Windows Analysis Report
Hacxx MSDT 0-Day CVE-2022-30190 Exploit Generator.htm

Overview

General Information

Sample Name: Hacxx MSDT 0-Day CVE-2022-30190 Exploit Generator.htm
Analysis ID: 668454
MD5: 944593b21badb2add4c954e7ea09bc53
SHA1: 737ec2a8778af5404d5c57824f705a5fb1897b10
SHA256: b2743f7047a7119794a28840403def40e27ff7f9575ef060c458ab4fe3e9aeb9
Tags: CVE-2022-30190ExploitGeneratorhtml
Infos:

Detection

Follina CVE-2022-30190
Score: 56
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Multi AV Scanner detection for submitted file
Yara detected Microsoft Office Exploit Follina CVE-2022-30190
Yara signature match
IP address seen in connection with other malware

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: Hacxx MSDT 0-Day CVE-2022-30190 Exploit Generator.htm Virustotal: Detection: 32% Perma Link
Source: Hacxx MSDT 0-Day CVE-2022-30190 Exploit Generator.htm Metadefender: Detection: 22% Perma Link
Source: Hacxx MSDT 0-Day CVE-2022-30190 Exploit Generator.htm ReversingLabs: Detection: 15%

Exploits
barindex
Yara detected Microsoft Office Exploit Follina CVE-2022-30190
Source: Yara match File source: Hacxx MSDT 0-Day CVE-2022-30190 Exploit Generator.htm, type: SAMPLE
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Local\Temp\3628_562390067\LICENSE.txt Jump to behavior
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 239.255.255.250 239.255.255.250
Source: unknown DNS traffic detected: queries for: clients2.google.com
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49732 -> 443
Source: global traffic HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-GB&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda,pkedcjkdefgpdelpbcmbmeomcjbeemfmX-Goog-Update-Updater: chromecrx-85.0.4183.121Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: Ruleset Data.0.dr String found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)
Source: Filtering Rules.0.dr, Ruleset Data.0.dr String found in binary or memory: www.facebook.com/ajax/ads/ equals www.facebook.com (Facebook)
Source: Filtering Rules.0.dr String found in binary or memory: www.facebook.com0 equals www.facebook.com (Facebook)
Source: pnacl_public_x86_64_pnacl_sz_nexe.0.dr, pnacl_public_x86_64_pnacl_llc_nexe.0.dr String found in binary or memory: http://llvm.org/):
Source: 7d5a61e7-35f3-4e76-8642-dae2ae803399.tmp.1.dr, f8a16519-1264-457e-bd0e-0d7479d9eb2b.tmp.1.dr String found in binary or memory: https://accounts.google.com
Source: craw_window.js.0.dr String found in binary or memory: https://accounts.google.com/MergeSession
Source: 7d5a61e7-35f3-4e76-8642-dae2ae803399.tmp.1.dr, f8a16519-1264-457e-bd0e-0d7479d9eb2b.tmp.1.dr String found in binary or memory: https://apis.google.com
Source: pnacl_public_x86_64_libpnacl_irt_shim_dummy_a.0.dr String found in binary or memory: https://chromium.googlesource.com/a/native_client/pnacl-clang.git
Source: pnacl_public_x86_64_libpnacl_irt_shim_dummy_a.0.dr String found in binary or memory: https://chromium.googlesource.com/a/native_client/pnacl-llvm.git
Source: 7d5a61e7-35f3-4e76-8642-dae2ae803399.tmp.1.dr, f8a16519-1264-457e-bd0e-0d7479d9eb2b.tmp.1.dr String found in binary or memory: https://clients2.google.com
Source: manifest.json1.0.dr, manifest.json4.0.dr, manifest.json.0.dr String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 7d5a61e7-35f3-4e76-8642-dae2ae803399.tmp.1.dr, f8a16519-1264-457e-bd0e-0d7479d9eb2b.tmp.1.dr String found in binary or memory: https://clients2.googleusercontent.com
Source: pnacl_public_x86_64_ld_nexe.0.dr String found in binary or memory: https://code.google.com/p/nativeclient/issues/entry
Source: pnacl_public_x86_64_ld_nexe.0.dr String found in binary or memory: https://code.google.com/p/nativeclient/issues/entry%s:
Source: LICENSE.txt.0.dr String found in binary or memory: https://creativecommons.org/.
Source: LICENSE.txt.0.dr String found in binary or memory: https://creativecommons.org/compatiblelicenses
Source: 7d5a61e7-35f3-4e76-8642-dae2ae803399.tmp.1.dr, 5fa60e0e-e2b5-4357-988a-4477fd114917.tmp.1.dr, 727a27ef-2203-4b69-a8bf-89c988389b14.tmp.1.dr, f8a16519-1264-457e-bd0e-0d7479d9eb2b.tmp.1.dr String found in binary or memory: https://dns.google
Source: LICENSE.txt.0.dr String found in binary or memory: https://easylist.to/)
Source: 7d5a61e7-35f3-4e76-8642-dae2ae803399.tmp.1.dr, f8a16519-1264-457e-bd0e-0d7479d9eb2b.tmp.1.dr String found in binary or memory: https://fonts.googleapis.com
Source: 7d5a61e7-35f3-4e76-8642-dae2ae803399.tmp.1.dr, f8a16519-1264-457e-bd0e-0d7479d9eb2b.tmp.1.dr String found in binary or memory: https://fonts.gstatic.com
Source: LICENSE.txt.0.dr String found in binary or memory: https://github.com/easylist)
Source: craw_window.js.0.dr, craw_background.js.0.dr String found in binary or memory: https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p
Source: 7d5a61e7-35f3-4e76-8642-dae2ae803399.tmp.1.dr, f8a16519-1264-457e-bd0e-0d7479d9eb2b.tmp.1.dr String found in binary or memory: https://ogs.google.com
Source: craw_window.js.0.dr, manifest.json.0.dr String found in binary or memory: https://payments.google.com/payments/v4/js/integrator.js
Source: 7d5a61e7-35f3-4e76-8642-dae2ae803399.tmp.1.dr, f8a16519-1264-457e-bd0e-0d7479d9eb2b.tmp.1.dr String found in binary or memory: https://play.google.com
Source: 7d5a61e7-35f3-4e76-8642-dae2ae803399.tmp.1.dr String found in binary or memory: https://r5---sn-h0jeln7l.gvt1.com
Source: 7d5a61e7-35f3-4e76-8642-dae2ae803399.tmp.1.dr, f8a16519-1264-457e-bd0e-0d7479d9eb2b.tmp.1.dr String found in binary or memory: https://redirector.gvt1.com
Source: craw_window.js.0.dr, manifest.json.0.dr String found in binary or memory: https://sandbox.google.com/payments/v4/js/integrator.js
Source: 7d5a61e7-35f3-4e76-8642-dae2ae803399.tmp.1.dr, f8a16519-1264-457e-bd0e-0d7479d9eb2b.tmp.1.dr String found in binary or memory: https://ssl.gstatic.com
Source: craw_window.js.0.dr, craw_background.js.0.dr String found in binary or memory: https://www-googleapis-staging.sandbox.google.com
Source: 7d5a61e7-35f3-4e76-8642-dae2ae803399.tmp.1.dr, f8a16519-1264-457e-bd0e-0d7479d9eb2b.tmp.1.dr String found in binary or memory: https://www.google.com
Source: manifest.json.0.dr String found in binary or memory: https://www.google.com/
Source: craw_window.js.0.dr String found in binary or memory: https://www.google.com/accounts/OAuthLogin?issueuberauth=1
Source: craw_window.js.0.dr String found in binary or memory: https://www.google.com/images/cleardot.gif
Source: craw_window.js.0.dr String found in binary or memory: https://www.google.com/images/dot2.gif
Source: craw_window.js.0.dr String found in binary or memory: https://www.google.com/images/x2.gif
Source: craw_background.js.0.dr String found in binary or memory: https://www.google.com/intl/en-US/chrome/blank.html
Source: craw_window.js.0.dr, craw_background.js.0.dr, 7d5a61e7-35f3-4e76-8642-dae2ae803399.tmp.1.dr, f8a16519-1264-457e-bd0e-0d7479d9eb2b.tmp.1.dr String found in binary or memory: https://www.googleapis.com
Source: manifest.json.0.dr String found in binary or memory: https://www.googleapis.com/
Source: manifest.json.0.dr String found in binary or memory: https://www.googleapis.com/auth/chromewebstore
Source: manifest.json.0.dr String found in binary or memory: https://www.googleapis.com/auth/chromewebstore.readonly
Source: manifest.json.0.dr String found in binary or memory: https://www.googleapis.com/auth/sierra
Source: manifest.json.0.dr String found in binary or memory: https://www.googleapis.com/auth/sierrasandbox
