Loading ...

Play interactive tourEdit tour

Analysis Report QRN-CLJC-06112020149.PDF.exe

Overview

General Information

Sample Name:QRN-CLJC-06112020149.PDF.exe
Analysis ID:321395
MD5:cdefe555b30aa451be1c4b519ccaa9a3
SHA1:dde5a61b58ce44a985ee7ca8d4a789140063616c
SHA256:67bff3c99f10c2b189df24202f66a3901d355847afee7de4f66c78aff794c923
Tags:AgentTeslaexe

Most interesting Screenshot:

Detection

AgentTesla
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Found malware configuration
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Scheduled temp file as task from temp location
Sigma detected: Suspicious Double Extension
Yara detected AgentTesla
Yara detected AntiVM_3
.NET source code contains very large array initializations
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
May check the online IP address of the machine
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file access)
Uses an obfuscated file name to hide its real file extension (double extension)
Uses schtasks.exe or at.exe to add and modify task schedules
Antivirus or Machine Learning detection for unpacked file
Contains capabilities to detect virtual machines
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Drops PE files
Enables debug privileges
Found inlined nop instructions (likely shell or obfuscated code)
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Tries to load missing DLLs
Uses SMTP (mail sending)
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer

Classification

Startup

  • System is w10x64
  • QRN-CLJC-06112020149.PDF.exe (PID: 6128 cmdline: 'C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe' MD5: CDEFE555B30AA451BE1C4B519CCAA9A3)
    • schtasks.exe (PID: 5500 cmdline: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\XwhZikir' /XML 'C:\Users\user\AppData\Local\Temp\tmpF5B4.tmp' MD5: 15FF7D8324231381BAD48A052F85DF04)
      • conhost.exe (PID: 4480 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
  • cleanup

Malware Configuration

Threatname: Agenttesla

{"Username: ": "AmBIZ", "URL: ": "http://z61os6wyor.com", "To: ": "", "ByHost: ": "mail.privateemail.com:587", "Password: ": "Tp7L2", "From: ": ""}

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000003.00000002.504281771.0000000000402000.00000040.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
    00000003.00000002.508154788.00000000030B1000.00000004.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
      00000003.00000002.508154788.00000000030B1000.00000004.00000001.sdmpJoeSecurity_CredentialStealerYara detected Credential StealerJoe Security
        00000000.00000002.248253061.00000000034D1000.00000004.00000001.sdmpJoeSecurity_AntiVM_3Yara detected AntiVM_3Joe Security
          00000000.00000002.248835494.00000000044D4000.00000004.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
            Click to see the 5 entries

            Unpacked PEs

            SourceRuleDescriptionAuthorStrings
            3.2.QRN-CLJC-06112020149.PDF.exe.400000.0.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security

              Sigma Overview

              System Summary:

              barindex
              Sigma detected: Scheduled temp file as task from temp locationShow sources
              Source: Process startedAuthor: Joe Security: Data: Command: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\XwhZikir' /XML 'C:\Users\user\AppData\Local\Temp\tmpF5B4.tmp', CommandLine: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\XwhZikir' /XML 'C:\Users\user\AppData\Local\Temp\tmpF5B4.tmp', CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: 'C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe' , ParentImage: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe, ParentProcessId: 6128, ProcessCommandLine: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\XwhZikir' /XML 'C:\Users\user\AppData\Local\Temp\tmpF5B4.tmp', ProcessId: 5500
              Sigma detected: Suspicious Double ExtensionShow sources
              Source: Process startedAuthor: Florian Roth (rule), @blu3_team (idea): Data: Command: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe, CommandLine: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe, CommandLine|base64offset|contains: , Image: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe, NewProcessName: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe, OriginalFileName: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe, ParentCommandLine: 'C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe' , ParentImage: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe, ParentProcessId: 6128, ProcessCommandLine: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe, ProcessId: 4664

