Analysis Report PI.exe

AV Detection:

Found malware configuration

Source: PI.exe.5152.2.memstr

Malware Configuration Extractor: Agenttesla {"Username: ": "l6qpC", "URL: ": "https://xmFob4yUwp.org", "To: ": "info@hybridgroupco.com", "ByHost: ": "mail.hybridgroupco.com:587", "Password: ": "PWiE8a9WlECjO", "From: ": "info@hybridgroupco.com"}

Multi AV Scanner detection for submitted file

Source: PI.exe

ReversingLabs: Detection: 52%

Machine Learning detection for sample

Source: PI.exe

Joe Sandbox ML: detected

Antivirus or Machine Learning detection for unpacked file

Source: 7.2.PI.exe.bb0000.3.unpack	Avira: Label: TR/Spy.Gen8
Source: 2.2.PI.exe.2250000.3.unpack	Avira: Label: TR/Spy.Gen8
Source: 7.2.PI.exe.400000.0.unpack	Avira: Label: TR/Spy.Gen8
Source: 5.2.PI.exe.2760000.3.unpack	Avira: Label: TR/Spy.Gen8

Spreading:

Contains functionality to enumerate / list files inside a directory

Source: C:\Users\user\Desktop\PI.exe	Code function: 0_2_00408994 FindFirstFileA,GetLastError,		0_2_00408994
Source: C:\Users\user\Desktop\PI.exe	Code function: 0_2_00405AE8 GetModuleHandleA,GetProcAddress,lstrcpyn,lstrcpyn,lstrcpyn,FindFirstFileA,FindClose,lstrlen,lstrcpyn,lstrlen,lstrcpyn,		0_2_00405AE8
Source: C:\Users\user\Desktop\PI.exe	Code function: 3_2_00408994 FindFirstFileA,GetLastError,		3_2_00408994
Source: C:\Users\user\Desktop\PI.exe	Code function: 3_2_00405AE8 GetModuleHandleA,GetProcAddress,lstrcpyn,lstrcpyn,lstrcpyn,FindFirstFileA,FindClose,lstrlen,lstrcpyn,lstrlen,lstrcpyn,		3_2_00405AE8
Source: C:\Users\user\Desktop\PI.exe	Code function: 5_2_00408994 FindFirstFileA,GetLastError,		5_2_00408994
Source: C:\Users\user\Desktop\PI.exe	Code function: 5_2_00405AE8 GetModuleHandleA,GetProcAddress,lstrcpyn,lstrcpyn,lstrcpyn,FindFirstFileA,FindClose,lstrlen,lstrcpyn,lstrlen,lstrcpyn,		5_2_00405AE8

Enumerates the file system

Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\			Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\			Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\			Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\			Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\			Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\			Jump to behavior

Networking:

Detected TCP or UDP traffic on non-standard ports

Source: global traffic

TCP traffic: 192.168.2.4:49745 -> 66.70.204.222:587

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 66.70.204.222 66.70.204.222

Internet Provider seen in connection with other malware

Source: Joe Sandbox View

ASN Name: OVHFR OVHFR

Uses SMTP (mail sending)

Source: global traffic

TCP traffic: 192.168.2.4:49745 -> 66.70.204.222:587

Contains functionality to download additional files from the internet

Source: C:\Users\user\Desktop\PI.exe

Code function: 2_2_0233A186 recv,

2_2_0233A186

Performs DNS lookups

Source: unknown

DNS traffic detected: queries for: mail.hybridgroupco.com

Urls found in memory or binary data

Source: PI.exe, PI.exe, 00000007.00000002.706572619.0000000000B42000.00000004.00000001.sdmp	String found in binary or memory: http://127.0.0.1:
Source: PI.exe, 00000002.00000002.944519197.0000000005A20000.00000004.00000001.sdmp	String found in binary or memory: http://apps.identrust.com/roots/dstrootcax3.p7c0
Source: PI.exe, 00000002.00000002.944519197.0000000005A20000.00000004.00000001.sdmp	String found in binary or memory: http://cert.int-x3.letsencrypt.org/0
Source: PI.exe, 00000002.00000002.944519197.0000000005A20000.00000004.00000001.sdmp	String found in binary or memory: http://cps.letsencrypt.org0
Source: PI.exe, 00000002.00000002.944519197.0000000005A20000.00000004.00000001.sdmp	String found in binary or memory: http://cps.root-x1.letsencrypt.org0
Source: PI.exe, 00000002.00000002.944519197.0000000005A20000.00000004.00000001.sdmp	String found in binary or memory: http://crl.identrust
Source: PI.exe, 00000002.00000002.944519197.0000000005A20000.00000004.00000001.sdmp	String found in binary or memory: http://crl.identrust.com/DSTROOTCAX3CRL.crl0
Source: PI.exe, 00000002.00000002.944519197.0000000005A20000.00000004.00000001.sdmp	String found in binary or memory: http://isrg.trustid.ocsp.identrust.com0;
Source: PI.exe, 00000002.00000002.944519197.0000000005A20000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.int-x3.letsencrypt.org0/
Source: PI.exe, PI.exe, 00000007.00000002.706572619.0000000000B42000.00000004.00000001.sdmp	String found in binary or memory: https://api.telegram.org/bot%telegramapi%/
Source: PI.exe	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/
Source: PI.exe	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
Source: PI.exe, 00000000.00000002.681442399.00000000027E5000.00000040.00000001.sdmp, PI.exe, 00000002.00000002.941812642.0000000000402000.00000040.00000001.sdmp, PI.exe, 00000005.00000002.708227438.00000000027D5000.00000040.00000001.sdmp, PI.exe, 00000007.00000002.706572619.0000000000B42000.00000004.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/U
Source: PI.exe, 00000002.00000002.943432491.0000000002C69000.00000004.00000001.sdmp, PI.exe, 00000002.00000002.943600197.0000000002D98000.00000004.00000001.sdmp	String found in binary or memory: https://xmFob4yUwp.org
Source: PI.exe, 00000002.00000002.943293284.0000000002B8A000.00000004.00000001.sdmp	String found in binary or memory: https://xmFob4yUwp.org$

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Contains functionality for read data from the clipboard

Source: C:\Users\user\Desktop\PI.exe

Code function: 0_2_004070C2 OpenClipboard,

0_2_004070C2

Contains functionality to read the clipboard data

Source: C:\Users\user\Desktop\PI.exe

Code function: 0_2_00423388 GetClipboardData,CopyEnhMetaFileA,GetEnhMetaFileHeader,

0_2_00423388

Contains functionality to record screenshots

Source: C:\Users\user\Desktop\PI.exe

Code function: 3_2_004239CC GetObjectA,GetDC,CreateCompatibleDC,CreateBitmap,CreateCompatibleBitmap,GetDeviceCaps,GetDeviceCaps,SelectObject,GetDIBColorTable,GetDIBits,SelectObject,CreateDIBSection,GetDIBits,SelectObject,SelectPalette,RealizePalette,FillRect,SetTextColor,SetBkColor,SetDIBColorTable,PatBlt,CreateCompatibleDC,SelectObject,SelectPalette,RealizePalette,SetTextColor,SetBkColor,BitBlt,SelectPalette,SelectObject,DeleteDC,SelectPalette,

3_2_004239CC

Contains functionality to retrieve information about pressed keystrokes

Source: C:\Users\user\Desktop\PI.exe

Code function: 0_2_004586FC GetKeyboardState,SetKeyboardState,SendMessageA,SendMessageA,

0_2_004586FC

System Summary:

