Loading ...

Play interactive tourEdit tour

Analysis Report 8s3IDkICjfVJdjf.exe

Overview

General Information

Sample Name:8s3IDkICjfVJdjf.exe
Analysis ID:286320
MD5:37b68b7785d2d85dc2e86994274bc372
SHA1:07a1c8c9f6d8e5196aa8146b5d49cdd02c708cdf
SHA256:95cd424f047341dbb29fb265895ed8057f33c0ee67abb437dfae16174dcbe66d
Tags:AgentTeslaexe

Most interesting Screenshot:

Detection

AgentTesla
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Found malware configuration
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Scheduled temp file as task from temp location
Yara detected AgentTesla
Yara detected AntiVM_3
Injects a PE file into a foreign processes
Installs a global keyboard hook
Machine Learning detection for dropped file
Machine Learning detection for sample
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file access)
Uses schtasks.exe or at.exe to add and modify task schedules
Antivirus or Machine Learning detection for unpacked file
Contains capabilities to detect virtual machines
Contains functionality to call native functions
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a window with clipboard capturing capabilities
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Drops PE files
Enables debug privileges
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains strange resources
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Tries to load missing DLLs
Uses SMTP (mail sending)
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer

Classification

Startup

  • System is w10x64
  • 8s3IDkICjfVJdjf.exe (PID: 7040 cmdline: 'C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe' MD5: 37B68B7785D2D85DC2E86994274BC372)
    • schtasks.exe (PID: 7108 cmdline: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\BXolyRSDNw' /XML 'C:\Users\user\AppData\Local\Temp\tmp5268.tmp' MD5: 15FF7D8324231381BAD48A052F85DF04)
      • conhost.exe (PID: 7116 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • 8s3IDkICjfVJdjf.exe (PID: 7152 cmdline: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe MD5: 37B68B7785D2D85DC2E86994274BC372)
  • cleanup

Malware Configuration

Threatname: Agenttesla

{"Username: ": "cOpf5MgRS7NhGvu", "URL: ": "https://SBhSpy0yu12Ss3zLyiL.com", "To: ": "goodresult5050@gmail.com", "ByHost: ": "mail.redwevamaldives.com:587", "Password: ": "7vdMuIDGV0", "From: ": "naufal@redwevamaldives.com"}

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000003.00000002.483021216.0000000003356000.00000004.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
    00000003.00000002.483021216.0000000003356000.00000004.00000001.sdmpJoeSecurity_CredentialStealerYara detected Credential StealerJoe Security
      00000000.00000002.221345303.0000000003361000.00000004.00000001.sdmpJoeSecurity_AntiVM_3Yara detected AntiVM_3Joe Security
        00000003.00000002.478557686.0000000000402000.00000040.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
          00000000.00000002.222297954.000000000443B000.00000004.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
            Click to see the 4 entries

            Unpacked PEs

            SourceRuleDescriptionAuthorStrings
            3.2.8s3IDkICjfVJdjf.exe.400000.0.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security

              Sigma Overview

              System Summary:

              barindex
              Sigma detected: Scheduled temp file as task from temp locationShow sources
              Source: Process startedAuthor: Joe Security: Data: Command: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\BXolyRSDNw' /XML 'C:\Users\user\AppData\Local\Temp\tmp5268.tmp', CommandLine: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\BXolyRSDNw' /XML 'C:\Users\user\AppData\Local\Temp\tmp5268.tmp', CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: 'C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe' , ParentImage: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe, ParentProcessId: 7040, ProcessCommandLine: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\BXolyRSDNw' /XML 'C:\Users\user\AppData\Local\Temp\tmp5268.tmp', ProcessId: 7108

