Windows Analysis Report
test_exploit.docx.vir

Overview

General Information

Sample Name:	test_exploit.docx.vir (renamed file extension from vir to docx)
Analysis ID:	648185
MD5:	fcb4a6f299be7168bea772af871e203e
SHA1:	26428cb21220443643e53c619a98dac6d35acae6
SHA256:	e907ec4b1da6b2fa4e2fcff5b80d8c004f3b8922fcf62a76988a5a16036dcf8f
Tags:	doc
Infos:

Detection

Follina CVE-2022-30190

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected Microsoft Office Exploit Follina CVE-2022-30190

Malicious sample detected (through community Yara rule)

Contains an external reference to another file

Yara signature match

Potential document exploit detected (unknown TCP traffic)

Uses a known web browser user agent for HTTP communication

JA3 SSL client fingerprint seen in connection with other malware

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Uses insecure TLS / SSL version for HTTPS connection

Document misses a certain OLE stream usually present in this Microsoft Office document type

Classification

Signatures

Exploits

Yara detected Microsoft Office Exploit Follina CVE-2022-30190

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\1B18D662.htm, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\exp[1].htm, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\83FA24C0.htm, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\exp[1].htm, type: DROPPED

Uses insecure TLS / SSL version for HTTPS connection

Source: unknown	HTTPS traffic detected: 145.14.144.66:443 -> 192.168.2.22:49172 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 145.14.144.66:443 -> 192.168.2.22:49173 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 145.14.144.66:443 -> 192.168.2.22:49178 version: TLS 1.0

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source: unknown

HTTPS traffic detected: 145.14.144.188:443 -> 192.168.2.22:49171 version: TLS 1.2

Potential document exploit detected (unknown TCP traffic)

Source: global traffic

TCP traffic: 192.168.2.22:49171 -> 145.14.144.188:443

Potential document exploit detected (performs DNS queries)

Source: global traffic

DNS query: name: samisoooo.000webhostapp.com

Potential document exploit detected (performs HTTP gets)

Source: global traffic

TCP traffic: 192.168.2.22:49171 -> 145.14.144.188:443

Uses a known web browser user agent for HTTP communication

Source: global traffic	HTTP traffic detected: GET /exp.html HTTP/1.1Accept: /User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; ms-office; MSOffice 14)UA-CPU: AMD64Accept-Encoding: gzip, deflateHost: samisoooo.000webhostapp.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /exp.html HTTP/1.1Accept: /User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; ms-office; MSOffice 14)UA-CPU: AMD64Accept-Encoding: gzip, deflateHost: samisoooo.000webhostapp.comConnection: Keep-Alive

JA3 SSL client fingerprint seen in connection with other malware

Source: Joe Sandbox View	JA3 fingerprint: 05af1f5ca1b87cc9cc9b25185115607d
Source: Joe Sandbox View	JA3 fingerprint: 7dcce5b76c8b17472d024758970a406b

Uses insecure TLS / SSL version for HTTPS connection

Source: unknown	HTTPS traffic detected: 145.14.144.66:443 -> 192.168.2.22:49172 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 145.14.144.66:443 -> 192.168.2.22:49173 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 145.14.144.66:443 -> 192.168.2.22:49178 version: TLS 1.0

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49179
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49178
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49177
Source: unknown	Network traffic detected: HTTP traffic on port 49180 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49176
Source: unknown	Network traffic detected: HTTP traffic on port 49181 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49175
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49174
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49173
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49172
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49171
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49181
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49180
Source: unknown	Network traffic detected: HTTP traffic on port 49172 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49175 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49171 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49176 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49173 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49174 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49177 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49178 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49179 -> 443