Contains functionality to call native functions

Source: C:\Users\user\Desktop\PI.exe	Code function: 0_2_004547D0 NtdllDefWindowProc_A,		0_2_004547D0
Source: C:\Users\user\Desktop\PI.exe	Code function: 0_2_0042E46C NtdllDefWindowProc_A,		0_2_0042E46C
Source: C:\Users\user\Desktop\PI.exe	Code function: 0_2_00454F4C IsIconic,SetActiveWindow,IsWindowEnabled,SetWindowPos,NtdllDefWindowProc_A,		0_2_00454F4C
Source: C:\Users\user\Desktop\PI.exe	Code function: 0_2_00454FFC IsIconic,SetActiveWindow,IsWindowEnabled,NtdllDefWindowProc_A,SetWindowPos,SetFocus,		0_2_00454FFC
Source: C:\Users\user\Desktop\PI.exe	Code function: 0_2_004493A0 GetSubMenu,SaveDC,RestoreDC,72E7B080,SaveDC,RestoreDC,NtdllDefWindowProc_A,		0_2_004493A0
Source: C:\Users\user\Desktop\PI.exe	Code function: 0_2_00439CA4 NtdllDefWindowProc_A,GetCapture,		0_2_00439CA4
Source: C:\Users\user\Desktop\PI.exe	Code function: 2_2_0046E159 NtCreateSection,		2_2_0046E159
Source: C:\Users\user\Desktop\PI.exe	Code function: 2_2_0233B362 NtQuerySystemInformation,		2_2_0233B362
Source: C:\Users\user\Desktop\PI.exe	Code function: 2_2_0233B331 NtQuerySystemInformation,		2_2_0233B331
Source: C:\Users\user\Desktop\PI.exe	Code function: 3_2_004547D0 NtdllDefWindowProc_A,		3_2_004547D0
Source: C:\Users\user\Desktop\PI.exe	Code function: 3_2_0042E46C NtdllDefWindowProc_A,		3_2_0042E46C
Source: C:\Users\user\Desktop\PI.exe	Code function: 3_2_00454F4C IsIconic,SetActiveWindow,IsWindowEnabled,SetWindowPos,NtdllDefWindowProc_A,		3_2_00454F4C
Source: C:\Users\user\Desktop\PI.exe	Code function: 3_2_00454FFC IsIconic,SetActiveWindow,IsWindowEnabled,NtdllDefWindowProc_A,SetWindowPos,SetFocus,		3_2_00454FFC
Source: C:\Users\user\Desktop\PI.exe	Code function: 3_2_004493A0 GetSubMenu,SaveDC,RestoreDC,GetWindowDC,SaveDC,RestoreDC,NtdllDefWindowProc_A,		3_2_004493A0
Source: C:\Users\user\Desktop\PI.exe	Code function: 3_2_00439CA4 NtdllDefWindowProc_A,GetCapture,		3_2_00439CA4
Source: C:\Users\user\Desktop\PI.exe	Code function: 5_2_004547D0 NtdllDefWindowProc_A,		5_2_004547D0
Source: C:\Users\user\Desktop\PI.exe	Code function: 5_2_0042E46C NtdllDefWindowProc_A,		5_2_0042E46C
Source: C:\Users\user\Desktop\PI.exe	Code function: 5_2_00454F4C IsIconic,SetActiveWindow,IsWindowEnabled,SetWindowPos,NtdllDefWindowProc_A,		5_2_00454F4C
Source: C:\Users\user\Desktop\PI.exe	Code function: 5_2_00454FFC IsIconic,SetActiveWindow,IsWindowEnabled,NtdllDefWindowProc_A,SetWindowPos,SetFocus,		5_2_00454FFC
Source: C:\Users\user\Desktop\PI.exe	Code function: 5_2_004493A0 GetSubMenu,SaveDC,RestoreDC,GetWindowDC,SaveDC,RestoreDC,NtdllDefWindowProc_A,		5_2_004493A0
Source: C:\Users\user\Desktop\PI.exe	Code function: 5_2_00439CA4 NtdllDefWindowProc_A,GetCapture,		5_2_00439CA4