              Signature Overview

              Click to jump to signature section

              Show All Signature Results

              AV Detection:

              barindex
              Antivirus / Scanner detection for submitted sampleShow sources
              Source: 8s3IDkICjfVJdjf.exeAvira: detected
              Antivirus detection for dropped fileShow sources
              Source: C:\Users\user\AppData\Roaming\BXolyRSDNw.exeAvira: detection malicious, Label: TR/AD.AgentTesla.buhwq
              Found malware configurationShow sources
              Source: 8s3IDkICjfVJdjf.exe.7152.3.memstrMalware Configuration Extractor: Agenttesla {"Username: ": "cOpf5MgRS7NhGvu", "URL: ": "https://SBhSpy0yu12Ss3zLyiL.com", "To: ": "goodresult5050@gmail.com", "ByHost: ": "mail.redwevamaldives.com:587", "Password: ": "7vdMuIDGV0", "From: ": "naufal@redwevamaldives.com"}
              Multi AV Scanner detection for dropped fileShow sources
              Source: C:\Users\user\AppData\Roaming\BXolyRSDNw.exeVirustotal: Detection: 30%Perma Link
              Source: C:\Users\user\AppData\Roaming\BXolyRSDNw.exeReversingLabs: Detection: 43%
              Multi AV Scanner detection for submitted fileShow sources
              Source: 8s3IDkICjfVJdjf.exeVirustotal: Detection: 30%Perma Link
              Source: 8s3IDkICjfVJdjf.exeReversingLabs: Detection: 43%
              Machine Learning detection for dropped fileShow sources
              Source: C:\Users\user\AppData\Roaming\BXolyRSDNw.exeJoe Sandbox ML: detected
              Machine Learning detection for sampleShow sources
              Source: 8s3IDkICjfVJdjf.exeJoe Sandbox ML: detected
              Source: 3.2.8s3IDkICjfVJdjf.exe.400000.0.unpackAvira: Label: TR/Spy.Gen8
              Source: global trafficTCP traffic: 192.168.2.4:49719 -> 185.99.1.5:587
              Source: Joe Sandbox ViewIP Address: 185.99.1.5 185.99.1.5
              Source: Joe Sandbox ViewASN Name: GLOBALHOST-BOSNIA-ASBA GLOBALHOST-BOSNIA-ASBA
              Source: global trafficTCP traffic: 192.168.2.4:49719 -> 185.99.1.5:587
              Source: unknownDNS traffic detected: queries for: mail.redwevamaldives.com
              Source: 8s3IDkICjfVJdjf.exe, 00000000.00000002.222297954.000000000443B000.00000004.00000001.sdmp, 8s3IDkICjfVJdjf.exe, 00000003.00000002.478557686.0000000000402000.00000040.00000001.sdmpString found in binary or memory: http://127.0.0.1:
              Source: 8s3IDkICjfVJdjf.exe, 00000003.00000002.483952993.00000000034EC000.00000004.00000001.sdmpString found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
              Source: 8s3IDkICjfVJdjf.exe, 00000003.00000002.485874782.00000000063E0000.00000004.00000001.sdmpString found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
              Source: 8s3IDkICjfVJdjf.exe, 00000003.00000002.483952993.00000000034EC000.00000004.00000001.sdmpString found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
              Source: 8s3IDkICjfVJdjf.exe, 00000003.00000002.483952993.00000000034EC000.00000004.00000001.sdmpString found in binary or memory: http://crl.comodoca.com/cPanelIncCertificationAuthority.crl0
              Source: 8s3IDkICjfVJdjf.exe, 00000003.00000002.483952993.00000000034EC000.00000004.00000001.sdmpString found in binary or memory: http://ocsp.comodoca.com0
              Source: 8s3IDkICjfVJdjf.exe, 00000003.00000002.483021216.0000000003356000.00000004.00000001.sdmp, 8s3IDkICjfVJdjf.exe, 00000003.00000002.483990631.0000000003503000.00000004.00000001.sdmpString found in binary or memory: https://SBhSpy0yu12Ss3zLyiL.com
              Source: 8s3IDkICjfVJdjf.exe, 00000003.00000002.483021216.0000000003356000.00000004.00000001.sdmpString found in binary or memory: https://SBhSpy0yu12Ss3zLyiL.comHPI
              Source: 8s3IDkICjfVJdjf.exe, 00000000.00000002.222297954.000000000443B000.00000004.00000001.sdmp, 8s3IDkICjfVJdjf.exe, 00000003.00000002.478557686.0000000000402000.00000040.00000001.sdmpString found in binary or memory: https://api.telegram.org/bot%telegramapi%/
              Source: 8s3IDkICjfVJdjf.exe, 00000003.00000002.483952993.00000000034EC000.00000004.00000001.sdmpString found in binary or memory: https://sectigo.com/CPS0
              Source: 8s3IDkICjfVJdjf.exe, 00000000.00000002.222297954.000000000443B000.00000004.00000001.sdmp, 8s3IDkICjfVJdjf.exe, 00000003.00000002.478557686.0000000000402000.00000040.00000001.sdmpString found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
              Source: 8s3IDkICjfVJdjf.exe, 00000000.00000002.222297954.000000000443B000.00000004.00000001.sdmp, 8s3IDkICjfVJdjf.exe, 00000003.00000002.478557686.0000000000402000.00000040.00000001.sdmpString found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/U