Source: ~WRF{71B1CDC1-773F-473E-BD67-B44520A9E1A7}.tmp.0.dr	String found in binary or memory: https://samisoooo.000webhostapp.com/e
Source: ~WRF{71B1CDC1-773F-473E-BD67-B44520A9E1A7}.tmp.0.dr	String found in binary or memory: https://samisoooo.000webhostapp.com/exp.
Source: ~WRF{71B1CDC1-773F-473E-BD67-B44520A9E1A7}.tmp.0.dr, ~WRS{E3155A32-4109-4836-B85D-FBC05DE1F998}.tmp.0.dr	String found in binary or memory: https://samisoooo.000webhostapp.com/exp.html
Source: ~WRF{71B1CDC1-773F-473E-BD67-B44520A9E1A7}.tmp.0.dr	String found in binary or memory: https://samisoooo.000webhostapp.com/exp.htmloooo.000webhostapp.com/e
Source: ~WRF{71B1CDC1-773F-473E-BD67-B44520A9E1A7}.tmp.0.dr	String found in binary or memory: https://samisoooo.000webhostapp.com/exp.htmlyX
Source: exp[1].htm.0.dr	String found in binary or memory: https://www.bbc.com/news/live/world-europe-60517447

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{4E26B072-EAB3-41AA-AF89-735B4390C5D9}.tmp

Jump to behavior

Source: unknown

DNS traffic detected: queries for: samisoooo.000webhostapp.com

Source: global traffic	HTTP traffic detected: GET /exp.html HTTP/1.1Accept: /User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; ms-office; MSOffice 14)UA-CPU: AMD64Accept-Encoding: gzip, deflateHost: samisoooo.000webhostapp.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /exp.html HTTP/1.1Accept: /User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; ms-office; MSOffice 14)UA-CPU: AMD64Accept-Encoding: gzip, deflateHost: samisoooo.000webhostapp.comConnection: Keep-Alive

Source: unknown

HTTPS traffic detected: 145.14.144.188:443 -> 192.168.2.22:49171 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: document.xml.rels, type: SAMPLE

Matched rule: Detects XML relations where an OLE object is refrencing an external target in dropper OOXML documents Author: ditekSHen

Yara signature match

Source: sslproxydump.pcap, type: PCAP	Matched rule: EXPL_Follina_CVE_2022_30190_Msdt_MSProtocolURI_May22 date = 2022-05-30, author = Tobias Michalski, Christian Burkard, description = Detects the malicious usage of the ms-msdt URI as seen in CVE-2022-30190 / Follina exploitation, reference = https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e, score = , modified = 2022-05-31, hash = 4a24048f81afbe9fb62e7a6a49adbd1faf41f266b5f9feecdceb567aec096784
Source: document.xml.rels, type: SAMPLE	Matched rule: INDICATOR_OLE_RemoteTemplate author = ditekSHen, description = Detects XML relations where an OLE object is refrencing an external target in dropper OOXML documents

Document misses a certain OLE stream usually present in this Microsoft Office document type

Source: ~WRF{71B1CDC1-773F-473E-BD67-B44520A9E1A7}.tmp.0.dr

OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: test_exploit.docx.LNK.0.dr

LNK file: ..\..\..\..\..\Desktop\test_exploit.docx.docx

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user\Desktop\~$st_exploit.docx.docx

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Temp\CVR5E26.tmp

Jump to behavior

Source: classification engine

Classification label: mal60.expl.evad.winDOCX@1/22@7/2

Source: ~WRF{71B1CDC1-773F-473E-BD67-B44520A9E1A7}.tmp.0.dr	OLE document summary: title field not present or empty
Source: ~WRF{71B1CDC1-773F-473E-BD67-B44520A9E1A7}.tmp.0.dr	OLE document summary: author field not present or empty
Source: ~WRF{71B1CDC1-773F-473E-BD67-B44520A9E1A7}.tmp.0.dr	OLE document summary: edited time not present or 0

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: test_exploit.docx.docx

Initial sample: OLE zip file path = word/media/image1.wmf

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source: ~WRF{71B1CDC1-773F-473E-BD67-B44520A9E1A7}.tmp.0.dr

Initial sample: OLE indicators vbamacros = False

Persistence and Installation Behavior

Contains an external reference to another file

Source: document.xml.rels

Extracted files from sample: https://samisoooo.000webhostapp.com/exp.html

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
145.14.144.66	unknown	Netherlands		204915	AWEXUS	false
145.14.144.188	us-east-1.route-1.000webhost.awex.io	Netherlands		204915	AWEXUS	false

Contacted Domains

Name	IP	Active
us-east-1.route-1.000webhost.awex.io	145.14.144.188	true
samisoooo.000webhostapp.com	unknown	unknown