Detected potential crypto function

Source: C:\Users\user\Desktop\PI.exe	Code function: 0_2_0044EEA4		0_2_0044EEA4
Source: C:\Users\user\Desktop\PI.exe	Code function: 0_2_004493A0		0_2_004493A0
Source: C:\Users\user\Desktop\PI.exe	Code function: 0_2_00471BA8		0_2_00471BA8
Source: C:\Users\user\Desktop\PI.exe	Code function: 0_2_0046BD44		0_2_0046BD44
Source: C:\Users\user\Desktop\PI.exe	Code function: 2_2_00467976		2_2_00467976
Source: C:\Users\user\Desktop\PI.exe	Code function: 2_2_0046D13D		2_2_0046D13D
Source: C:\Users\user\Desktop\PI.exe	Code function: 2_2_02332478		2_2_02332478
Source: C:\Users\user\Desktop\PI.exe	Code function: 2_2_04E33468		2_2_04E33468
Source: C:\Users\user\Desktop\PI.exe	Code function: 2_2_04E20007		2_2_04E20007
Source: C:\Users\user\Desktop\PI.exe	Code function: 2_2_04E39010		2_2_04E39010
Source: C:\Users\user\Desktop\PI.exe	Code function: 2_2_04E331F8		2_2_04E331F8
Source: C:\Users\user\Desktop\PI.exe	Code function: 2_2_04E37990		2_2_04E37990
Source: C:\Users\user\Desktop\PI.exe	Code function: 2_2_04E31568		2_2_04E31568
Source: C:\Users\user\Desktop\PI.exe	Code function: 2_2_04E31D20		2_2_04E31D20
Source: C:\Users\user\Desktop\PI.exe	Code function: 2_2_04E3810F		2_2_04E3810F
Source: C:\Users\user\Desktop\PI.exe	Code function: 2_2_04E3B6E8		2_2_04E3B6E8
Source: C:\Users\user\Desktop\PI.exe	Code function: 2_2_04E3DBB8		2_2_04E3DBB8
Source: C:\Users\user\Desktop\PI.exe	Code function: 2_2_04E39388		2_2_04E39388
Source: C:\Users\user\Desktop\PI.exe	Code function: 2_2_04E3CB34		2_2_04E3CB34
Source: C:\Users\user\Desktop\PI.exe	Code function: 2_2_04E3C8EB		2_2_04E3C8EB
Source: C:\Users\user\Desktop\PI.exe	Code function: 2_2_04E39CFE		2_2_04E39CFE
Source: C:\Users\user\Desktop\PI.exe	Code function: 2_2_04E384B1		2_2_04E384B1
Source: C:\Users\user\Desktop\PI.exe	Code function: 2_2_04E328B8		2_2_04E328B8
Source: C:\Users\user\Desktop\PI.exe	Code function: 2_2_04E3C8B8		2_2_04E3C8B8
Source: C:\Users\user\Desktop\PI.exe	Code function: 2_2_04E348BE		2_2_04E348BE
Source: C:\Users\user\Desktop\PI.exe	Code function: 2_2_04E3C889		2_2_04E3C889
Source: C:\Users\user\Desktop\PI.exe	Code function: 2_2_04E32099		2_2_04E32099
Source: C:\Users\user\Desktop\PI.exe	Code function: 2_2_04E3C877		2_2_04E3C877
Source: C:\Users\user\Desktop\PI.exe	Code function: 2_2_04E36C35		2_2_04E36C35
Source: C:\Users\user\Desktop\PI.exe	Code function: 2_2_04E39000		2_2_04E39000
Source: C:\Users\user\Desktop\PI.exe	Code function: 2_2_04E3D5C3		2_2_04E3D5C3
Source: C:\Users\user\Desktop\PI.exe	Code function: 2_2_04E355D3		2_2_04E355D3
Source: C:\Users\user\Desktop\PI.exe	Code function: 2_2_04E38998		2_2_04E38998
Source: C:\Users\user\Desktop\PI.exe	Code function: 2_2_04E31559		2_2_04E31559
Source: C:\Users\user\Desktop\PI.exe	Code function: 2_2_04E32136		2_2_04E32136
Source: C:\Users\user\Desktop\PI.exe	Code function: 2_2_04E3553A		2_2_04E3553A
Source: C:\Users\user\Desktop\PI.exe	Code function: 2_2_04E39D03		2_2_04E39D03
Source: C:\Users\user\Desktop\PI.exe	Code function: 2_2_04E39D08		2_2_04E39D08
Source: C:\Users\user\Desktop\PI.exe	Code function: 2_2_04E31D10		2_2_04E31D10
Source: C:\Users\user\Desktop\PI.exe	Code function: 2_2_04E37A98		2_2_04E37A98
Source: C:\Users\user\Desktop\PI.exe	Code function: 2_2_04E3566C		2_2_04E3566C
Source: C:\Users\user\Desktop\PI.exe	Code function: 2_2_04E36A72		2_2_04E36A72
Source: C:\Users\user\Desktop\PI.exe	Code function: 2_2_04E37E78		2_2_04E37E78
Source: C:\Users\user\Desktop\PI.exe	Code function: 2_2_04E33468		2_2_04E33468
Source: C:\Users\user\Desktop\PI.exe	Code function: 2_2_04E3A3A2		2_2_04E3A3A2
Source: C:\Users\user\Desktop\PI.exe	Code function: 2_2_04E3DBA9		2_2_04E3DBA9
Source: C:\Users\user\Desktop\PI.exe	Code function: 2_2_04E357AD		2_2_04E357AD
Source: C:\Users\user\Desktop\PI.exe	Code function: 2_2_04E39378		2_2_04E39378
Source: C:\Users\user\Desktop\PI.exe	Code function: 2_2_059A59C8		2_2_059A59C8
Source: C:\Users\user\Desktop\PI.exe	Code function: 2_2_059A07F0		2_2_059A07F0
Source: C:\Users\user\Desktop\PI.exe	Code function: 2_2_059A0D10		2_2_059A0D10
Source: C:\Users\user\Desktop\PI.exe	Code function: 2_2_059A7710		2_2_059A7710
Source: C:\Users\user\Desktop\PI.exe	Code function: 2_2_059A3F22		2_2_059A3F22
Source: C:\Users\user\Desktop\PI.exe	Code function: 2_2_059A3740		2_2_059A3740
Source: C:\Users\user\Desktop\PI.exe	Code function: 2_2_059A5370		2_2_059A5370
Source: C:\Users\user\Desktop\PI.exe	Code function: 2_2_059A1EB0		2_2_059A1EB0
Source: C:\Users\user\Desktop\PI.exe	Code function: 2_2_059A1CC0		2_2_059A1CC0
Source: C:\Users\user\Desktop\PI.exe	Code function: 2_2_059A56F3		2_2_059A56F3
Source: C:\Users\user\Desktop\PI.exe	Code function: 2_2_059A7E08		2_2_059A7E08
Source: C:\Users\user\Desktop\PI.exe	Code function: 2_2_059A8648		2_2_059A8648
Source: C:\Users\user\Desktop\PI.exe	Code function: 2_2_059A0788		2_2_059A0788
Source: C:\Users\user\Desktop\PI.exe	Code function: 2_2_059A0DBB		2_2_059A0DBB
Source: C:\Users\user\Desktop\PI.exe	Code function: 2_2_059A07D3		2_2_059A07D3
Source: C:\Users\user\Desktop\PI.exe	Code function: 2_2_059A63CC		2_2_059A63CC
Source: C:\Users\user\Desktop\PI.exe	Code function: 2_2_059A0DCD		2_2_059A0DCD
Source: C:\Users\user\Desktop\PI.exe	Code function: 2_2_059A3FC7		2_2_059A3FC7
Source: C:\Users\user\Desktop\PI.exe	Code function: 2_2_059A7DF8		2_2_059A7DF8
Source: C:\Users\user\Desktop\PI.exe	Code function: 2_2_059A1115		2_2_059A1115
Source: C:\Users\user\Desktop\PI.exe	Code function: 2_2_059A7703		2_2_059A7703
Source: C:\Users\user\Desktop\PI.exe	Code function: 2_2_059A3731		2_2_059A3731
Source: C:\Users\user\Desktop\PI.exe	Code function: 2_2_059A3F7C		2_2_059A3F7C
Source: C:\Users\user\Desktop\PI.exe	Code function: 2_2_059A0E93		2_2_059A0E93
Source: C:\Users\user\Desktop\PI.exe	Code function: 2_2_059A7E87		2_2_059A7E87
Source: C:\Users\user\Desktop\PI.exe	Code function: 2_2_059A72BC		2_2_059A72BC
Source: C:\Users\user\Desktop\PI.exe	Code function: 2_2_059A1CB0		2_2_059A1CB0
Source: C:\Users\user\Desktop\PI.exe	Code function: 2_2_059A1EA3		2_2_059A1EA3
Source: C:\Users\user\Desktop\PI.exe	Code function: 2_2_059A08D6		2_2_059A08D6
Source: C:\Users\user\Desktop\PI.exe	Code function: 2_2_059A0CF2		2_2_059A0CF2
Source: C:\Users\user\Desktop\PI.exe	Code function: 2_2_059A2414		2_2_059A2414
Source: C:\Users\user\Desktop\PI.exe	Code function: 2_2_059A0A2A		2_2_059A0A2A
Source: C:\Users\user\Desktop\PI.exe	Code function: 2_2_059A0E6A		2_2_059A0E6A
Source: C:\Users\user\Desktop\PI.exe	Code function: 3_2_0044EEA4		3_2_0044EEA4
Source: C:\Users\user\Desktop\PI.exe	Code function: 3_2_004493A0		3_2_004493A0
Source: C:\Users\user\Desktop\PI.exe	Code function: 3_2_00471BA8		3_2_00471BA8
Source: C:\Users\user\Desktop\PI.exe	Code function: 3_2_0046BD44		3_2_0046BD44
Source: C:\Users\user\Desktop\PI.exe	Code function: 5_2_0044EEA4		5_2_0044EEA4
Source: C:\Users\user\Desktop\PI.exe	Code function: 5_2_004493A0		5_2_004493A0
Source: C:\Users\user\Desktop\PI.exe	Code function: 5_2_00471BA8		5_2_00471BA8
Source: C:\Users\user\Desktop\PI.exe	Code function: 5_2_0046BD44		5_2_0046BD44
Source: C:\Users\user\Desktop\PI.exe	Code function: 7_2_00467976		7_2_00467976
Source: C:\Users\user\Desktop\PI.exe	Code function: 7_2_0046D13D		7_2_0046D13D

Found potential string decryption / allocating functions

Source: C:\Users\user\Desktop\PI.exe	Code function: String function: 004035DC appears 109 times
Source: C:\Users\user\Desktop\PI.exe	Code function: String function: 00467F3C appears 33 times
Source: C:\Users\user\Desktop\PI.exe	Code function: String function: 00403E24 appears 54 times
Source: C:\Users\user\Desktop\PI.exe	Code function: String function: 00402774 appears 44 times
Source: C:\Users\user\Desktop\PI.exe	Code function: String function: 0040436C appears 54 times
Source: C:\Users\user\Desktop\PI.exe	Code function: String function: 004066E0 appears 48 times
Source: C:\Users\user\Desktop\PI.exe	Code function: String function: 004148B4 appears 36 times
Source: C:\Users\user\Desktop\PI.exe	Code function: String function: 00404348 appears 233 times
Source: C:\Users\user\Desktop\PI.exe	Code function: String function: 0040C2CC appears 54 times
Source: C:\Users\user\Desktop\PI.exe	Code function: String function: 004039A8 appears 118 times
Source: C:\Users\user\Desktop\PI.exe	Code function: String function: 00403DD0 appears 40 times
Source: C:\Users\user\Desktop\PI.exe	Code function: String function: 0040695C appears 42 times