              Key, Mouse, Clipboard, Microphone and Screen Capturing:

              barindex
              Installs a global keyboard hookShow sources
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeWindows user hook set: 0 keyboard low level C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeWindow created: window name: CLIPBRDWNDCLASSJump to behavior

              System Summary:

              barindex
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeCode function: 0_2_057119A2 NtQuerySystemInformation,0_2_057119A2
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeCode function: 0_2_05711971 NtQuerySystemInformation,0_2_05711971
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeCode function: 0_2_00CB5C580_2_00CB5C58
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeCode function: 0_2_00CB5C120_2_00CB5C12
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeCode function: 0_2_054973380_2_05497338
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeCode function: 0_2_054915000_2_05491500
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeCode function: 0_2_054981F70_2_054981F7
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeCode function: 0_2_054911800_2_05491180
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeCode function: 0_2_054984580_2_05498458
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeCode function: 0_2_054984520_2_05498452
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeCode function: 0_2_054914EF0_2_054914EF
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeCode function: 0_2_054917400_2_05491740
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeCode function: 0_2_054917500_2_05491750
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeCode function: 0_2_054973280_2_05497328
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeCode function: 0_2_054982080_2_05498208
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeCode function: 0_2_05C357E00_2_05C357E0
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeCode function: 3_2_00C35C123_2_00C35C12
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeCode function: 3_2_00C35C583_2_00C35C58
              Source: 8s3IDkICjfVJdjf.exeStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
              Source: BXolyRSDNw.exe.0.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
              Source: 8s3IDkICjfVJdjf.exe, 00000000.00000002.227485302.0000000006470000.00000002.00000001.sdmpBinary or memory string: originalfilename vs 8s3IDkICjfVJdjf.exe
              Source: 8s3IDkICjfVJdjf.exe, 00000000.00000002.227485302.0000000006470000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamepropsys.dll.mui@ vs 8s3IDkICjfVJdjf.exe
              Source: 8s3IDkICjfVJdjf.exe, 00000000.00000002.224539621.0000000005660000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameEminem.dll< vs 8s3IDkICjfVJdjf.exe
              Source: 8s3IDkICjfVJdjf.exe, 00000000.00000002.224462044.0000000005600000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamemscorrc.dllT vs 8s3IDkICjfVJdjf.exe
              Source: 8s3IDkICjfVJdjf.exe, 00000000.00000002.219587512.0000000000CBA000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameoLVH.exe, vs 8s3IDkICjfVJdjf.exe
              Source: 8s3IDkICjfVJdjf.exe, 00000000.00000002.222297954.000000000443B000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameButterFly.dll< vs 8s3IDkICjfVJdjf.exe
              Source: 8s3IDkICjfVJdjf.exe, 00000000.00000002.222297954.000000000443B000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameLNnWERDcXuUUJavHMnwdrQTULkQTqgDq.exe4 vs 8s3IDkICjfVJdjf.exe
              Source: 8s3IDkICjfVJdjf.exe, 00000000.00000002.226195448.0000000006380000.00000002.00000001.sdmpBinary or memory string: System.OriginalFileName vs 8s3IDkICjfVJdjf.exe
              Source: 8s3IDkICjfVJdjf.exeBinary or memory string: OriginalFilename vs 8s3IDkICjfVJdjf.exe
              Source: 8s3IDkICjfVJdjf.exe, 00000003.00000002.485612832.0000000006140000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamemscorrc.dllT vs 8s3IDkICjfVJdjf.exe
              Source: 8s3IDkICjfVJdjf.exe, 00000003.00000002.484808468.0000000005690000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamewbemdisp.tlbj% vs 8s3IDkICjfVJdjf.exe
              Source: 8s3IDkICjfVJdjf.exe, 00000003.00000002.485534489.0000000006120000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamewshom.ocx.mui vs 8s3IDkICjfVJdjf.exe
