Windows Analysis Report
V3g2Pfu707.docx

Overview

General Information

Sample Name: V3g2Pfu707.docx
Analysis ID: 647003
MD5: b60cd79e2c14dbeefa22197f76fc3437
SHA1: 07a2811a3ea7a4a0c84e52cb5a48f1e712b55fd9
SHA256: 6ddab79a6d836f9c1ed9ab3bbe28a074c0c93bd87f55144ed62b23c0032715d1
Tags: CVE-2022-30190docfollina
Infos:

Detection

Follina CVE-2022-30190
Score: 76
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Multi AV Scanner detection for submitted file
Yara detected Microsoft Office Exploit Follina CVE-2022-30190
Malicious sample detected (through community Yara rule)
Contains an external reference to another file
Uses known network protocols on non-standard ports
Detected suspicious Microsoft Office reference URL
Yara signature match
Potential document exploit detected (unknown TCP traffic)
Uses a known web browser user agent for HTTP communication
Detected TCP or UDP traffic on non-standard ports
Internet Provider seen in connection with other malware
Potential document exploit detected (performs HTTP gets)
Document misses a certain OLE stream usually present in this Microsoft Office document type

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: V3g2Pfu707.docx Virustotal: Detection: 33% Perma Link

Exploits
barindex
Yara detected Microsoft Office Exploit Follina CVE-2022-30190
Source: Yara match File source: dump.pcap, type: PCAP
Source: Yara match File source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\6B087DC1.htm, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\42A30EFB.htm, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\exploit[1].htm, type: DROPPED
Detected suspicious Microsoft Office reference URL
Source: document.xml.rels Extracted files from sample: http://101.33.231.81:62563/exploit.html!
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Potential document exploit detected (unknown TCP traffic)
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 101.33.231.81:62563
Potential document exploit detected (performs HTTP gets)
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 101.33.231.81:62563