PE file contains strange resources

Source: PI.exe

Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST

Sample file is different than original file name gathered from version info

Source: PI.exe, 00000000.00000002.681442399.00000000027E5000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenameyZFlSsyWYLpOIrYUuUqNGPSmFjhfv.exe4 vs PI.exe
Source: PI.exe, 00000000.00000002.681052578.0000000002370000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameuser32j% vs PI.exe
Source: PI.exe	Binary or memory string: OriginalFilename vs PI.exe
Source: PI.exe, 00000002.00000002.941812642.0000000000402000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenameyZFlSsyWYLpOIrYUuUqNGPSmFjhfv.exe4 vs PI.exe
Source: PI.exe, 00000002.00000002.944407117.00000000058A0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamewshom.ocx.mui vs PI.exe
Source: PI.exe, 00000002.00000002.944104826.0000000005210000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameKernelbase.dll.muij% vs PI.exe
Source: PI.exe, 00000003.00000002.707407270.0000000002330000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameuser32j% vs PI.exe
Source: PI.exe, 00000005.00000002.708291240.0000000002836000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenameyZFlSsyWYLpOIrYUuUqNGPSmFjhfv.exe4 vs PI.exe
Source: PI.exe, 00000005.00000002.708009088.0000000002470000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameuser32j% vs PI.exe
Source: PI.exe	Binary or memory string: OriginalFilename vs PI.exe
Source: PI.exe, 00000007.00000002.706572619.0000000000B42000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameyZFlSsyWYLpOIrYUuUqNGPSmFjhfv.exe4 vs PI.exe

.NET source code contains calls to encryption/decryption functions

Source: 0.2.PI.exe.2770000.3.unpack, gtu.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.PI.exe.2770000.3.unpack, gtu.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformFinalBlock'
Source: 0.2.PI.exe.2770000.3.unpack, gtu.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformBlock'
Source: 0.2.PI.exe.2770000.3.unpack, DPAPI.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 0.2.PI.exe.2770000.3.unpack, DPAPI.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 2.2.PI.exe.21e0000.2.unpack, gtu.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 2.2.PI.exe.21e0000.2.unpack, gtu.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformFinalBlock'
Source: 2.2.PI.exe.21e0000.2.unpack, gtu.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformBlock'

Classification label

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@16/2@1/2

Contains functionality for error logging

Source: C:\Users\user\Desktop\PI.exe

Code function: 0_2_00420A54 GetLastError,FormatMessageA,

0_2_00420A54

Contains functionality to adjust token privileges (e.g. debug / backup)

Source: C:\Users\user\Desktop\PI.exe	Code function: 2_2_0233B1E6 AdjustTokenPrivileges,		2_2_0233B1E6
Source: C:\Users\user\Desktop\PI.exe	Code function: 2_2_0233B1AF AdjustTokenPrivileges,		2_2_0233B1AF

Contains functionality to check free disk space

Source: C:\Users\user\Desktop\PI.exe

Code function: 0_2_00408B5E GetDiskFreeSpaceA,

0_2_00408B5E

Contains functionality to load and extract PE file embedded resources

Source: C:\Users\user\Desktop\PI.exe

Code function: 0_2_004171B0 FindResourceA,LoadResource,SizeofResource,LockResource,

0_2_004171B0

Creates files inside the user directory

Source: C:\Windows\SysWOW64\notepad.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\STRATUP.vbs

Jump to behavior

Creates mutexes

Source: C:\Users\user\Desktop\PI.exe

Mutant created: \Sessions\1\BaseNamedObjects\Global\.net clr networking

Executes visual basic scripts

Source: unknown

Process created: C:\Windows\System32\wscript.exe 'C:\Windows\System32\WScript.exe' 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\STRATUP.vbs'

Parts of this applications are using Borland Delphi (Probably coded in Delphi)

Source: C:\Users\user\Desktop\PI.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior

Parts of this applications are using the .NET runtime (Probably coded in C#)

Source: C:\Users\user\Desktop\PI.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp			Jump to behavior

Queries process information (via WMI, Win32_Process)

Source: C:\Users\user\Desktop\PI.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\PI.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Reads ini files

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Reads software policies

Source: C:\Users\user\Desktop\PI.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Reads the hosts file

Source: C:\Users\user\Desktop\PI.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Sample is known by Antivirus

Source: PI.exe

ReversingLabs: Detection: 52%

Spawns processes

Source: unknown	Process created: C:\Users\user\Desktop\PI.exe 'C:\Users\user\Desktop\PI.exe'
Source: unknown	Process created: C:\Windows\SysWOW64\notepad.exe C:\Windows\system32\notepad.exe
Source: unknown	Process created: C:\Users\user\Desktop\PI.exe 'C:\Users\user\Desktop\PI.exe'
Source: unknown	Process created: C:\Users\user\Desktop\PI.exe 'C:\Users\user\Desktop\PI.exe' 2 5152 5197828
Source: unknown	Process created: C:\Windows\System32\wscript.exe 'C:\Windows\System32\WScript.exe' 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\STRATUP.vbs'
Source: unknown	Process created: C:\Users\user\Desktop\PI.exe 'C:\Users\user\Desktop\PI.exe'
Source: unknown	Process created: C:\Windows\SysWOW64\notepad.exe C:\Windows\system32\notepad.exe
Source: unknown	Process created: C:\Users\user\Desktop\PI.exe 'C:\Users\user\Desktop\PI.exe'
Source: unknown	Process created: C:\Users\user\Desktop\PI.exe 'C:\Users\user\Desktop\PI.exe' 2 6728 5209890
Source: C:\Users\user\Desktop\PI.exe	Process created: C:\Windows\SysWOW64\notepad.exe C:\Windows\system32\notepad.exe			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process created: C:\Users\user\Desktop\PI.exe 'C:\Users\user\Desktop\PI.exe'			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process created: C:\Users\user\Desktop\PI.exe 'C:\Users\user\Desktop\PI.exe' 2 5152 5197828			Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\Desktop\PI.exe 'C:\Users\user\Desktop\PI.exe'			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process created: C:\Windows\SysWOW64\notepad.exe C:\Windows\system32\notepad.exe			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process created: C:\Users\user\Desktop\PI.exe 'C:\Users\user\Desktop\PI.exe'			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process created: C:\Users\user\Desktop\PI.exe 'C:\Users\user\Desktop\PI.exe' 2 6728 5209890			Jump to behavior

Uses an in-process (OLE) Automation server

Source: C:\Users\user\Desktop\PI.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\InProcServer32

Jump to behavior

Uses Microsoft Silverlight

Source: C:\Users\user\Desktop\PI.exe

File opened: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll

Jump to behavior

Checks if Microsoft Office is installed

Source: C:\Users\user\Desktop\PI.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Uses new MSVCR Dlls

Source: C:\Users\user\Desktop\PI.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_d08c58b4442ba54f\MSVCR80.dll

Jump to behavior

Data Obfuscation:

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\PI.exe

Unpacked PE file: 2.2.PI.exe.400000.0.unpack CODE:ER;DATA:W;BSS:W;.idata:W;.tls:W;.rdata:R;.reloc:R;.rsrc:R; vs .text:ER;.rsrc:R;.reloc:R;

Detected unpacking (creates a PE file in dynamic memory)

Source: C:\Users\user\Desktop\PI.exe

Unpacked PE file: 2.2.PI.exe.2250000.3.unpack

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\PI.exe

Unpacked PE file: 2.2.PI.exe.400000.0.unpack

.NET source code contains potential unpacker

Source: 0.2.PI.exe.2770000.3.unpack, gtu.cs	.Net Code: ncv System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 2.2.PI.exe.21e0000.2.unpack, gtu.cs	.Net Code: ncv System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 2.2.PI.exe.2250000.3.unpack, gtu.cs	.Net Code: ncv System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 2.2.PI.exe.400000.0.unpack, gtu.cs	.Net Code: ncv System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 7.2.PI.exe.bb0000.3.unpack, gtu.cs	.Net Code: ncv System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 7.2.PI.exe.b40000.2.unpack, gtu.cs	.Net Code: ncv System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\PI.exe

Code function: 0_2_00440918 SetErrorMode,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,SetErrorMode,

0_2_00440918

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\PI.exe	Code function: 0_2_00440F64 push 00440FF1h; ret		0_2_00440FE9
Source: C:\Users\user\Desktop\PI.exe	Code function: 0_2_0040C076 push 0040C0E7h; ret		0_2_0040C0DF
Source: C:\Users\user\Desktop\PI.exe	Code function: 0_2_0040C078 push 0040C0E7h; ret		0_2_0040C0DF
Source: C:\Users\user\Desktop\PI.exe	Code function: 0_2_0040C156 push 0040C184h; ret		0_2_0040C17C
Source: C:\Users\user\Desktop\PI.exe	Code function: 0_2_0040C158 push 0040C184h; ret		0_2_0040C17C
Source: C:\Users\user\Desktop\PI.exe	Code function: 0_2_004421E4 push ecx; mov dword ptr [esp], edx		0_2_004421E8
Source: C:\Users\user\Desktop\PI.exe	Code function: 0_2_004101F0 push 004103F1h; ret		0_2_004103E9
Source: C:\Users\user\Desktop\PI.exe	Code function: 0_2_0041018C push 004101EDh; ret		0_2_004101E5
Source: C:\Users\user\Desktop\PI.exe	Code function: 0_2_004642CC push 004642F8h; ret		0_2_004642F0
Source: C:\Users\user\Desktop\PI.exe	Code function: 0_2_004103F4 push 00410538h; ret		0_2_00410530
Source: C:\Users\user\Desktop\PI.exe	Code function: 0_2_004264A8 push 00426578h; ret		0_2_00426570
Source: C:\Users\user\Desktop\PI.exe	Code function: 0_2_0041050C push 00410538h; ret		0_2_00410530
Source: C:\Users\user\Desktop\PI.exe	Code function: 0_2_0044251C push 00442548h; ret		0_2_00442540
Source: C:\Users\user\Desktop\PI.exe	Code function: 0_2_0040659E push 004065F1h; ret		0_2_004065E9
Source: C:\Users\user\Desktop\PI.exe	Code function: 0_2_004065A0 push 004065F1h; ret		0_2_004065E9
Source: C:\Users\user\Desktop\PI.exe	Code function: 0_2_00460674 push 004606A0h; ret		0_2_00460698
Source: C:\Users\user\Desktop\PI.exe	Code function: 0_2_004306D0 push 0043073Ah; ret		0_2_00430732
Source: C:\Users\user\Desktop\PI.exe	Code function: 0_2_0041C680 push ecx; mov dword ptr [esp], edx		0_2_0041C685
Source: C:\Users\user\Desktop\PI.exe	Code function: 0_2_00426688 push 004266B4h; ret		0_2_004266AC
Source: C:\Users\user\Desktop\PI.exe	Code function: 0_2_00406770 push 0040679Ch; ret		0_2_00406794
Source: C:\Users\user\Desktop\PI.exe	Code function: 0_2_0043073C push 004307A6h; ret		0_2_0043079E
Source: C:\Users\user\Desktop\PI.exe	Code function: 0_2_0040682C push 00406858h; ret		0_2_00406850
Source: C:\Users\user\Desktop\PI.exe	Code function: 0_2_00426940 push 0042696Ch; ret		0_2_00426964
Source: C:\Users\user\Desktop\PI.exe	Code function: 0_2_0041A914 push ecx; mov dword ptr [esp], edx		0_2_0041A916
Source: C:\Users\user\Desktop\PI.exe	Code function: 0_2_0045691C push 00456976h; ret		0_2_0045696E
Source: C:\Users\user\Desktop\PI.exe	Code function: 0_2_004289CC push 004289F8h; ret		0_2_004289F0
Source: C:\Users\user\Desktop\PI.exe	Code function: 0_2_00428980 push 004289C1h; ret		0_2_004289B9
Source: C:\Users\user\Desktop\PI.exe	Code function: 0_2_00428A04 push 00428A3Ch; ret		0_2_00428A34
Source: C:\Users\user\Desktop\PI.exe	Code function: 0_2_00456B34 push ecx; mov dword ptr [esp], edx		0_2_00456B39
Source: C:\Users\user\Desktop\PI.exe	Code function: 0_2_00412BE4 push ecx; mov dword ptr [esp], eax		0_2_00412BE5
Source: C:\Users\user\Desktop\PI.exe	Code function: 0_2_0042EBF4 push 0042EC20h; ret		0_2_0042EC18

Boot Survival:

Drops VBS files to the startup folder

Source: C:\Windows\SysWOW64\notepad.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\STRATUP.vbs
Source: C:\Windows\SysWOW64\notepad.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\STRATUP.vbs			Jump to dropped file

Creates a start menu entry (Start Menu\Programs\Startup)

Source: C:\Windows\SysWOW64\notepad.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\STRATUP.vbs

Jump to behavior

Stores files to the Windows start menu directory

Source: C:\Windows\SysWOW64\notepad.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\STRATUP.vbs			Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\STRATUP.vbs			Jump to behavior

Hooking and other Techniques for Hiding and Protection:

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Source: C:\Users\user\Desktop\PI.exe	Code function: 0_2_00454858 PostMessageA,PostMessageA,SendMessageA,GetProcAddress,GetLastError,IsWindowEnabled,IsWindowVisible,GetFocus,SetFocus,SetFocus,IsIconic,GetFocus,SetFocus,		0_2_00454858
Source: C:\Users\user\Desktop\PI.exe	Code function: 0_2_0043C504 IsIconic,GetWindowPlacement,GetWindowRect,GetWindowLongA,GetWindowLongA,ScreenToClient,ScreenToClient,		0_2_0043C504
Source: C:\Users\user\Desktop\PI.exe	Code function: 0_2_00454F4C IsIconic,SetActiveWindow,IsWindowEnabled,SetWindowPos,NtdllDefWindowProc_A,		0_2_00454F4C
Source: C:\Users\user\Desktop\PI.exe	Code function: 0_2_00454FFC IsIconic,SetActiveWindow,IsWindowEnabled,NtdllDefWindowProc_A,SetWindowPos,SetFocus,		0_2_00454FFC
Source: C:\Users\user\Desktop\PI.exe	Code function: 0_2_0043B378 IsIconic,GetCapture,		0_2_0043B378
Source: C:\Users\user\Desktop\PI.exe	Code function: 0_2_00427394 IsIconic,GetWindowPlacement,GetWindowRect,		0_2_00427394
Source: C:\Users\user\Desktop\PI.exe	Code function: 0_2_0045194C SendMessageA,ShowWindow,ShowWindow,CallWindowProcA,SendMessageA,ShowWindow,SetWindowPos,GetActiveWindow,IsIconic,SetWindowPos,SetActiveWindow,ShowWindow,		0_2_0045194C
Source: C:\Users\user\Desktop\PI.exe	Code function: 0_2_0043BC20 IsIconic,SetWindowPos,GetWindowPlacement,SetWindowPlacement,		0_2_0043BC20
Source: C:\Users\user\Desktop\PI.exe	Code function: 3_2_00454858 PostMessageA,PostMessageA,SendMessageA,GetProcAddress,GetLastError,IsWindowEnabled,IsWindowVisible,GetFocus,SetFocus,SetFocus,IsIconic,GetFocus,SetFocus,		3_2_00454858
Source: C:\Users\user\Desktop\PI.exe	Code function: 3_2_0043C504 IsIconic,GetWindowPlacement,GetWindowRect,GetWindowLongA,GetWindowLongA,ScreenToClient,ScreenToClient,		3_2_0043C504
Source: C:\Users\user\Desktop\PI.exe	Code function: 3_2_00454F4C IsIconic,SetActiveWindow,IsWindowEnabled,SetWindowPos,NtdllDefWindowProc_A,		3_2_00454F4C
Source: C:\Users\user\Desktop\PI.exe	Code function: 3_2_00454FFC IsIconic,SetActiveWindow,IsWindowEnabled,NtdllDefWindowProc_A,SetWindowPos,SetFocus,		3_2_00454FFC
Source: C:\Users\user\Desktop\PI.exe	Code function: 3_2_0043B378 IsIconic,GetCapture,		3_2_0043B378
Source: C:\Users\user\Desktop\PI.exe	Code function: 3_2_00427394 IsIconic,GetWindowPlacement,GetWindowRect,		3_2_00427394
Source: C:\Users\user\Desktop\PI.exe	Code function: 3_2_0045194C SendMessageA,ShowWindow,ShowWindow,CallWindowProcA,SendMessageA,ShowWindow,SetWindowPos,GetActiveWindow,IsIconic,SetWindowPos,SetActiveWindow,ShowWindow,		3_2_0045194C
Source: C:\Users\user\Desktop\PI.exe	Code function: 3_2_0043BC20 IsIconic,SetWindowPos,GetWindowPlacement,SetWindowPlacement,		3_2_0043BC20
Source: C:\Users\user\Desktop\PI.exe	Code function: 5_2_00454858 PostMessageA,PostMessageA,SendMessageA,GetProcAddress,GetLastError,IsWindowEnabled,IsWindowVisible,GetFocus,SetFocus,SetFocus,IsIconic,GetFocus,SetFocus,		5_2_00454858
Source: C:\Users\user\Desktop\PI.exe	Code function: 5_2_0043C504 IsIconic,GetWindowPlacement,GetWindowRect,GetWindowLongA,GetWindowLongA,ScreenToClient,ScreenToClient,		5_2_0043C504
Source: C:\Users\user\Desktop\PI.exe	Code function: 5_2_00454F4C IsIconic,SetActiveWindow,IsWindowEnabled,SetWindowPos,NtdllDefWindowProc_A,		5_2_00454F4C
Source: C:\Users\user\Desktop\PI.exe	Code function: 5_2_00454FFC IsIconic,SetActiveWindow,IsWindowEnabled,NtdllDefWindowProc_A,SetWindowPos,SetFocus,		5_2_00454FFC
Source: C:\Users\user\Desktop\PI.exe	Code function: 5_2_0043B378 IsIconic,GetCapture,		5_2_0043B378
Source: C:\Users\user\Desktop\PI.exe	Code function: 5_2_00427394 IsIconic,GetWindowPlacement,GetWindowRect,		5_2_00427394
Source: C:\Users\user\Desktop\PI.exe	Code function: 5_2_0045194C SendMessageA,ShowWindow,ShowWindow,CallWindowProcA,SendMessageA,ShowWindow,SetWindowPos,GetActiveWindow,IsIconic,SetWindowPos,SetActiveWindow,ShowWindow,		5_2_0045194C
Source: C:\Users\user\Desktop\PI.exe	Code function: 5_2_0043BC20 IsIconic,SetWindowPos,GetWindowPlacement,SetWindowPlacement,		5_2_0043BC20

Extensive use of GetProcAddress (often used to hide API calls)

Source: C:\Users\user\Desktop\PI.exe

Code function: 0_2_00440918 SetErrorMode,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,SetErrorMode,

0_2_00440918

Disables application error messsages (SetErrorMode)

Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion:

Contains functionality to detect sleep reduction / modifications

Source: C:\Users\user\Desktop\PI.exe	Code function: 0_2_0043061C		0_2_0043061C
Source: C:\Users\user\Desktop\PI.exe	Code function: 3_2_0043061C		3_2_0043061C
Source: C:\Users\user\Desktop\PI.exe	Code function: 5_2_0043061C		5_2_0043061C

Delayed program exit found

Source: C:\Windows\SysWOW64\notepad.exe	Code function: 1_2_032305C0 Sleep,ExitProcess,		1_2_032305C0
Source: C:\Windows\SysWOW64\notepad.exe	Code function: 6_2_00CB05C0 Sleep,ExitProcess,		6_2_00CB05C0

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Source: C:\Users\user\Desktop\PI.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\Desktop\PI.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Contains capabilities to detect virtual machines

Source: C:\Windows\System32\wscript.exe

File opened / queried: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Jump to behavior

Contains functionality to detect sandboxes (mouse cursor move detection)

Source: C:\Users\user\Desktop\PI.exe	Code function: GetCurrentThreadId,GetCursorPos,WaitForSingleObject,		0_2_00453E2C
Source: C:\Users\user\Desktop\PI.exe	Code function: GetCurrentThreadId,GetCursorPos,WaitForSingleObject,		3_2_00453E2C
Source: C:\Users\user\Desktop\PI.exe	Code function: GetCurrentThreadId,GetCursorPos,WaitForSingleObject,		5_2_00453E2C

Contains long sleeps (>= 3 min)

Source: C:\Users\user\Desktop\PI.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Found WSH timer for Javascript or VBS script (likely evasive script)

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

May check if the current machine is a sandbox (GetTickCount - Sleep)

Source: C:\Users\user\Desktop\PI.exe

Code function: 5_2_0043061C

5_2_0043061C

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -120000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -118624s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -88641s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -88359s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -117440s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -87330s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -115624s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -115188s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -56906s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -113440s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -113000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -83718s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -111188s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -110812s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -109440s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -109000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -108624s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -80109s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -79830s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -79500s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -52720s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -52500s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -78468s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -78141s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -51720s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -76830s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -76500s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -101188s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -49906s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -49720s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -99000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -73218s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -72891s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -96812s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -96440s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -71250s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -70968s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -69609s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -69330s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -46000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -45720s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -67968s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -67359s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -44720s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -66330s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -66000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -43812s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -64359s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -64080s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -41812s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -41594s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -41406s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -82440s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -61080s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -60468s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -60141s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -39594s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -58830s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -58500s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -58218s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -38500s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -57141s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -56859s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -56580s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -55830s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -55500s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -55218s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -54891s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -36094s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -53859s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -35720s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -53250s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -35000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -52218s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -51891s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -34406s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -51330s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -33906s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -33720s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -50250s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -49641s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -32812s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -32594s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -48609s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -48000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -31500s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -46968s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -61440s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -45750s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -45000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -44718s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -42750s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -38859s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -38580s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -37218s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -35580s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -35250s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -89718s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -89391s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -87750s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -86109s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -85830s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -84468s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -54094s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -80580s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -75609s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -75330s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -73968s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -73641s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -48000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -64830s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -63141s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -61500s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -39906s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -39720s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -38594s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -36220s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -35094s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -34000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -32906s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -31812s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -31594s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -55220s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -52594s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -51500s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -47094s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -46906s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -45812s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -45094s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -43406s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -42312s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6912	Thread sleep time: -30906s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe TID: 6552	Thread sleep count: 74 > 30			Jump to behavior