              Source: 8s3IDkICjfVJdjf.exe, 00000003.00000002.485486105.0000000006110000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamewshom.ocx vs 8s3IDkICjfVJdjf.exe
              Source: 8s3IDkICjfVJdjf.exe, 00000003.00000002.478858694.0000000000462000.00000040.00000001.sdmpBinary or memory string: OriginalFilenameLNnWERDcXuUUJavHMnwdrQTULkQTqgDq.exe4 vs 8s3IDkICjfVJdjf.exe
              Source: 8s3IDkICjfVJdjf.exe, 00000003.00000002.479025685.0000000000C3A000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameoLVH.exe, vs 8s3IDkICjfVJdjf.exe
              Source: 8s3IDkICjfVJdjf.exe, 00000003.00000002.484913211.00000000058C0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameKernelbase.dll.muij% vs 8s3IDkICjfVJdjf.exe
              Source: 8s3IDkICjfVJdjf.exe, 00000003.00000002.479390087.0000000001150000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameCRYPT32.DLL.MUIj% vs 8s3IDkICjfVJdjf.exe
              Source: 8s3IDkICjfVJdjf.exeBinary or memory string: OriginalFilenameoLVH.exe, vs 8s3IDkICjfVJdjf.exe
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeSection loaded: security.dllJump to behavior
              Source: 8s3IDkICjfVJdjf.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
              Source: BXolyRSDNw.exe.0.drStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
              Source: 8s3IDkICjfVJdjf.exe, SecurityZone.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
              Source: BXolyRSDNw.exe.0.dr, SecurityZone.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
              Source: 0.2.8s3IDkICjfVJdjf.exe.c20000.0.unpack, SecurityZone.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
              Source: 0.0.8s3IDkICjfVJdjf.exe.c20000.0.unpack, SecurityZone.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
              Source: 3.2.8s3IDkICjfVJdjf.exe.ba0000.1.unpack, SecurityZone.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
              Source: 3.0.8s3IDkICjfVJdjf.exe.ba0000.0.unpack, SecurityZone.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
              Source: classification engineClassification label: mal100.troj.spyw.evad.winEXE@6/4@1/1
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeCode function: 0_2_05711826 AdjustTokenPrivileges,0_2_05711826
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeCode function: 0_2_057117EF AdjustTokenPrivileges,0_2_057117EF
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeFile created: C:\Users\user\AppData\Roaming\BXolyRSDNw.exeJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeMutant created: \Sessions\1\BaseNamedObjects\AOtYtJLGEjHhEWPXRITN
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7116:120:WilError_01
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeMutant created: \Sessions\1\BaseNamedObjects\Global\.net clr networking
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeFile created: C:\Users\user\AppData\Local\Temp\tmp5268.tmpJump to behavior
              Source: 8s3IDkICjfVJdjf.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeSection loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dllJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeSection loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlpJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeSection loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlpJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeSection loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dllJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeSection loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlpJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeSection loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlpJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: 8s3IDkICjfVJdjf.exeVirustotal: Detection: 30%
              Source: 8s3IDkICjfVJdjf.exeReversingLabs: Detection: 43%
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeFile read: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeJump to behavior
              Source: unknownProcess created: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe 'C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe'
              Source: unknownProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\BXolyRSDNw' /XML 'C:\Users\user\AppData\Local\Temp\tmp5268.tmp'