              Signature Overview

              Click to jump to signature section

              Show All Signature Results

              AV Detection:

              barindex
              Found malware configurationShow sources
              Source: QRN-CLJC-06112020149.PDF.exe.4664.3.memstrMalware Configuration Extractor: Agenttesla {"Username: ": "AmBIZ", "URL: ": "http://z61os6wyor.com", "To: ": "", "ByHost: ": "mail.privateemail.com:587", "Password: ": "Tp7L2", "From: ": ""}
              Multi AV Scanner detection for dropped fileShow sources
              Source: C:\Users\user\AppData\Roaming\XwhZikir.exeReversingLabs: Detection: 33%
              Multi AV Scanner detection for submitted fileShow sources
              Source: QRN-CLJC-06112020149.PDF.exeVirustotal: Detection: 52%Perma Link
              Source: QRN-CLJC-06112020149.PDF.exeReversingLabs: Detection: 33%
              Machine Learning detection for dropped fileShow sources
              Source: C:\Users\user\AppData\Roaming\XwhZikir.exeJoe Sandbox ML: detected
              Machine Learning detection for sampleShow sources
              Source: QRN-CLJC-06112020149.PDF.exeJoe Sandbox ML: detected
              Source: 3.2.QRN-CLJC-06112020149.PDF.exe.400000.0.unpackAvira: Label: TR/Spy.Gen8
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeCode function: 4x nop then jmp 05C390A6h0_2_05C38FEB
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeCode function: 4x nop then mov dword ptr [ebp-1Ch], 00000000h0_2_05C39857
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeCode function: 4x nop then mov dword ptr [ebp-1Ch], 00000000h0_2_05C39868

              Networking:

              barindex
              May check the online IP address of the machineShow sources
              Source: unknownDNS query: name: api.ipify.org
              Source: unknownDNS query: name: api.ipify.org
              Source: unknownDNS query: name: api.ipify.org
              Source: global trafficTCP traffic: 192.168.2.7:49748 -> 198.54.122.60:587
              Source: Joe Sandbox ViewIP Address: 54.243.161.145 54.243.161.145
              Source: Joe Sandbox ViewIP Address: 54.243.161.145 54.243.161.145
              Source: Joe Sandbox ViewIP Address: 198.54.122.60 198.54.122.60
              Source: Joe Sandbox ViewJA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
              Source: global trafficTCP traffic: 192.168.2.7:49748 -> 198.54.122.60:587
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeCode function: 3_2_0269A09A recv,3_2_0269A09A
              Source: unknownDNS traffic detected: queries for: g.msn.com
              Source: QRN-CLJC-06112020149.PDF.exe, 00000003.00000002.508154788.00000000030B1000.00000004.00000001.sdmpString found in binary or memory: http://127.0.0.1:HTTP/1.1
              Source: QRN-CLJC-06112020149.PDF.exe, 00000003.00000002.508154788.00000000030B1000.00000004.00000001.sdmpString found in binary or memory: http://DynDns.comDynDNS
              Source: QRN-CLJC-06112020149.PDF.exe, 00000003.00000002.509398240.00000000031E6000.00000004.00000001.sdmpString found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
              Source: QRN-CLJC-06112020149.PDF.exe, 00000003.00000002.512477564.0000000005F30000.00000004.00000001.sdmpString found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
              Source: QRN-CLJC-06112020149.PDF.exe, 00000003.00000002.512477564.0000000005F30000.00000004.00000001.sdmpString found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
              Source: QRN-CLJC-06112020149.PDF.exe, 00000003.00000002.508154788.00000000030B1000.00000004.00000001.sdmpString found in binary or memory: http://crl.comodoca.com/COMODORSADomainValidationSecureServerCA.crl0