ID:	648185
Product:	CloudBasic
Start time:	16:59:06
Start date:	18.06.2022
Sample:	test_exploit.docx.vir
Cookbook:	defaultwindowsofficecookbook.jbs
System description:	Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Architecture:	WINDOWS
MD5:	fcb4a6f299be7168bea772af871e203e
SHA1:	26428cb21220443643e53c619a98dac6d35acae6
SHA256:	e907ec4b1da6b2fa4e2fcff5b80d8c004f3b8922fcf62a76988a5a16036dcf8f
Filetype:	Word Microsoft Office Open XML Format document (49504/1) 49.01%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSD-CNRY.FSD	data	EECB7F513E8A53C43004044F5C158663	E7A06F754F530762D0BD2A67FB9648440AB515B8	00B678470F283CFCC06F70437741FE38CA442D56E5010048877339792E2EF9DF
C:\Users\user\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSD-{114CD8F4-726A-47E5-81BB-88D492C7D89F}.FSD	data	63E4487EB98988D4B91B8B0841A5EFEA	E79BF4DED8B5B8FACEB3C6EFED7A04C3502206AD	9BF660F43623C7D6B5643938DA3862006A6659E800D5D92B42AA325CF2065ED8
C:\Users\user\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSF-CTBL.FSF	data	AE4F7D89E4CC88711F34E4CE5FC2A0CB	EA023968F5F6B244EF808399FF978F1BD42E38AF	FA18BD905873C0C9B2E8F472189D9B55B50027F42AF9E803B83B96C0FC25429B
C:\Users\user\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSD-CNRY.FSD	data	554E97AB312C5FC57A297F54B0533E95	1BBF3978C3CEC6E78A662DCE1B206B7459262D99	516879417BA03BBC6BB280A097AA7E6BFEE67F36095DC8AE8BF6910CE0DE707D
C:\Users\user\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSD-{57B17972-0969-4493-B3CE-7A59E2F01440}.FSD	data	4F2DCB93190C549F8958691563DA3A4C	E3938FE0E6F5DB87291877F8D14D03A2CB908A95	A97CF0B600E50C8D5C4FBD180FDD3A789B1FFA00B0D1CDAF68E935B994AD2A9B
C:\Users\user\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSF-{0E1EEE64-E8C6-4E2A-9759-63CF07FD8988}.FSF	data	58B2BB316BC3B1C1A655BA6A6DFF12D7	556B4708A27278350CD3C4DB08652F539F5ED340	ADBD903757DB3574D73F4B800A8A61CACDC8B489039EB563277A1AC9682FF91D
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\exp[1].htm	HTML document, ASCII text, with very long lines, with CRLF line terminators	19EF3736867C133098F4E4D7FE6A5D36	07730F94E02B06699B8B9B8CD822E9850459D5E8	D69A3B887DD2D6AB25FC29199E1E7FFFF75E3A68AEBF060F99D2F5DE6D29F778
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\exp[1].htm	HTML document, ASCII text, with very long lines, with CRLF line terminators	19EF3736867C133098F4E4D7FE6A5D36	07730F94E02B06699B8B9B8CD822E9850459D5E8	D69A3B887DD2D6AB25FC29199E1E7FFFF75E3A68AEBF060F99D2F5DE6D29F778
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\1B18D662.htm	HTML document, ASCII text, with very long lines, with CRLF line terminators	19EF3736867C133098F4E4D7FE6A5D36	07730F94E02B06699B8B9B8CD822E9850459D5E8	D69A3B887DD2D6AB25FC29199E1E7FFFF75E3A68AEBF060F99D2F5DE6D29F778
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\475C6E34.dat	Targa image data - Map - RLE 5 x 65536 x 0 "\004"	07FFEFF17A8A1A1209AB3C2690D569D4	37CB513FABDDCDBBAA2E7296B31A4BC9832E1B01	57CFA30BB860B95B7012ED62427025959B671D270AAF67FC406FBC3C4F3C48D4
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\83FA24C0.htm	HTML document, ASCII text, with very long lines, with CRLF line terminators	19EF3736867C133098F4E4D7FE6A5D36	07730F94E02B06699B8B9B8CD822E9850459D5E8	D69A3B887DD2D6AB25FC29199E1E7FFFF75E3A68AEBF060F99D2F5DE6D29F778