              Source: unknownProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: unknownProcess created: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\BXolyRSDNw' /XML 'C:\Users\user\AppData\Local\Temp\tmp5268.tmp'Jump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeProcess created: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32Jump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeFile opened: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dllJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676Jump to behavior
              Source: 8s3IDkICjfVJdjf.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeFile opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_d08c58b4442ba54f\MSVCR80.dllJump to behavior
              Source: 8s3IDkICjfVJdjf.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
              Source: Binary string: mscorrc.pdb source: 8s3IDkICjfVJdjf.exe, 00000000.00000002.224462044.0000000005600000.00000002.00000001.sdmp, 8s3IDkICjfVJdjf.exe, 00000003.00000002.485612832.0000000006140000.00000002.00000001.sdmp
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeCode function: 0_2_00CB619B push es; ret 0_2_00CB6262
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeCode function: 0_2_00CB619F push es; ret 0_2_00CB6262
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeCode function: 0_2_00CB6263 push cs; iretd 0_2_00CB6274
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeCode function: 0_2_01498BD8 push edx; ret 0_2_01498BE2
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeCode function: 0_2_01498BEB push ebx; ret 0_2_01498BEE
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeCode function: 0_2_014993F8 push cs; ret 0_2_014993FA
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeCode function: 0_2_01498B81 push edx; ret 0_2_01498B82
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeCode function: 0_2_01498BA7 push esp; ret 0_2_01498BBE
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeCode function: 0_2_01498BA7 pushad ; ret 0_2_01498BCA
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeCode function: 0_2_014993B8 push cs; ret 0_2_014993BA
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeCode function: 0_2_01499538 push cs; ret 0_2_0149953A
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeCode function: 0_2_01499478 push cs; ret 0_2_0149947A
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeCode function: 0_2_01499438 push cs; ret 0_2_0149943A
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeCode function: 0_2_014994F8 push cs; ret 0_2_014994FA
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeCode function: 0_2_014994B8 push cs; ret 0_2_014994BA
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeCode function: 0_2_01499F37 push eax; ret 0_2_01499F41
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeCode function: 0_2_0549844A pushad ; ret 0_2_05498451
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeCode function: 0_2_05C34DD3 push ds; ret 0_2_05C34DE2
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeCode function: 0_2_05C35193 push 00000018h; ret 0_2_05C3519A
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeCode function: 0_2_05C3399A push edi; retf 0_2_05C339A1
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeCode function: 0_2_05C35107 pushad ; ret 0_2_05C35129
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeCode function: 0_2_05C34CFF push ds; ret 0_2_05C34D0E
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeCode function: 0_2_05C34CB0 push ds; ret 0_2_05C34CB2
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeCode function: 0_2_05C350BB push ds; ret 0_2_05C350E2
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeCode function: 0_2_05C34C53 push ss; ret 0_2_05C34C62
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeCode function: 0_2_05C34C1F push es; ret 0_2_05C34C26
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeCode function: 0_2_05C337C2 push ecx; ret 0_2_05C337C4
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeCode function: 0_2_05C34FB3 push ds; ret 0_2_05C34FBA
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeCode function: 0_2_05C34B47 push ss; ret 0_2_05C34B52
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeCode function: 3_2_00C3619B push es; ret 3_2_00C36262
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeCode function: 3_2_00C3619F push es; ret 3_2_00C36262
              Source: initial sampleStatic PE information: section name: .text entropy: 7.98593541357
              Source: initial sampleStatic PE information: section name: .text entropy: 7.98593541357
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeFile created: C:\Users\user\AppData\Roaming\BXolyRSDNw.exeJump to dropped file