              Source: QRN-CLJC-06112020149.PDF.exe, 00000003.00000002.512543715.0000000005F63000.00000004.00000001.sdmpString found in binary or memory: http://crt.sectigo.com/SectigoRSADomainValidationS
              Source: QRN-CLJC-06112020149.PDF.exe, 00000003.00000002.509729422.0000000003211000.00000004.00000001.sdmpString found in binary or memory: http://crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt0#
              Source: QRN-CLJC-06112020149.PDF.exe, 00000003.00000002.508154788.00000000030B1000.00000004.00000001.sdmpString found in binary or memory: http://gWhdeq.com
              Source: QRN-CLJC-06112020149.PDF.exe, 00000003.00000002.512543715.0000000005F63000.00000004.00000001.sdmpString found in binary or memory: http://ocsp.com1
              Source: QRN-CLJC-06112020149.PDF.exe, 00000003.00000002.508154788.00000000030B1000.00000004.00000001.sdmp, QRN-CLJC-06112020149.PDF.exe, 00000003.00000002.509398240.00000000031E6000.00000004.00000001.sdmpString found in binary or memory: http://ocsp.comodoca.com0
              Source: QRN-CLJC-06112020149.PDF.exe, 00000003.00000002.509729422.0000000003211000.00000004.00000001.sdmpString found in binary or memory: http://ocsp.sectigo.com0
              Source: QRN-CLJC-06112020149.PDF.exe, 00000003.00000002.509398240.00000000031E6000.00000004.00000001.sdmp, QRN-CLJC-06112020149.PDF.exe, 00000003.00000002.509511016.00000000031F4000.00000004.00000001.sdmpString found in binary or memory: http://z61os6wyor.com
              Source: QRN-CLJC-06112020149.PDF.exe, 00000003.00000002.508154788.00000000030B1000.00000004.00000001.sdmpString found in binary or memory: https://api.ipify.org
              Source: QRN-CLJC-06112020149.PDF.exe, 00000003.00000002.508154788.00000000030B1000.00000004.00000001.sdmpString found in binary or memory: https://api.ipify.org/
              Source: QRN-CLJC-06112020149.PDF.exe, 00000003.00000002.508154788.00000000030B1000.00000004.00000001.sdmpString found in binary or memory: https://api.ipify.org/(
              Source: QRN-CLJC-06112020149.PDF.exe, 00000003.00000002.508154788.00000000030B1000.00000004.00000001.sdmpString found in binary or memory: https://api.ipify.orgGETMozilla/5.0
              Source: QRN-CLJC-06112020149.PDF.exe, 00000000.00000002.248835494.00000000044D4000.00000004.00000001.sdmp, QRN-CLJC-06112020149.PDF.exe, 00000003.00000002.504281771.0000000000402000.00000040.00000001.sdmpString found in binary or memory: https://api.telegram.org/bot%telegramapi%/
              Source: QRN-CLJC-06112020149.PDF.exe, 00000003.00000002.508154788.00000000030B1000.00000004.00000001.sdmpString found in binary or memory: https://api.telegram.org/bot%telegramapi%/sendDocumentdocument---------------------------x
              Source: QRN-CLJC-06112020149.PDF.exe, 00000003.00000002.509729422.0000000003211000.00000004.00000001.sdmpString found in binary or memory: https://sectigo.com/CPS0
              Source: QRN-CLJC-06112020149.PDF.exe, 00000003.00000002.508154788.00000000030B1000.00000004.00000001.sdmpString found in binary or memory: https://secure.comodo.com/CPS0
              Source: QRN-CLJC-06112020149.PDF.exe, 00000000.00000002.248835494.00000000044D4000.00000004.00000001.sdmp, QRN-CLJC-06112020149.PDF.exe, 00000003.00000002.504281771.0000000000402000.00000040.00000001.sdmpString found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
              Source: QRN-CLJC-06112020149.PDF.exe, 00000003.00000002.508154788.00000000030B1000.00000004.00000001.sdmpString found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha
              Source: unknownNetwork traffic detected: HTTP traffic on port 49747 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49747