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Source: C:\Users\user\Desktop\PI.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\PI.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Sample execution stops while process was sleeping (likely an evasion)

Source: C:\Users\user\Desktop\PI.exe	Last function: Thread delayed
Source: C:\Users\user\Desktop\PI.exe	Last function: Thread delayed
Source: C:\Users\user\Desktop\PI.exe	Last function: Thread delayed

Uses the system / local time for branch decision (may execute only at specific dates)

Source: C:\Users\user\Desktop\PI.exe	Code function: 0_2_00475588 GetSystemTime followed by cmp: cmp word ptr [esp], 07e4h and CTI: jnc 004755A3h		0_2_00475588
Source: C:\Users\user\Desktop\PI.exe	Code function: 3_2_00475588 GetSystemTime followed by cmp: cmp word ptr [esp], 07e4h and CTI: jnc 004755A3h		3_2_00475588
Source: C:\Users\user\Desktop\PI.exe	Code function: 5_2_00475588 GetSystemTime followed by cmp: cmp word ptr [esp], 07e4h and CTI: jnc 004755A3h		5_2_00475588

Contains functionality to enumerate / list files inside a directory

Source: C:\Users\user\Desktop\PI.exe	Code function: 0_2_00408994 FindFirstFileA,GetLastError,		0_2_00408994
Source: C:\Users\user\Desktop\PI.exe	Code function: 0_2_00405AE8 GetModuleHandleA,GetProcAddress,lstrcpyn,lstrcpyn,lstrcpyn,FindFirstFileA,FindClose,lstrlen,lstrcpyn,lstrlen,lstrcpyn,		0_2_00405AE8
Source: C:\Users\user\Desktop\PI.exe	Code function: 3_2_00408994 FindFirstFileA,GetLastError,		3_2_00408994
Source: C:\Users\user\Desktop\PI.exe	Code function: 3_2_00405AE8 GetModuleHandleA,GetProcAddress,lstrcpyn,lstrcpyn,lstrcpyn,FindFirstFileA,FindClose,lstrlen,lstrcpyn,lstrlen,lstrcpyn,		3_2_00405AE8
Source: C:\Users\user\Desktop\PI.exe	Code function: 5_2_00408994 FindFirstFileA,GetLastError,		5_2_00408994
Source: C:\Users\user\Desktop\PI.exe	Code function: 5_2_00405AE8 GetModuleHandleA,GetProcAddress,lstrcpyn,lstrcpyn,lstrcpyn,FindFirstFileA,FindClose,lstrlen,lstrcpyn,lstrlen,lstrcpyn,		5_2_00405AE8

Contains functionality to query system information

Source: C:\Users\user\Desktop\PI.exe

Code function: 0_2_00420FE4 GetSystemInfo,

0_2_00420FE4

Enumerates the file system

Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\			Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\			Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\			Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\			Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\			Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\			Jump to behavior

May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)

Source: PI.exe, 00000002.00000002.944104826.0000000005210000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: PI.exe, 00000002.00000002.944104826.0000000005210000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: PI.exe, 00000002.00000002.944104826.0000000005210000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: wscript.exe, 00000004.00000002.702851391.0000022471482000.00000004.00000020.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}Z
Source: wscript.exe, 00000004.00000002.702851391.0000022471482000.00000004.00000020.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: PI.exe, 00000002.00000002.944519197.0000000005A20000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: PI.exe, 00000002.00000002.944104826.0000000005210000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Queries a list of all running processes

Source: C:\Users\user\Desktop\PI.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging:

Checks if the current process is being debugged

Source: C:\Users\user\Desktop\PI.exe	Process queried: DebugFlags			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process queried: DebugObjectHandle			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process queried: DebugFlags			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process queried: DebugObjectHandle			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process queried: DebugFlags			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process queried: DebugObjectHandle			Jump to behavior

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Source: C:\Users\user\Desktop\PI.exe

Code function: 2_2_04E33468 LdrInitializeThunk,

2_2_04E33468

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Source: C:\Users\user\Desktop\PI.exe

Code function: 2_2_004696F3 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

2_2_004696F3

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\PI.exe

Code function: 0_2_00440918 SetErrorMode,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,SetErrorMode,

0_2_00440918

Contains functionality to read the PEB

Source: C:\Users\user\Desktop\PI.exe	Code function: 2_2_0046D412 mov eax, dword ptr fs:[00000030h]		2_2_0046D412
Source: C:\Users\user\Desktop\PI.exe	Code function: 2_2_0046D4D0 mov eax, dword ptr fs:[00000030h]		2_2_0046D4D0
Source: C:\Users\user\Desktop\PI.exe	Code function: 7_2_0046D412 mov eax, dword ptr fs:[00000030h]		7_2_0046D412
Source: C:\Users\user\Desktop\PI.exe	Code function: 7_2_0046D4D0 mov eax, dword ptr fs:[00000030h]		7_2_0046D4D0

Enables debug privileges

Source: C:\Users\user\Desktop\PI.exe

Process token adjusted: Debug

Jump to behavior

Contains functionality to register its own exception handler

Source: C:\Users\user\Desktop\PI.exe	Code function: 2_2_004696F3 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		2_2_004696F3
Source: C:\Users\user\Desktop\PI.exe	Code function: 2_2_00468746 SetUnhandledExceptionFilter,		2_2_00468746
Source: C:\Users\user\Desktop\PI.exe	Code function: 2_2_0046BD7F __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		2_2_0046BD7F
Source: C:\Users\user\Desktop\PI.exe	Code function: 2_2_00469BB5 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		2_2_00469BB5
Source: C:\Users\user\Desktop\PI.exe	Code function: 7_2_0046BD7F __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		7_2_0046BD7F
Source: C:\Users\user\Desktop\PI.exe	Code function: 7_2_004696F3 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		7_2_004696F3
Source: C:\Users\user\Desktop\PI.exe	Code function: 7_2_00469BB5 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		7_2_00469BB5

Creates guard pages, often used to prevent reverse engineering and debugging

Source: C:\Users\user\Desktop\PI.exe

Memory protected: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\PI.exe	Memory allocated: C:\Windows\SysWOW64\notepad.exe base: 3230000 protect: page execute and read and write			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Memory allocated: C:\Windows\SysWOW64\notepad.exe base: 3240000 protect: page read and write			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Memory allocated: C:\Windows\SysWOW64\notepad.exe base: CB0000 protect: page execute and read and write			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Memory allocated: C:\Windows\SysWOW64\notepad.exe base: CC0000 protect: page read and write			Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\PI.exe	Section loaded: unknown target: C:\Users\user\Desktop\PI.exe protection: execute and read and write			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Section loaded: unknown target: C:\Users\user\Desktop\PI.exe protection: execute and read and write			Jump to behavior

Queues an APC in another process (thread injection)

Source: C:\Users\user\Desktop\PI.exe

Thread APC queued: target process: C:\Windows\SysWOW64\notepad.exe

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\PI.exe	Memory written: C:\Windows\SysWOW64\notepad.exe base: 3230000			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Memory written: C:\Windows\SysWOW64\notepad.exe base: 3240000			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Memory written: C:\Windows\SysWOW64\notepad.exe base: CB0000			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Memory written: C:\Windows\SysWOW64\notepad.exe base: CC0000			Jump to behavior