Source: 7d5a61e7-35f3-4e76-8642-dae2ae803399.tmp.1.dr, f8a16519-1264-457e-bd0e-0d7479d9eb2b.tmp.1.dr String found in binary or memory: https://www.gstatic.com
Source: unknown HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Yara signature match
Source: Hacxx MSDT 0-Day CVE-2022-30190 Exploit Generator.htm, type: SAMPLE Matched rule: SUSP_PS1_Msdt_Execution_May22 date = 2022-05-31, author = Nasreddine Bencherchali, Christian Burkard, description = Detects suspicious calls of msdt.exe as seen in CVE-2022-30190 / Follina exploitation, score = , reference = https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e, modified = 2022-07-08
Source: 83002.0.pages.csv, type: HTML Matched rule: SUSP_PS1_Msdt_Execution_May22 date = 2022-05-31, author = Nasreddine Bencherchali, Christian Burkard, description = Detects suspicious calls of msdt.exe as seen in CVE-2022-30190 / Follina exploitation, score = , reference = https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e, modified = 2022-07-08
Source: Hacxx MSDT 0-Day CVE-2022-30190 Exploit Generator.htm Virustotal: Detection: 32%
Source: Hacxx MSDT 0-Day CVE-2022-30190 Exploit Generator.htm Metadefender: Detection: 22%
Source: Hacxx MSDT 0-Day CVE-2022-30190 Exploit Generator.htm ReversingLabs: Detection: 15%
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Local\Temp\83e2d3a3-c39c-4d02-ac9e-2cb5ac7dc711.tmp Jump to behavior
Source: classification engine Classification label: mal56.expl.winHTM@31/139@2/6
Source: unknown Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation "C:\Users\user\Desktop\Hacxx MSDT 0-Day CVE-2022-30190 Exploit Generator.htm
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1592,17218383300859783571,9943285069256131307,131072 --lang=en-GB --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1928 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1592,17218383300859783571,9943285069256131307,131072 --lang=en-GB --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1928 /prefetch:8 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-62D58BE9-E2C.pma Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Local\Temp\3628_562390067\LICENSE.txt Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 668454 Sample: Hacxx MSDT 0-Day CVE-2022-3... Startdate: 18/07/2022 Architecture: WINDOWS Score: 56 31 Multi AV Scanner detection for submitted file 2->31 33 Yara detected Microsoft Office Exploit Follina CVE-2022-30190 2->33 6 chrome.exe 15 296 2->6         started        process3 dnsIp4 19 192.168.2.1 unknown unknown 6->19 21 192.168.2.5 unknown unknown 6->21 23 239.255.255.250 unknown Reserved 6->23 13 C:\...\pnacl_public_x86_64_pnacl_sz_nexe, ELF 6->13 dropped 15 C:\...\pnacl_public_x86_64_pnacl_llc_nexe, ELF 6->15 dropped 17 C:\Users\user\...\pnacl_public_x86_64_ld_nexe, ELF 6->17 dropped 10 chrome.exe 14 6->10         started        file5 process6 dnsIp7 25 accounts.google.com 142.250.180.141, 443, 49731 GOOGLEUS United States 10->25 27 clients.l.google.com 216.58.209.46, 443, 49732, 58172 GOOGLEUS United States 10->27 29 2 other IPs or domains 10->29
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
239.255.255.250
 unknown Reserved
unknown unknown false
142.250.180.141
 accounts.google.com United States
15169 GOOGLEUS false
216.58.209.46
 clients.l.google.com United States
15169 GOOGLEUS false

Private

IP
192.168.2.1
127.0.0.1
192.168.2.5

Contacted Domains

Name IP Active
accounts.google.com 142.250.180.141 true
clients.l.google.com 216.58.209.46 true
clients2.google.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard false
    		high
    https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-GB&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 false
      		high