              System Summary:

              barindex
              .NET source code contains very large array initializationsShow sources
              Source: 3.2.QRN-CLJC-06112020149.PDF.exe.400000.0.unpack, u003cPrivateImplementationDetailsu003eu007b161D827Cu002dEE49u002d4B0Eu002d833Fu002dF512BCC8F74Cu007d/u00334888689u002d8818u002d434Eu002dB30Fu002dF3A6EF143ED7.csLarge array initialization: .cctor: array initializer size 11992
              Initial sample is a PE file and has a suspicious nameShow sources
              Source: initial sampleStatic PE information: Filename: QRN-CLJC-06112020149.PDF.exe
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeCode function: 0_2_05BB11CE NtQuerySystemInformation,0_2_05BB11CE
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeCode function: 0_2_05BB119D NtQuerySystemInformation,0_2_05BB119D
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeCode function: 3_2_0269B0BA NtQuerySystemInformation,3_2_0269B0BA
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeCode function: 3_2_0269B089 NtQuerySystemInformation,3_2_0269B089
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeCode function: 0_2_00D46CC10_2_00D46CC1
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeCode function: 0_2_030D0A3F0_2_030D0A3F
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeCode function: 0_2_030D0AC80_2_030D0AC8
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeCode function: 0_2_030D21980_2_030D2198
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeCode function: 0_2_030D26E40_2_030D26E4
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeCode function: 0_2_030D1C090_2_030D1C09
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeCode function: 0_2_030D1CF00_2_030D1CF0
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeCode function: 0_2_030D73000_2_030D7300
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeCode function: 0_2_030D21310_2_030D2131
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeCode function: 0_2_030D21890_2_030D2189
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeCode function: 0_2_030D94570_2_030D9457
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeCode function: 0_2_030DA77E0_2_030DA77E
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeCode function: 0_2_030D37700_2_030D3770
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeCode function: 0_2_030D37D80_2_030D37D8
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeCode function: 0_2_030D37E80_2_030D37E8
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeCode function: 0_2_030DE6B00_2_030DE6B0
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeCode function: 0_2_030D94570_2_030D9457
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeCode function: 0_2_030D1CE00_2_030D1CE0
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeCode function: 0_2_05C351500_2_05C35150
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeCode function: 0_2_05C351600_2_05C35160
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeCode function: 0_2_05C300470_2_05C30047
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeCode function: 0_2_05C300700_2_05C30070
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeCode function: 0_2_05C307E70_2_05C307E7
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeCode function: 0_2_05C300700_2_05C30070
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeCode function: 0_2_00D420500_2_00D42050
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeCode function: 3_2_00696CC13_2_00696CC1
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeCode function: 3_2_02BD71A03_2_02BD71A0
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeCode function: 3_2_02BDC9383_2_02BDC938
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeCode function: 3_2_063A70783_2_063A7078
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeCode function: 3_2_063AA0B83_2_063AA0B8
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeCode function: 3_2_063A58AC3_2_063A58AC
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeCode function: 3_2_063A28F83_2_063A28F8
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeCode function: 3_2_063A74C83_2_063A74C8
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeCode function: 3_2_063AEB303_2_063AEB30
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeCode function: 3_2_063AE5603_2_063AE560
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeCode function: 3_2_063A3B403_2_063A3B40
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeCode function: 3_2_063A9ED83_2_063A9ED8
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeCode function: 3_2_063D53303_2_063D5330
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeCode function: 3_2_063D65FB3_2_063D65FB
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeCode function: 3_2_006920503_2_00692050
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeCode function: 3_2_063D14E03_2_063D14E0
              Source: QRN-CLJC-06112020149.PDF.exeBinary or memory string: OriginalFilename vs QRN-CLJC-06112020149.PDF.exe
              Source: QRN-CLJC-06112020149.PDF.exe, 00000000.00000002.249206382.000000000469B000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameKedermister.dllT vs QRN-CLJC-06112020149.PDF.exe
              Source: QRN-CLJC-06112020149.PDF.exe, 00000000.00000002.252133026.0000000006250000.00000002.00000001.sdmpBinary or memory string: System.OriginalFileName vs QRN-CLJC-06112020149.PDF.exe
              Source: QRN-CLJC-06112020149.PDF.exe, 00000000.00000002.249620145.0000000005670000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamemscorrc.dllT vs QRN-CLJC-06112020149.PDF.exe
              Source: QRN-CLJC-06112020149.PDF.exe, 00000000.00000002.252265585.0000000006350000.00000002.00000001.sdmpBinary or memory string: originalfilename vs QRN-CLJC-06112020149.PDF.exe
              Source: QRN-CLJC-06112020149.PDF.exe, 00000000.00000002.252265585.0000000006350000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamepropsys.dll.mui@ vs QRN-CLJC-06112020149.PDF.exe
              Source: QRN-CLJC-06112020149.PDF.exe, 00000000.00000002.248253061.00000000034D1000.00000004.00000001.sdmpBinary or memory string: OriginalFilenamegGBfrdvzjTnMYYsrYcgGjNdaKrLUoCIJrGyRgJ.exe4 vs QRN-CLJC-06112020149.PDF.exe
              Source: QRN-CLJC-06112020149.PDF.exeBinary or memory string: OriginalFilename vs QRN-CLJC-06112020149.PDF.exe
              Source: QRN-CLJC-06112020149.PDF.exe, 00000003.00000002.512915861.00000000063F0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamemscorrc.dllT vs QRN-CLJC-06112020149.PDF.exe
              Source: QRN-CLJC-06112020149.PDF.exe, 00000003.00000002.511565740.00000000052A0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameKernelbase.dll.muij% vs QRN-CLJC-06112020149.PDF.exe
