Analysis Report file

ID:	339189
Product:	CloudBasic
Start time:	17:03:41
Start date:	13.01.2021
Sample:	file
Cookbook:	default.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS
MD5:	4be8c93e9f60d0c2503dc3c6869975c4
SHA1:	3554a4a68003edeef2e4385ec70d7d477fed77c0
SHA256:	f188b5182bfe25b85b5748ae7932ff857fbeebe45c9b67718d708fa843d3b7b6
Filetype:	Win32 Executable (generic) a (10002005/4) 99.15%

Name	Type	MD5	SHA1	SHA256

Compliance:

Uses 32bit PE files

Source: file.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Creates a DirectInput object (often for capturing keystrokes)

Source: file.exe, 00000000.00000002.1276886652.000000000077A000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

System Summary:

Abnormal high CPU Usage

Source: C:\Users\user\Desktop\file.exe

Process Stats: CPU usage > 98%

Contains functionality to call native functions

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00737B9C NtProtectVirtualMemory,

0_2_00737B9C

Detected potential crypto function

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00733876		0_2_00733876
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00737C7A		0_2_00737C7A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00735463		0_2_00735463
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00731857		0_2_00731857
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00732C54		0_2_00732C54
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0073685F		0_2_0073685F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00736C43		0_2_00736C43
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00733442		0_2_00733442
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00736046		0_2_00736046
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00737045		0_2_00737045
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0073243A		0_2_0073243A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00733822		0_2_00733822
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0073542F		0_2_0073542F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0073801A		0_2_0073801A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0073201E		0_2_0073201E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00730804		0_2_00730804
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00735CF7		0_2_00735CF7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007354FD		0_2_007354FD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007374E7		0_2_007374E7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007300EB		0_2_007300EB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00737CD3		0_2_00737CD3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007328D0		0_2_007328D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007330C2		0_2_007330C2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007358C6		0_2_007358C6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007380C5		0_2_007380C5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007354CC		0_2_007354CC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00732CA7		0_2_00732CA7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007334A6		0_2_007334A6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007364AF		0_2_007364AF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00736892		0_2_00736892
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00735494		0_2_00735494
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0073808A		0_2_0073808A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00732173		0_2_00732173
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00737D77		0_2_00737D77
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0073256C		0_2_0073256C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00735D5F		0_2_00735D5F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00735941		0_2_00735941
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0073754B		0_2_0073754B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00737D48		0_2_00737D48
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00737133		0_2_00737133
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00735D30		0_2_00735D30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0073292E		0_2_0073292E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00737D10		0_2_00737D10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0073211B		0_2_0073211B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00735908		0_2_00735908
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0073650D		0_2_0073650D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007301F5		0_2_007301F5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007351F4		0_2_007351F4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00731DF8		0_2_00731DF8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007355FC		0_2_007355FC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00737DDC		0_2_00737DDC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007301C4		0_2_007301C4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007359CE		0_2_007359CE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007355CC		0_2_007355CC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007339AB		0_2_007339AB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00737DAB		0_2_00737DAB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007321A8		0_2_007321A8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007371AE		0_2_007371AE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00738194		0_2_00738194
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00736D8A		0_2_00736D8A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00732274		0_2_00732274
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00735678		0_2_00735678
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00735E7F		0_2_00735E7F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00737260		0_2_00737260
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00737664		0_2_00737664
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00732E4E		0_2_00732E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00735A4D		0_2_00735A4D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00735638		0_2_00735638
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00737E3E		0_2_00737E3E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00737E10		0_2_00737E10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00732E07		0_2_00732E07
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00737206		0_2_00737206
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00735A0B		0_2_00735A0B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007352F1		0_2_007352F1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00735AE2		0_2_00735AE2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00737EE7		0_2_00737EE7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007372D6		0_2_007372D6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00732EC0		0_2_00732EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00736ECD		0_2_00736ECD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00735AB0		0_2_00735AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007376B7		0_2_007376B7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00736EA3		0_2_00736EA3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00733EA8		0_2_00733EA8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007356A8		0_2_007356A8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007366A8		0_2_007366A8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00733293		0_2_00733293
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00732698		0_2_00732698
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00732A98		0_2_00732A98
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00731A9C		0_2_00731A9C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0073737A		0_2_0073737A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00735779		0_2_00735779
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00731F61		0_2_00731F61
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00733368		0_2_00733368
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00732352		0_2_00732352
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00737F5C		0_2_00737F5C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00735B43		0_2_00735B43
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00736744		0_2_00736744
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00731F35		0_2_00731F35
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00735F3C		0_2_00735F3C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00737321		0_2_00737321
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00737F27		0_2_00737F27
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00732F1B		0_2_00732F1B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0073371A		0_2_0073371A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00736F03		0_2_00736F03
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00733302		0_2_00733302
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007317F2		0_2_007317F2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00735BF1		0_2_00735BF1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007353FC		0_2_007353FC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007363EA		0_2_007363EA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007367ED		0_2_007367ED
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00737FD0		0_2_00737FD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007333D8		0_2_007333D8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00731BDE		0_2_00731BDE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007313DC		0_2_007313DC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007337C7		0_2_007337C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00736BC6		0_2_00736BC6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007373CA		0_2_007373CA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00735BB0		0_2_00735BB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00737F9A		0_2_00737F9A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00731B84		0_2_00731B84