Networking
barindex
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 49171 -> 62563
Source: unknown Network traffic detected: HTTP traffic on port 62563 -> 49171
Source: unknown Network traffic detected: HTTP traffic on port 49172 -> 62563
Source: unknown Network traffic detected: HTTP traffic on port 62563 -> 49172
Source: unknown Network traffic detected: HTTP traffic on port 49173 -> 62563
Source: unknown Network traffic detected: HTTP traffic on port 62563 -> 49173
Source: unknown Network traffic detected: HTTP traffic on port 49174 -> 62563
Source: unknown Network traffic detected: HTTP traffic on port 62563 -> 49174
Source: unknown Network traffic detected: HTTP traffic on port 49175 -> 62563
Source: unknown Network traffic detected: HTTP traffic on port 62563 -> 49175
Source: unknown Network traffic detected: HTTP traffic on port 49176 -> 62563
Source: unknown Network traffic detected: HTTP traffic on port 62563 -> 49176
Source: unknown Network traffic detected: HTTP traffic on port 49177 -> 62563
Source: unknown Network traffic detected: HTTP traffic on port 62563 -> 49177
Source: unknown Network traffic detected: HTTP traffic on port 49178 -> 62563
Source: unknown Network traffic detected: HTTP traffic on port 62563 -> 49178
Source: unknown Network traffic detected: HTTP traffic on port 49179 -> 62563
Source: unknown Network traffic detected: HTTP traffic on port 62563 -> 49179
Source: unknown Network traffic detected: HTTP traffic on port 49180 -> 62563
Source: unknown Network traffic detected: HTTP traffic on port 62563 -> 49180
Source: unknown Network traffic detected: HTTP traffic on port 49181 -> 62563
Source: unknown Network traffic detected: HTTP traffic on port 62563 -> 49181
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /exploit.html HTTP/1.1Accept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; ms-office; MSOffice 14)UA-CPU: AMD64Accept-Encoding: gzip, deflateHost: 101.33.231.81:62563Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /exploit.html HTTP/1.1Accept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; ms-office; MSOffice 14)UA-CPU: AMD64Accept-Encoding: gzip, deflateHost: 101.33.231.81:62563If-Modified-Since: Tue, 14 Jun 2022 15:37:10 GMT; length=5737Connection: Keep-Alive
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 101.33.231.81:62563
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: TENCENT-NET-AP-CNTencentBuildingKejizhongyiAvenueCN TENCENT-NET-AP-CNTencentBuildingKejizhongyiAvenueCN
Source: unknown TCP traffic detected without corresponding DNS query: 101.33.231.81
Source: unknown TCP traffic detected without corresponding DNS query: 101.33.231.81
Source: unknown TCP traffic detected without corresponding DNS query: 101.33.231.81
Source: unknown TCP traffic detected without corresponding DNS query: 101.33.231.81
Source: unknown TCP traffic detected without corresponding DNS query: 101.33.231.81
Source: unknown TCP traffic detected without corresponding DNS query: 101.33.231.81
Source: unknown TCP traffic detected without corresponding DNS query: 101.33.231.81
Source: unknown TCP traffic detected without corresponding DNS query: 101.33.231.81
Source: unknown TCP traffic detected without corresponding DNS query: 101.33.231.81
Source: unknown TCP traffic detected without corresponding DNS query: 101.33.231.81
Source: unknown TCP traffic detected without corresponding DNS query: 101.33.231.81
Source: unknown TCP traffic detected without corresponding DNS query: 101.33.231.81
Source: unknown TCP traffic detected without corresponding DNS query: 101.33.231.81
Source: unknown TCP traffic detected without corresponding DNS query: 101.33.231.81
Source: unknown TCP traffic detected without corresponding DNS query: 101.33.231.81
Source: unknown TCP traffic detected without corresponding DNS query: 101.33.231.81
Source: unknown TCP traffic detected without corresponding DNS query: 101.33.231.81
Source: unknown TCP traffic detected without corresponding DNS query: 101.33.231.81
Source: unknown TCP traffic detected without corresponding DNS query: 101.33.231.81
Source: unknown TCP traffic detected without corresponding DNS query: 101.33.231.81
Source: unknown TCP traffic detected without corresponding DNS query: 101.33.231.81
Source: unknown TCP traffic detected without corresponding DNS query: 101.33.231.81
Source: unknown TCP traffic detected without corresponding DNS query: 101.33.231.81
Source: unknown TCP traffic detected without corresponding DNS query: 101.33.231.81
Source: unknown TCP traffic detected without corresponding DNS query: 101.33.231.81
Source: unknown TCP traffic detected without corresponding DNS query: 101.33.231.81
Source: unknown TCP traffic detected without corresponding DNS query: 101.33.231.81
Source: unknown TCP traffic detected without corresponding DNS query: 101.33.231.81
Source: unknown TCP traffic detected without corresponding DNS query: 101.33.231.81
Source: unknown TCP traffic detected without corresponding DNS query: 101.33.231.81
Source: unknown TCP traffic detected without corresponding DNS query: 101.33.231.81
Source: unknown TCP traffic detected without corresponding DNS query: 101.33.231.81
Source: unknown TCP traffic detected without corresponding DNS query: 101.33.231.81
Source: unknown TCP traffic detected without corresponding DNS query: 101.33.231.81
Source: unknown TCP traffic detected without corresponding DNS query: 101.33.231.81
Source: unknown TCP traffic detected without corresponding DNS query: 101.33.231.81
Source: unknown TCP traffic detected without corresponding DNS query: 101.33.231.81
Source: unknown TCP traffic detected without corresponding DNS query: 101.33.231.81
Source: unknown TCP traffic detected without corresponding DNS query: 101.33.231.81
Source: unknown TCP traffic detected without corresponding DNS query: 101.33.231.81
Source: unknown TCP traffic detected without corresponding DNS query: 101.33.231.81
Source: unknown TCP traffic detected without corresponding DNS query: 101.33.231.81
Source: unknown TCP traffic detected without corresponding DNS query: 101.33.231.81
Source: unknown TCP traffic detected without corresponding DNS query: 101.33.231.81
Source: unknown TCP traffic detected without corresponding DNS query: 101.33.231.81
Source: unknown TCP traffic detected without corresponding DNS query: 101.33.231.81
Source: unknown TCP traffic detected without corresponding DNS query: 101.33.231.81
Source: unknown TCP traffic detected without corresponding DNS query: 101.33.231.81
Source: unknown TCP traffic detected without corresponding DNS query: 101.33.231.81
Source: unknown TCP traffic detected without corresponding DNS query: 101.33.231.81
Source: ~WRF{6245E340-9A7D-4D8C-95F3-E607A94CA060}.tmp.0.dr, ~WRS{F19FE166-8B13-4DD0-BB8B-900FB9050402}.tmp.0.dr String found in binary or memory: http://101.33.231.81:62563/exploit.html
Source: ~WRF{6245E340-9A7D-4D8C-95F3-E607A94CA060}.tmp.0.dr String found in binary or memory: http://101.33.231.81:62563/exploit.htmlyX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{6A4592DE-D21D-4642-AE77-FFCC3AAD3185}.tmp Jump to behavior
Source: global traffic HTTP traffic detected: GET /exploit.html HTTP/1.1Accept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; ms-office; MSOffice 14)UA-CPU: AMD64Accept-Encoding: gzip, deflateHost: 101.33.231.81:62563Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /exploit.html HTTP/1.1Accept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; ms-office; MSOffice 14)UA-CPU: AMD64Accept-Encoding: gzip, deflateHost: 101.33.231.81:62563If-Modified-Since: Tue, 14 Jun 2022 15:37:10 GMT; length=5737Connection: Keep-Alive

