 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN China 5->15 9 C:\Users\user\AppData\Local\...\7341AC3F.htm, HTML 5->9 dropped 11 C:\Users\user\AppData\Local\...\722BFA5.htm, HTML 5->11 dropped 13 C:\Users\user\AppData\...\exploit[1].htm, HTML 5->13 dropped file5
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
117.48.146.246
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN true