Managed XDR

follina.doc (Follina) — malware analysis report

File info

Filename
follina.doc
File type
Zip archive data, at least v2.0 to extract
File size
10.4 KB
First seen
Last seen

Environment

win7/x86 en

Hashes

SHA1
bc916691a3f1af088cbabd42e8572ac1c4b5ebb8
SHA256
f7b0df7ea315842ab4b3a9c0f8e26df7c1beb3e836fb514219f3c243a482eedf
MD5
688c2a67ef70a32ae59a659f84e5702a

Malwares

  • Follina

Signatures

Initial Access

T1192 downloader_ms_word: Suspicious link to an external file (Microsoft Word)

Execution

T1203 exploit_CVE_2022_30190: Exploitation of Follina (CVE-2022-30190) Vulnerability

Privilege Escalation

T1134 sets_privilegies_via_adjusttokenprivileges: Sets process privilege via AdjustTokenPrivileges
T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process

Defense Evasion

T1497 evasion_trustrecords: Attempts to detect Sandbox exploring trusted documents
T1497.001 antivm_queries_computername: Retrieves the computer name
T1134 sets_privilegies_via_adjusttokenprivileges: Sets process privilege via AdjustTokenPrivileges
T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process

Discovery

T1497 evasion_trustrecords: Attempts to detect Sandbox exploring trusted documents
T1497.001 antivm_queries_computername: Retrieves the computer name

Other

yara_rules: Static rules
create_rpc_bindings: Creates RPC connection
get_policy_info: Retrieves information about a Policy object
antisandbox_check_graphics_card: Uses CreateDXGIFactory, potentially to detect graphics card

Related reports