              Source: QRN-CLJC-06112020149.PDF.exe, 00000003.00000002.504281771.0000000000402000.00000040.00000001.sdmpBinary or memory string: OriginalFilenamegGBfrdvzjTnMYYsrYcgGjNdaKrLUoCIJrGyRgJ.exe4 vs QRN-CLJC-06112020149.PDF.exe
              Source: QRN-CLJC-06112020149.PDF.exe, 00000003.00000002.512807164.00000000063C0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamewshom.ocx.mui vs QRN-CLJC-06112020149.PDF.exe
              Source: QRN-CLJC-06112020149.PDF.exe, 00000003.00000002.512770176.00000000063B0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameCRYPT32.DLL.MUIj% vs QRN-CLJC-06112020149.PDF.exe
              Source: QRN-CLJC-06112020149.PDF.exeBinary or memory string: OriginalFilenameb3Bd.exeN vs QRN-CLJC-06112020149.PDF.exe
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeSection loaded: windows.staterepositoryps.dllJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeSection loaded: security.dllJump to behavior
              Source: QRN-CLJC-06112020149.PDF.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
              Source: XwhZikir.exe.0.drStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
              Source: 3.2.QRN-CLJC-06112020149.PDF.exe.400000.0.unpack, A/b2.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
              Source: 3.2.QRN-CLJC-06112020149.PDF.exe.400000.0.unpack, A/b2.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
              Source: classification engineClassification label: mal100.troj.spyw.evad.winEXE@6/5@3/2
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeCode function: 0_2_05BB1052 AdjustTokenPrivileges,0_2_05BB1052
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeCode function: 0_2_05BB101B AdjustTokenPrivileges,0_2_05BB101B
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeCode function: 3_2_0269AF3E AdjustTokenPrivileges,3_2_0269AF3E
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeCode function: 3_2_0269AF07 AdjustTokenPrivileges,3_2_0269AF07
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeFile created: C:\Users\user\AppData\Roaming\XwhZikir.exeJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeMutant created: \Sessions\1\BaseNamedObjects\ZcufQIP
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeMutant created: \Sessions\1\BaseNamedObjects\Global\.net clr networking
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4480:120:WilError_01
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeFile created: C:\Users\user\AppData\Local\Temp\tmpF5B4.tmpJump to behavior
              Source: QRN-CLJC-06112020149.PDF.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeSection loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dllJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeSection loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlpJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeSection loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlpJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeSection loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dllJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeSection loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlpJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeSection loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlpJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: QRN-CLJC-06112020149.PDF.exeVirustotal: Detection: 52%
              Source: QRN-CLJC-06112020149.PDF.exeReversingLabs: Detection: 33%
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeFile read: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeJump to behavior
              Source: unknownProcess created: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe 'C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe'
              Source: unknownProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\XwhZikir' /XML 'C:\Users\user\AppData\Local\Temp\tmpF5B4.tmp'
              Source: unknownProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: unknownProcess created: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\XwhZikir' /XML 'C:\Users\user\AppData\Local\Temp\tmpF5B4.tmp'Jump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeProcess created: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32Jump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeFile opened: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dllJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676Jump to behavior
              Source: QRN-CLJC-06112020149.PDF.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeFile opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_d08c58b4442ba54f\MSVCR80.dllJump to behavior
              Source: QRN-CLJC-06112020149.PDF.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
              Source: Binary string: mscorrc.pdb source: QRN-CLJC-06112020149.PDF.exe, 00000000.00000002.249620145.0000000005670000.00000002.00000001.sdmp, QRN-CLJC-06112020149.PDF.exe, 00000003.00000002.512915861.00000000063F0000.00000002.00000001.sdmp
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeCode function: 0_2_01706E79 push ebx; retf 0_2_01706E7A
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeCode function: 0_2_01706E7C push ebx; retf 0_2_01706E7E
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeCode function: 0_2_01709ADC push ebx; retf 0_2_01709B06
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeCode function: 0_2_01708EA1 push ebx; retf 0_2_01708EA2
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeCode function: 0_2_01708EA4 push ebx; retf 0_2_01708EA6
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeCode function: 0_2_01709A9D push ebx; retf 0_2_01709B06
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeCode function: 0_2_05C3453B push ss; ret 0_2_05C3454A
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeCode function: 0_2_05C348A7 push ss; ret 0_2_05C348AE
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeCode function: 0_2_05C33B59 push edx; retf 0_2_05C33B5A
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeCode function: 0_2_05C34687 push cs; ret 0_2_05C3468E
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeCode function: 0_2_05C3468F push 0000001Ah; ret 0_2_05C346A6
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeCode function: 0_2_05C34657 push 0000001Ah; ret 0_2_05C346A6
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeCode function: 0_2_05C34A23 push ds; ret 0_2_05C34A3A
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeCode function: 3_2_02BDD0A1 push ss; retf 3_2_02BDD0A3
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeCode function: 3_2_063A229F push ecx; ret 3_2_063A22B4
              Source: initial sampleStatic PE information: section name: .text entropy: 7.83443319066
              Source: initial sampleStatic PE information: section name: .text entropy: 7.83443319066
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeFile created: C:\Users\user\AppData\Roaming\XwhZikir.exeJump to dropped file