Creates a process in suspended mode (likely to inject code)

Source: C:\Users\user\Desktop\PI.exe	Process created: C:\Users\user\Desktop\PI.exe 'C:\Users\user\Desktop\PI.exe'			Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\Desktop\PI.exe 'C:\Users\user\Desktop\PI.exe'			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Process created: C:\Users\user\Desktop\PI.exe 'C:\Users\user\Desktop\PI.exe'			Jump to behavior

May try to detect the Windows Explorer process (often used for injection)

Source: PI.exe, 00000002.00000002.942302186.0000000000D70000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: PI.exe, 00000002.00000002.942302186.0000000000D70000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: PI.exe, 00000002.00000002.942302186.0000000000D70000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: PI.exe, 00000002.00000002.942302186.0000000000D70000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

Contains functionality to query locales information (e.g. system language)

Source: C:\Users\user\Desktop\PI.exe	Code function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpyn,GetThreadLocale,GetLocaleInfoA,lstrlen,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,		0_2_00405CA0
Source: C:\Users\user\Desktop\PI.exe	Code function: GetLocaleInfoA,GetACP,		0_2_0040AD2C
Source: C:\Users\user\Desktop\PI.exe	Code function: GetLocaleInfoA,		0_2_004099FC
Source: C:\Users\user\Desktop\PI.exe	Code function: GetLocaleInfoA,		0_2_004099B0
Source: C:\Users\user\Desktop\PI.exe	Code function: lstrcpyn,GetThreadLocale,GetLocaleInfoA,lstrlen,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,		0_2_00405DAC
Source: C:\Users\user\Desktop\PI.exe	Code function: GetLocaleInfoA,		2_2_0046CA4A
Source: C:\Users\user\Desktop\PI.exe	Code function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpyn,GetThreadLocale,GetLocaleInfoA,lstrlen,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,		3_2_00405CA0
Source: C:\Users\user\Desktop\PI.exe	Code function: GetLocaleInfoA,GetACP,		3_2_0040AD2C
Source: C:\Users\user\Desktop\PI.exe	Code function: GetLocaleInfoA,		3_2_004099FC
Source: C:\Users\user\Desktop\PI.exe	Code function: GetLocaleInfoA,		3_2_004099B0
Source: C:\Users\user\Desktop\PI.exe	Code function: lstrcpyn,GetThreadLocale,GetLocaleInfoA,lstrlen,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,		3_2_00405DAC
Source: C:\Users\user\Desktop\PI.exe	Code function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpyn,GetThreadLocale,GetLocaleInfoA,lstrlen,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,		5_2_00405CA0
Source: C:\Users\user\Desktop\PI.exe	Code function: GetLocaleInfoA,GetACP,		5_2_0040AD2C
Source: C:\Users\user\Desktop\PI.exe	Code function: GetLocaleInfoA,		5_2_004099FC
Source: C:\Users\user\Desktop\PI.exe	Code function: GetLocaleInfoA,		5_2_004099B0
Source: C:\Users\user\Desktop\PI.exe	Code function: lstrcpyn,GetThreadLocale,GetLocaleInfoA,lstrlen,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,		5_2_00405DAC
Source: C:\Users\user\Desktop\PI.exe	Code function: GetLocaleInfoA,		7_2_0046CA4A

Queries the volume information (name, serial number etc) of a device

Source: C:\Users\user\Desktop\PI.exe	Queries volume information: C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Queries volume information: C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation			Jump to behavior

Contains functionality to query local / system time

Source: C:\Users\user\Desktop\PI.exe

Code function: 0_2_00475588 GetSystemTime,ExitProcess,GetNextDlgTabItem,

0_2_00475588

Contains functionality to query the account / user name

Source: C:\Users\user\Desktop\PI.exe

Code function: 2_2_0233A502 GetUserNameW,

2_2_0233A502

Contains functionality to query windows version

Source: C:\Users\user\Desktop\PI.exe

Code function: 0_2_00440F64 GetVersion,

0_2_00440F64

Queries the cryptographic machine GUID

Source: C:\Users\user\Desktop\PI.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings:

AV process strings found (often used to terminate AV products)

Source: PI.exe, 00000000.00000002.680325895.000000000019D000.00000004.00000010.sdmp, PI.exe, 00000003.00000002.705494157.000000000019D000.00000004.00000010.sdmp, PI.exe, 00000005.00000002.707159490.000000000019D000.00000004.00000010.sdmp

Binary or memory string: avp.exe

Stealing of Sensitive Information:

Yara detected AgentTesla

Source: Yara match	File source: 00000002.00000002.941812642.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.941872630.0000000000475000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.942359260.0000000002180000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.942468067.0000000002252000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.708227438.00000000027D5000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.706572619.0000000000B42000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.681442399.00000000027E5000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.943139633.0000000002AC1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.705557320.0000000000475000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.681329227.0000000002772000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.706213393.0000000000790000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.707115774.0000000000BB2000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000001.705125363.0000000000499000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.943293284.0000000002B8A000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.942414784.00000000021E2000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.943432491.0000000002C69000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PI.exe PID: 6744, type: MEMORY
Source: Yara match	File source: Process Memory Space: PI.exe PID: 6728, type: MEMORY
Source: Yara match	File source: Process Memory Space: PI.exe PID: 6512, type: MEMORY
Source: Yara match	File source: Process Memory Space: PI.exe PID: 5152, type: MEMORY
Source: Yara match	File source: 2.2.PI.exe.2180000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.PI.exe.bb0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.PI.exe.2180000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.PI.exe.790000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.PI.exe.2250000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.PI.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.PI.exe.2760000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.1.PI.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PI.exe.2770000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.PI.exe.b40000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.PI.exe.790000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.PI.exe.21e0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.PI.exe.400000.0.unpack, type: UNPACKEDPE

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\PI.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\PI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini			Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\PI.exe	File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\			Jump to behavior

Tries to steal Mail credentials (via file access)

Source: C:\Users\user\Desktop\PI.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676			Jump to behavior
Source: C:\Users\user\Desktop\PI.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities			Jump to behavior

Yara detected Credential Stealer

Source: Yara match

File source: Process Memory Space: PI.exe PID: 5152, type: MEMORY

Remote Access Functionality:

Yara detected AgentTesla

Source: Yara match	File source: 00000002.00000002.941812642.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.941872630.0000000000475000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.942359260.0000000002180000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.942468067.0000000002252000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.708227438.00000000027D5000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.706572619.0000000000B42000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.681442399.00000000027E5000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.943139633.0000000002AC1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.705557320.0000000000475000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.681329227.0000000002772000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.706213393.0000000000790000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.707115774.0000000000BB2000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000001.705125363.0000000000499000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.943293284.0000000002B8A000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.942414784.00000000021E2000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.943432491.0000000002C69000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PI.exe PID: 6744, type: MEMORY
Source: Yara match	File source: Process Memory Space: PI.exe PID: 6728, type: MEMORY
Source: Yara match	File source: Process Memory Space: PI.exe PID: 6512, type: MEMORY
Source: Yara match	File source: Process Memory Space: PI.exe PID: 5152, type: MEMORY
Source: Yara match	File source: 2.2.PI.exe.2180000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.PI.exe.bb0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.PI.exe.2180000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.PI.exe.790000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.PI.exe.2250000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.PI.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.PI.exe.2760000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.1.PI.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PI.exe.2770000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.PI.exe.b40000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.PI.exe.790000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.PI.exe.21e0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.PI.exe.400000.0.unpack, type: UNPACKEDPE