PE file contains strange resources

Source: file.exe

Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Sample file is different than original file name gathered from version info

Source: file.exe, 00000000.00000002.1276125706.0000000000414000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameDenotationen5.exe vs file.exe
Source: file.exe, 00000000.00000002.1276790560.00000000005E0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameuser32j% vs file.exe
Source: file.exe	Binary or memory string: OriginalFilenameDenotationen5.exe vs file.exe

Uses 32bit PE files

Source: file.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Classification label

Source: classification engine

Classification label: mal68.troj.evad.winEXE@1/0@0/0

Creates temporary files

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\~DF5C53FDF4DEAA7056.TMP

Jump to behavior

PE file has an executable .text section and no other executable section

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Parts of this applications are using VB runtime library 6.0 (Probably coded in Visual Basic)

Source: C:\Users\user\Desktop\file.exe

Section loaded: C:\Windows\SysWOW64\msvbvm60.dll

Jump to behavior

Reads software policies

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Data Obfuscation:

Yara detected GuLoader

Source: Yara match

File source: Process Memory Space: file.exe PID: 6492, type: MEMORY

Yara detected VB6 Downloader Generic

Source: Yara match

File source: Process Memory Space: file.exe PID: 6492, type: MEMORY

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040C41E pushfd ; retf		0_2_0040C425
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00409D74 push ebp; retf		0_2_00409D75
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004075AA push 00000000h; ret		0_2_004075AC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00408AD8 pushfd ; retf		0_2_00408AD9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00733C73 pushf ; iretd		0_2_00733C75
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00733C37 pushfd ; iretd		0_2_00733C75
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00730036 push eax; retf		0_2_0073003E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00733CE5 push 85335BCEh; ret		0_2_00733CEA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007319A1 push F7665BCEh; ret		0_2_007319A6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00730A65 push 85C039CEh; retf		0_2_00730A6A

Hooking and other Techniques for Hiding and Protection:

Disables application error messsages (SetErrorMode)

Source: C:\Users\user\Desktop\file.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion:

Contains functionality to detect hardware virtualization (CPUID execution measurement)

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00732865		0_2_00732865
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0073284A		0_2_0073284A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0073280D		0_2_0073280D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007358C6		0_2_007358C6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007358C4		0_2_007358C4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00735941		0_2_00735941
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00735908		0_2_00735908
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007359CE		0_2_007359CE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00735A4D		0_2_00735A4D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00735A0B		0_2_00735A0B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007352F1		0_2_007352F1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00735AE2		0_2_00735AE2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00735AB0		0_2_00735AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00735B7F		0_2_00735B7F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00735B43		0_2_00735B43
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0073534F		0_2_0073534F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00731F1A		0_2_00731F1A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00735B0B		0_2_00735B0B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007353E5		0_2_007353E5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007327D3		0_2_007327D3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00735BB0		0_2_00735BB0

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: file.exe

Binary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe

RDTSC instruction interceptor: First address: 0000000000736986 second address: 0000000000736986 instructions: 0x00000000 rdtsc 0x00000002 xor eax, eax 0x00000004 inc eax 0x00000005 cpuid 0x00000007 popad 0x00000008 call 00007F42B49A9418h 0x0000000d lfence 0x00000010 mov edx, dword ptr [7FFE0014h] 0x00000016 lfence 0x00000019 ret 0x0000001a sub edx, esi 0x0000001c ret 0x0000001d test al, bl 0x0000001f cmp bh, ch 0x00000021 test ebx, edx 0x00000023 add edi, edx 0x00000025 test cl, dl 0x00000027 dec dword ptr [ebp+000000F8h] 0x0000002d cmp dword ptr [ebp+000000F8h], 00000000h 0x00000034 jne 00007F42B49A93A9h 0x00000036 push ss 0x00000037 pop ss 0x00000038 jmp 00007F42B49A942Bh 0x0000003a jmp 00007F42B49A943Ah 0x0000003c test ch, bh 0x0000003e cmp ecx, ecx 0x00000040 call 00007F42B49A946Bh 0x00000045 call 00007F42B49A9428h 0x0000004a lfence 0x0000004d mov edx, dword ptr [7FFE0014h] 0x00000053 lfence 0x00000056 ret 0x00000057 mov esi, edx 0x00000059 pushad 0x0000005a rdtsc

Contains functionality for execution timing, often used to detect debuggers

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00737C70 rdtsc

0_2_00737C70

Program does not show much activity (idle)

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)

Source: file.exe

Binary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exe

Anti Debugging:

Found potential dummy code loops (likely to delay analysis)

Source: C:\Users\user\Desktop\file.exe

Process Stats: CPU usage > 90% for more than 60s

Contains functionality for execution timing, often used to detect debuggers

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00737C70 rdtsc

0_2_00737C70

Contains functionality to read the PEB

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00736074 mov eax, dword ptr fs:[00000030h]		0_2_00736074
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00732865 mov eax, dword ptr fs:[00000030h]		0_2_00732865
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0073284A mov eax, dword ptr fs:[00000030h]		0_2_0073284A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0073280D mov eax, dword ptr fs:[00000030h]		0_2_0073280D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00737133 mov eax, dword ptr fs:[00000030h]		0_2_00737133
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00737131 mov eax, dword ptr fs:[00000030h]		0_2_00737131
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007365F7 mov eax, dword ptr fs:[00000030h]		0_2_007365F7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007325A2 mov eax, dword ptr fs:[00000030h]		0_2_007325A2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007336B1 mov eax, dword ptr fs:[00000030h]		0_2_007336B1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00731F1A mov eax, dword ptr fs:[00000030h]		0_2_00731F1A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007327D3 mov eax, dword ptr fs:[00000030h]		0_2_007327D3

Program does not show much activity (idle)

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

HIPS / PFW / Operating System Protection Evasion:

May try to detect the Windows Explorer process (often used for injection)

Source: file.exe, 00000000.00000002.1276937539.0000000000D00000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: file.exe, 00000000.00000002.1276937539.0000000000D00000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: file.exe, 00000000.00000002.1276937539.0000000000D00000.00000002.00000001.sdmp	Binary or memory string: SProgram Managerl
Source: file.exe, 00000000.00000002.1276937539.0000000000D00000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd,
Source: file.exe, 00000000.00000002.1276937539.0000000000D00000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

Contains functionality to query CPU information (cpuid)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00735941 cpuid

0_2_00735941