              Boot Survival:

              barindex
              Uses schtasks.exe or at.exe to add and modify task schedulesShow sources
              Source: unknownProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\XwhZikir' /XML 'C:\Users\user\AppData\Local\Temp\tmpF5B4.tmp'

              Hooking and other Techniques for Hiding and Protection:

              barindex
              Uses an obfuscated file name to hide its real file extension (double extension)Show sources
              Source: Possible double extension: pdf.exeStatic PE information: QRN-CLJC-06112020149.PDF.exe
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeRegistry key monitored for changes: HKEY_CURRENT_USER_ClassesJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

              Malware Analysis System Evasion:

              barindex
              Yara detected AntiVM_3Show sources
              Source: Yara matchFile source: 00000000.00000002.248253061.00000000034D1000.00000004.00000001.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000000.00000002.248377338.0000000003525000.00000004.00000001.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: QRN-CLJC-06112020149.PDF.exe PID: 6128, type: MEMORY
              Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)Show sources
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
              Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)Show sources
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
              Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)Show sources
              Source: QRN-CLJC-06112020149.PDF.exe, 00000000.00000002.248253061.00000000034D1000.00000004.00000001.sdmpBinary or memory string: SBIEDLL.DLL
              Source: QRN-CLJC-06112020149.PDF.exe, 00000000.00000002.248253061.00000000034D1000.00000004.00000001.sdmpBinary or memory string: KERNEL32.DLL.WINE_GET_UNIX_FILE_NAME
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeFile opened / queried: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}Jump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 1528Thread sleep time: -54725s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 1528Thread sleep time: -30000s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 724Thread sleep time: -922337203685477s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532Thread sleep time: -922337203685477s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532Thread sleep time: -30000s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532Thread sleep time: -59406s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532Thread sleep time: -58906s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532Thread sleep time: -88080s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532Thread sleep time: -87750s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532Thread sleep time: -86109s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532Thread sleep time: -57000s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532Thread sleep time: -113000s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532Thread sleep time: -110812s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532Thread sleep time: -55000s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532Thread sleep time: -53500s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532Thread sleep time: -106440s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532Thread sleep time: -106000s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532Thread sleep time: -52406s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532Thread sleep time: -77250s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532Thread sleep time: -75609s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532Thread sleep time: -69609s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532Thread sleep time: -46000s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532Thread sleep time: -44906s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532Thread sleep time: -66750s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532Thread sleep time: -66000s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532Thread sleep time: -65109s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532Thread sleep time: -64359s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532Thread sleep time: -41406s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532Thread sleep time: -61500s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532Thread sleep time: -59859s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532Thread sleep time: -39000s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532Thread sleep time: -56859s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532Thread sleep time: -55500s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532Thread sleep time: -53859s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532Thread sleep time: -35500s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532Thread sleep time: -50859s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532Thread sleep time: -33220s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532Thread sleep time: -31626s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532Thread sleep time: -31220s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532Thread sleep time: -30720s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532Thread sleep time: -30126s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532Thread sleep time: -39939s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532Thread sleep time: -39609s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532Thread sleep time: -39189s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532Thread sleep time: -36609s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532Thread sleep time: -36330s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532Thread sleep time: -34689s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532Thread sleep time: -34359s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532Thread sleep time: -33330s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532Thread sleep time: -59814s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532Thread sleep time: -59626s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532Thread sleep time: -59126s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532Thread sleep time: -57814s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532Thread sleep time: -86439s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532Thread sleep time: -85080s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532Thread sleep time: -56314s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532Thread sleep time: -83439s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532Thread sleep time: -55220s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532Thread sleep time: -54314s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532Thread sleep time: -81189s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532Thread sleep time: -52626s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532Thread sleep time: -78189s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532Thread sleep time: -51720s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532Thread sleep time: -76500s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532Thread sleep time: -50626s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532Thread sleep time: -75189s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532Thread sleep time: -49906s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532Thread sleep time: -74250s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532Thread sleep time: -49220s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532Thread sleep time: -49000s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532Thread sleep time: -48814s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532Thread sleep time: -48626s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532Thread sleep time: -72609s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532Thread sleep time: -48126s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532Thread sleep time: -47126s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532Thread sleep time: -46906s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532Thread sleep time: -46126s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532Thread sleep time: -45814s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532Thread sleep time: -45626s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532Thread sleep time: -42626s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532Thread sleep time: -42314s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532Thread sleep time: -42126s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532Thread sleep time: -41220s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532Thread sleep time: -40126s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532Thread sleep time: -39220s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532Thread sleep time: -38814s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532Thread sleep time: -57189s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532Thread sleep time: -37720s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532Thread sleep time: -35720s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532Thread sleep time: -35000s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532Thread sleep time: -34220s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532Thread sleep time: -50580s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532Thread sleep time: -33126s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532Thread sleep time: -32906s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532Thread sleep time: -31000s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532Thread sleep time: -59314s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532Thread sleep time: -58220s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532Thread sleep time: -57126s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532Thread sleep time: -56906s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532Thread sleep time: -54500s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532Thread sleep time: -53626s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532Thread sleep time: -53406s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532Thread sleep time: -52314s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532Thread sleep time: -51220s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532Thread sleep time: -47720s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532Thread sleep time: -45314s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532Thread sleep time: -45126s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532Thread sleep time: -44220s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532Thread sleep time: -43126s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532Thread sleep time: -41814s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532Thread sleep time: -39626s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532Thread sleep time: -36126s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532Thread sleep time: -34814s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532Thread sleep time: -33500s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532Thread sleep time: -31906s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532Thread sleep time: -31720s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532Thread sleep time: -31500s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532Thread sleep time: -30814s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532Thread sleep time: -30626s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe TID: 4532Thread sleep time: -30406s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeLast function: Thread delayed
              Source: QRN-CLJC-06112020149.PDF.exe, 00000000.00000002.248253061.00000000034D1000.00000004.00000001.sdmpBinary or memory string: InstallPathJC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
              Source: QRN-CLJC-06112020149.PDF.exe, 00000003.00000002.511565740.00000000052A0000.00000002.00000001.sdmpBinary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
              Source: QRN-CLJC-06112020149.PDF.exe, 00000000.00000002.248253061.00000000034D1000.00000004.00000001.sdmpBinary or memory string: vmware
              Source: QRN-CLJC-06112020149.PDF.exe, 00000000.00000002.248253061.00000000034D1000.00000004.00000001.sdmpBinary or memory string: VMware SVGA II|update users set password = @password where user_id = @user_id
              Source: QRN-CLJC-06112020149.PDF.exe, 00000003.00000002.511565740.00000000052A0000.00000002.00000001.sdmpBinary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
              Source: QRN-CLJC-06112020149.PDF.exe, 00000003.00000002.511565740.00000000052A0000.00000002.00000001.sdmpBinary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
              Source: QRN-CLJC-06112020149.PDF.exe, 00000000.00000002.248253061.00000000034D1000.00000004.00000001.sdmpBinary or memory string: VMWAREDSOFTWARE\VMware, Inc.\VMware Tools
              Source: QRN-CLJC-06112020149.PDF.exe, 00000003.00000002.511565740.00000000052A0000.00000002.00000001.sdmpBinary or memory string: An unknown internal message was received by the Hyper-V Compute Service.
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeProcess information queried: ProcessInformationJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeCode function: 3_2_02BD33C8 LdrInitializeThunk,3_2_02BD33C8
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeProcess token adjusted: DebugJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeProcess token adjusted: DebugJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeMemory allocated: page read and write | page guardJump to behavior

              HIPS / PFW / Operating System Protection Evasion:

              barindex
              Injects a PE file into a foreign processesShow sources
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeMemory written: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe base: 400000 value starts with: 4D5AJump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\XwhZikir' /XML 'C:\Users\user\AppData\Local\Temp\tmpF5B4.tmp'Jump to behavior
              Source: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exeProcess created: C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe C:\Users\user\Desktop\QRN-CLJC-06112020149.PDF.exe