              Boot Survival:

              barindex
              Uses schtasks.exe or at.exe to add and modify task schedulesShow sources
              Source: unknownProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\BXolyRSDNw' /XML 'C:\Users\user\AppData\Local\Temp\tmp5268.tmp'
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

              Malware Analysis System Evasion:

              barindex
              Yara detected AntiVM_3Show sources
              Source: Yara matchFile source: 00000000.00000002.221345303.0000000003361000.00000004.00000001.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: 8s3IDkICjfVJdjf.exe PID: 7040, type: MEMORY
              Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)Show sources
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
              Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)Show sources
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
              Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)Show sources
              Source: 8s3IDkICjfVJdjf.exe, 00000000.00000002.221345303.0000000003361000.00000004.00000001.sdmpBinary or memory string: SBIEDLL.DLL
              Source: 8s3IDkICjfVJdjf.exe, 00000000.00000002.221345303.0000000003361000.00000004.00000001.sdmpBinary or memory string: KERNEL32.DLL.WINE_GET_UNIX_FILE_NAME
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeFile opened / queried: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}Jump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe TID: 7044Thread sleep time: -51580s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe TID: 7060Thread sleep time: -922337203685477s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe TID: 6500Thread sleep time: -922337203685477s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe TID: 6500Thread sleep time: -30000s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe TID: 6500Thread sleep time: -59094s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe TID: 6500Thread sleep time: -58908s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe TID: 6500Thread sleep time: -58000s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe TID: 6500Thread sleep time: -57814s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe TID: 6500Thread sleep time: -56908s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe TID: 6500Thread sleep time: -56720s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe TID: 6500Thread sleep time: -55000s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe TID: 6500Thread sleep time: -81000s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe TID: 6500Thread sleep time: -51594s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe TID: 6500Thread sleep time: -51408s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe TID: 6500Thread sleep time: -51220s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe TID: 6500Thread sleep time: -76500s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe TID: 6500Thread sleep time: -50720s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe TID: 6500Thread sleep time: -50500s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe TID: 6500Thread sleep time: -50314s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe TID: 6500Thread sleep time: -75141s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe TID: 6500Thread sleep time: -49908s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe TID: 6500Thread sleep time: -49720s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe TID: 6500Thread sleep time: -49408s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe TID: 6500Thread sleep time: -49220s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe TID: 6500Thread sleep time: -49000s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe TID: 6500Thread sleep time: -48720s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe TID: 6500Thread sleep time: -48314s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe TID: 6500Thread sleep time: -48094s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe TID: 6500Thread sleep time: -47814s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe TID: 6500Thread sleep time: -47594s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe TID: 6500Thread sleep time: -47408s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe TID: 6500Thread sleep time: -47220s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe TID: 6500Thread sleep time: -94000s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe TID: 6500Thread sleep time: -46720s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe TID: 6500Thread sleep time: -46500s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe TID: 6500Thread sleep time: -69471s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe TID: 6500Thread sleep time: -68862s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe TID: 6500Thread sleep time: -45720s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe TID: 6500Thread sleep time: -45220s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe TID: 6500Thread sleep time: -90000s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe TID: 6500Thread sleep time: -67221s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe TID: 6500Thread sleep time: -89188s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe TID: 6500Thread sleep time: -66471s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe TID: 6500Thread sleep time: -44094s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe TID: 6500Thread sleep time: -43094s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe TID: 6500Thread sleep time: -42220s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe TID: 6500Thread sleep time: -42000s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe TID: 6500Thread sleep time: -41094s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe TID: 6500Thread sleep time: -60612s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe TID: 6500Thread sleep time: -60330s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe TID: 6500Thread sleep time: -38000s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe TID: 6500Thread sleep time: -37408s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe TID: 6500Thread sleep time: -37000s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe TID: 6500Thread sleep time: -54891s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe TID: 6500Thread sleep time: -36094s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe TID: 6500Thread sleep time: -53862s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe TID: 6500Thread sleep time: -35720s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe TID: 6500Thread sleep time: -53250s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe TID: 6500Thread sleep time: -35000s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe TID: 6500Thread sleep time: -34814s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe TID: 6500Thread sleep time: -33720s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe TID: 6500Thread sleep time: -50250s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe TID: 6500Thread sleep time: -33314s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe TID: 6500Thread sleep time: -33094s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe TID: 6500Thread sleep time: -32814s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe TID: 6500Thread sleep time: -48891s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe TID: 6500Thread sleep time: -31720s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe TID: 6500Thread sleep time: -31500s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe TID: 6500Thread sleep time: -30000s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe TID: 6500Thread sleep time: -39750s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe TID: 6500Thread sleep time: -36750s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe TID: 6500Thread sleep time: -33141s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe TID: 6500Thread sleep time: -31500s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe TID: 6500Thread sleep time: -30141s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe TID: 6500Thread sleep time: -31000s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe TID: 6500Thread sleep time: -59500s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe TID: 6500Thread sleep time: -58376s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe TID: 6500Thread sleep time: -57094s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe TID: 6500Thread sleep time: -56876s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe TID: 6500Thread sleep time: -56408s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe TID: 6500Thread sleep time: -56000s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe TID: 6500Thread sleep time: -55094s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe TID: 6500Thread sleep time: -43908s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe TID: 6500Thread sleep time: -43720s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe TID: 6500Thread sleep time: -65250s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe TID: 6500Thread sleep time: -43220s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe TID: 6500Thread sleep time: -42814s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe TID: 6500Thread sleep time: -63891s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe TID: 6500Thread sleep time: -42408s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe TID: 6500Thread sleep time: -41908s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe TID: 6500Thread sleep time: -41720s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe TID: 6500Thread sleep time: -62250s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe TID: 6500Thread sleep time: -41314s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe TID: 6500Thread sleep time: -40814s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe TID: 6500Thread sleep time: -40594s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe TID: 6500Thread sleep time: -39720s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe TID: 6500Thread sleep time: -39500s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe TID: 6500Thread sleep time: -39314s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe TID: 6500Thread sleep time: -38408s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe TID: 6500Thread sleep time: -37594s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe TID: 6500Thread sleep time: -30500s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe TID: 6500Thread sleep time: -30094s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe TID: 6500Thread sleep time: -35673s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe TID: 6500Thread sleep time: -53000s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe TID: 6500Thread sleep time: -52094s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe TID: 6500Thread sleep time: -48594s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe TID: 6500Thread sleep time: -47500s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe TID: 6500Thread sleep time: -46594s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe TID: 6500Thread sleep time: -34094s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe TID: 6500Thread sleep time: -33188s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe TID: 6500Thread sleep time: -33000s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe TID: 6500Thread sleep time: -32094s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exe TID: 6500Thread sleep time: -31000s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeLast function: Thread delayed
              Source: 8s3IDkICjfVJdjf.exe, 00000000.00000002.221345303.0000000003361000.00000004.00000001.sdmpBinary or memory string: InstallPathJC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
              Source: 8s3IDkICjfVJdjf.exe, 00000003.00000002.484913211.00000000058C0000.00000002.00000001.sdmpBinary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
              Source: 8s3IDkICjfVJdjf.exe, 00000000.00000002.221345303.0000000003361000.00000004.00000001.sdmpBinary or memory string: vmware
              Source: 8s3IDkICjfVJdjf.exe, 00000003.00000002.480146181.0000000001387000.00000004.00000020.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll Packet Scheduler-0000
              Source: 8s3IDkICjfVJdjf.exe, 00000003.00000002.484913211.00000000058C0000.00000002.00000001.sdmpBinary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
              Source: 8s3IDkICjfVJdjf.exe, 00000003.00000002.484913211.00000000058C0000.00000002.00000001.sdmpBinary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
              Source: 8s3IDkICjfVJdjf.exe, 00000000.00000002.221345303.0000000003361000.00000004.00000001.sdmpBinary or memory string: VMware SVGA II
              Source: 8s3IDkICjfVJdjf.exe, 00000000.00000002.221345303.0000000003361000.00000004.00000001.sdmpBinary or memory string: VMWAREDSOFTWARE\VMware, Inc.\VMware Tools
              Source: 8s3IDkICjfVJdjf.exe, 00000003.00000002.484913211.00000000058C0000.00000002.00000001.sdmpBinary or memory string: An unknown internal message was received by the Hyper-V Compute Service.
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeProcess information queried: ProcessInformationJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeProcess token adjusted: DebugJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeProcess token adjusted: DebugJump to behavior
              Source: C:\Users\user\Desktop\8s3IDkICjfVJdjf.exeMemory allocated: page read and write | page guardJump to behavior

              HIPS / PFW / Operating System Protection Evasion:

              bar