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: document.xml.rels, type: SAMPLE Matched rule: Detects XML relations where an OLE object is refrencing an external target in dropper OOXML documents Author: ditekSHen
Yara signature match
Source: dump.pcap, type: PCAP Matched rule: EXPL_Follina_CVE_2022_30190_Msdt_MSProtocolURI_May22 date = 2022-05-30, author = Tobias Michalski, Christian Burkard, description = Detects the malicious usage of the ms-msdt URI as seen in CVE-2022-30190 / Follina exploitation, reference = https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e, score = , modified = 2022-05-31, hash = 4a24048f81afbe9fb62e7a6a49adbd1faf41f266b5f9feecdceb567aec096784
Source: document.xml.rels, type: SAMPLE Matched rule: SUSP_Doc_WordXMLRels_May22 date = 2022-05-30, author = Tobias Michalski, Christian Burkard, Wojciech Cieslak, description = Detects a suspicious pattern in docx document.xml.rels file as seen in CVE-2022-30190 / Follina exploitation, reference = https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e, score = , modified = 2022-06-02, hash = 62f262d180a5a48f89be19369a8425bec596bc6a02ed23100424930791ae3df0
Source: document.xml.rels, type: SAMPLE Matched rule: INDICATOR_OLE_RemoteTemplate author = ditekSHen, description = Detects XML relations where an OLE object is refrencing an external target in dropper OOXML documents
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\6B087DC1.htm, type: DROPPED Matched rule: EXPL_Follina_CVE_2022_30190_Msdt_MSProtocolURI_May22 date = 2022-05-30, author = Tobias Michalski, Christian Burkard, description = Detects the malicious usage of the ms-msdt URI as seen in CVE-2022-30190 / Follina exploitation, reference = https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e, score = , modified = 2022-05-31, hash = 4a24048f81afbe9fb62e7a6a49adbd1faf41f266b5f9feecdceb567aec096784
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\42A30EFB.htm, type: DROPPED Matched rule: EXPL_Follina_CVE_2022_30190_Msdt_MSProtocolURI_May22 date = 2022-05-30, author = Tobias Michalski, Christian Burkard, description = Detects the malicious usage of the ms-msdt URI as seen in CVE-2022-30190 / Follina exploitation, reference = https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e, score = , modified = 2022-05-31, hash = 4a24048f81afbe9fb62e7a6a49adbd1faf41f266b5f9feecdceb567aec096784
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\exploit[1].htm, type: DROPPED Matched rule: EXPL_Follina_CVE_2022_30190_Msdt_MSProtocolURI_May22 date = 2022-05-30, author = Tobias Michalski, Christian Burkard, description = Detects the malicious usage of the ms-msdt URI as seen in CVE-2022-30190 / Follina exploitation, reference = https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e, score = , modified = 2022-05-31, hash = 4a24048f81afbe9fb62e7a6a49adbd1faf41f266b5f9feecdceb567aec096784
Document misses a certain OLE stream usually present in this Microsoft Office document type
Source: ~WRF{6245E340-9A7D-4D8C-95F3-E607A94CA060}.tmp.0.dr OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: V3g2Pfu707.docx Virustotal: Detection: 33%
Source: V3g2Pfu707.LNK.0.dr LNK file: ..\..\..\..\..\Desktop\V3g2Pfu707.docx
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\Desktop\~$g2Pfu707.docx Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\AppData\Local\Temp\CVR515A.tmp Jump to behavior
Source: classification engine Classification label: mal76.troj.expl.evad.winDOCX@1/21@0/1
Source: ~WRF{6245E340-9A7D-4D8C-95F3-E607A94CA060}.tmp.0.dr OLE document summary: title field not present or empty
Source: ~WRF{6245E340-9A7D-4D8C-95F3-E607A94CA060}.tmp.0.dr OLE document summary: author field not present or empty
Source: ~WRF{6245E340-9A7D-4D8C-95F3-E607A94CA060}.tmp.0.dr OLE document summary: edited time not present or 0
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File read: C:\Users\desktop.ini Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: ~WRF{6245E340-9A7D-4D8C-95F3-E607A94CA060}.tmp.0.dr Initial sample: OLE indicators vbamacros = False