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\B6A2553F.wmf	ms-windows metafont .wmf	C4E6B3035AC3828D375E5479E8485D0D	624B2E68B669293CE5EF5EDA4EFCFDE97FFEA84A	591890CBBED60EF32252835A3F13362E9204F1088E5EFA9E164A3526B612C4D7
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{71B1CDC1-773F-473E-BD67-B44520A9E1A7}.tmp	Composite Document File V2 Document, Cannot read section info	56E41FB4B3E7501317954EDAF4F3066A	E9AE9F4DBBF51710B4671AF250B8364BD192B9C0	02E94814AF6D6F1E738A173EEE6A0890481085F115C8591CCC4921F5A8027DF4
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{4E26B072-EAB3-41AA-AF89-735B4390C5D9}.tmp	data	5D4D94EE7E06BBB0AF9584119797B23A	DBB111419C704F116EFA8E72471DD83E86E49677	4826C0D860AF884D3343CA6460B0006A7A2CE7DBCCC4D743208585D997CC5FD1
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{E3155A32-4109-4836-B85D-FBC05DE1F998}.tmp	data	F0C0E203E2AC15026E3490F58536641D	92869BD6CDC12A6C62B6B3923E5C4BE3696A6C62	AB9D778B11E59A9CF88AE75D128AAC8713D6BEF146E3E96BF5BAA446C1032AD8
C:\Users\user\AppData\Local\Temp\{87A0ADDF-EA5F-47F4-8528-A6B8AB0136F3}	data	CD2905870C9640C3CDDD24039502D603	FEB2AB2BAB584E081AA1284CEA7DA0CBCEB02E24	8A8F798CF9439E63F29C4FA60C60C27CFD6B4FD1105141C9590B6AF772CCBA4B
C:\Users\user\AppData\Local\Temp\{D7DEA83B-46CD-4801-9593-7D8BD5CE2A97}	data	F7549CC4B3E9A52589570A92D5F4C8ED	DC287659BBED8383EFBD4BDAB4F16030063A0738	F0BFD4C1EB73AD82036D4FE228AC44FEA4AE9C831965A310A35E82574A8BB67D
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat	ASCII text, with CRLF line terminators	A8AFC82B523D89A72501353BFEAF2A07	DABA6C5AB64BA98EBAE9E4DE1E55B177C05F106D	9D6A0DB1FBB6911802B5727583F6C045413087F3515795294DF4D66223801257
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\test_exploit.docx.LNK	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Sat Jun 18 23:00:01 2022, mtime=Sat Jun 18 23:00:01 2022, atime=Sat Jun 18 23:00:13 2022, length=13714, window=hide	F23DB4F73D80F950340D228C47293FBB	9831E95028F54EED2F9EB2F7B26CEA89CEE528B1	C2D64C6138163FA93AFA285092B9A3B001592F0660E6600412ECDA5F368314B6
C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm	data	1674A1C7C99CD9FAADA789F5E2AEB335	26D9E81D5ED584A899A94D5EA8945A5AE3403F85	BB5F0D32E0E1C8B6865FCE4AE1FC50E34CA954B89E771364A6BE6627F7C726B6
C:\Users\user\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex	Little-endian UTF-16 Unicode text, with no line terminators	F3B25701FE362EC84616A93A45CE9998	D62636D8CAEC13F04E28442A0A6FA1AFEB024BBB	B3D510EF04275CA8E698E5B3CBB0ECE3949EF9252F0CDC839E9EE347409A2209
C:\Users\user\Desktop\~$st_exploit.docx.docx	data	1674A1C7C99CD9FAADA789F5E2AEB335	26D9E81D5ED584A899A94D5EA8945A5AE3403F85	BB5F0D32E0E1C8B6865FCE4AE1FC50E34CA954B89E771364A6BE6627F7C726B6

Windows Analysis Report
test_exploit.docx.vir

Overview

General Information

Detection

Signatures

Classification

Signatures

Exploits

Compliance

Software Vulnerabilities

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report test_exploit.docx.vir

Overview

General Information

Detection

Signatures

Classification

Signatures

Exploits

Compliance

Software Vulnerabilities

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report
test_exploit.docx.vir