Persistence and Installation Behavior
barindex
Contains an external reference to another file
Source: document.xml.rels Extracted files from sample: http://101.33.231.81:62563/exploit.html!

Hooking and other Techniques for Hiding and Protection
barindex
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 49171 -> 62563
Source: unknown Network traffic detected: HTTP traffic on port 62563 -> 49171
Source: unknown Network traffic detected: HTTP traffic on port 49172 -> 62563
Source: unknown Network traffic detected: HTTP traffic on port 62563 -> 49172
Source: unknown Network traffic detected: HTTP traffic on port 49173 -> 62563
Source: unknown Network traffic detected: HTTP traffic on port 62563 -> 49173
Source: unknown Network traffic detected: HTTP traffic on port 49174 -> 62563
Source: unknown Network traffic detected: HTTP traffic on port 62563 -> 49174
Source: unknown Network traffic detected: HTTP traffic on port 49175 -> 62563
Source: unknown Network traffic detected: HTTP traffic on port 62563 -> 49175
Source: unknown Network traffic detected: HTTP traffic on port 49176 -> 62563
Source: unknown Network traffic detected: HTTP traffic on port 62563 -> 49176
Source: unknown Network traffic detected: HTTP traffic on port 49177 -> 62563
Source: unknown Network traffic detected: HTTP traffic on port 62563 -> 49177
Source: unknown Network traffic detected: HTTP traffic on port 49178 -> 62563
Source: unknown Network traffic detected: HTTP traffic on port 62563 -> 49178
Source: unknown Network traffic detected: HTTP traffic on port 49179 -> 62563
Source: unknown Network traffic detected: HTTP traffic on port 62563 -> 49179
Source: unknown Network traffic detected: HTTP traffic on port 49180 -> 62563
Source: unknown Network traffic detected: HTTP traffic on port 62563 -> 49180
Source: unknown Network traffic detected: HTTP traffic on port 49181 -> 62563
Source: unknown Network traffic detected: HTTP traffic on port 62563 -> 49181
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 647003 Sample: V3g2Pfu707.docx Startdate: 16/06/2022 Architecture: WINDOWS Score: 76 17 Malicious sample detected (through community Yara rule) 2->17 19 Multi AV Scanner detection for submitted file 2->19 21 Yara detected Microsoft Office Exploit Follina CVE-2022-30190 2->21 23 3 other signatures 2->23 5 WINWORD.EXE 502 59 2->5         started        process3 dnsIp4 15 101.33.231.81, 49171, 49172, 49173 TENCENT-NET-AP-CNTencentBuildingKejizhongyiAvenueCN China 5->15 9 C:\Users\user\AppData\Local\...\6B087DC1.htm, HTML 5->9 dropped 11 C:\Users\user\AppData\Local\...\42A30EFB.htm, HTML 5->11 dropped 13 C:\Users\user\AppData\...\exploit[1].htm, HTML 5->13 dropped file5
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
101.33.231.81
 unknown China
132203 TENCENT-NET-AP-CNTencentBuildingKejizhongyiAvenueCN true