Loading ...

Play interactive tourEdit tour

Windows Analysis Report sale order.exe

Overview

General Information

Sample Name:sale order.exe
Analysis ID:502597
MD5:9d3fe8ed9fd927c91dd268f70a4c20b9
SHA1:0f0fe91255fd8af65bc2c03eb4ac63c888e600c9
SHA256:81c6ab8a5c8ea969d37b9b55d052cf8b352109f1d7e85e1115570f54e542b7c2
Tags:exe
Infos:

Most interesting Screenshot:

Detection

AgentTesla
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Found malware configuration
Yara detected AgentTesla
Yara detected AntiVM3
Sigma detected: Bad Opsec Defaults Sacrificial Processes With Improper Arguments
Initial sample is a PE file and has a suspicious name
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal ftp login credentials
Modifies the hosts file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
.NET source code contains potential unpacker
.NET source code contains very large array initializations
Hides that the sample has been downloaded from the Internet (zone.identifier)
Tries to steal Mail credentials (via file access)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Antivirus or Machine Learning detection for unpacked file
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Found potential string decryption / allocating functions
Yara detected Credential Stealer
IP address seen in connection with other malware
Contains long sleeps (>= 3 min)
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Sample file is different than original file name gathered from version info
Drops PE files
Detected TCP or UDP traffic on non-standard ports
Uses SMTP (mail sending)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Dropped file seen in connection with other malware
Creates a process in suspended mode (likely to inject code)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

  • System is w10x64
  • sale order.exe (PID: 6128 cmdline: 'C:\Users\user\Desktop\sale order.exe' MD5: 9D3FE8ED9FD927C91DD268F70A4C20B9)
    • RegSvcs.exe (PID: 4524 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe MD5: 2867A3817C9245F7CF518524DFD18F28)
  • NXLun.exe (PID: 6440 cmdline: 'C:\Users\user\AppData\Roaming\NXLun\NXLun.exe' MD5: 2867A3817C9245F7CF518524DFD18F28)
    • conhost.exe (PID: 6436 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
  • NXLun.exe (PID: 1240 cmdline: 'C:\Users\user\AppData\Roaming\NXLun\NXLun.exe' MD5: 2867A3817C9245F7CF518524DFD18F28)
    • conhost.exe (PID: 3732 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
  • cleanup

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Username": "nbsupports@seshsupports.com", "Password": "User@40378", "Host": "sg2plcpnl0023.prod.sin2.secureserver.net"}

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000003.00000002.536714817.0000000003215000.00000004.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
    00000003.00000002.534073873.0000000000402000.00000040.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
      00000003.00000002.534073873.0000000000402000.00000040.00000001.sdmpJoeSecurity_AgentTesla_2Yara detected AgentTeslaJoe Security
        00000000.00000002.281050930.00000000040E9000.00000004.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
          00000000.00000002.281050930.00000000040E9000.00000004.00000001.sdmpJoeSecurity_AgentTesla_2Yara detected AgentTeslaJoe Security
            Click to see the 10 entries

            Unpacked PEs

            SourceRuleDescriptionAuthorStrings
            0.2.sale order.exe.438e570.2.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
              0.2.sale order.exe.438e570.2.unpackJoeSecurity_AgentTesla_2Yara detected AgentTeslaJoe Security
                3.2.RegSvcs.exe.400000.0.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
                  3.2.RegSvcs.exe.400000.0.unpackJoeSecurity_AgentTesla_2Yara detected AgentTeslaJoe Security
                    0.2.sale order.exe.438e570.2.raw.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
                      Click to see the 3 entries

                      Sigma Overview

                      System Summary:

                      barindex
                      Sigma detected: Bad Opsec Defaults Sacrificial Processes With Improper ArgumentsShow sources
                      Source: Process startedAuthor: Oleg Kolesnikov @securonix invrep_de, oscd.community, Florian Roth, Christian Burkard: Data: Command: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, CommandLine: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, CommandLine|base64offset|contains: , Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, ParentCommandLine: 'C:\Users\user\Desktop\sale order.exe' , ParentImage: C:\Users\user\Desktop\sale order.exe, ParentProcessId: 6128, ProcessCommandLine: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, ProcessId: 4524
                      Sigma detected: Possible Applocker BypassShow sources
                      Source: Process startedAuthor: juju4: Data: Command: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, CommandLine: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, CommandLine|base64offset|contains: , Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, ParentCommandLine: 'C:\Users\user\Desktop\sale order.exe' , ParentImage: C:\Users\user\Desktop\sale order.exe, ParentProcessId: 6128, ProcessCommandLine: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, ProcessId: 4524

                      Jbx Signature Overview

                      Click to jump to signature section

                      Show All Signature Results

                      AV Detection:

                      barindex
                      Found malware configurationShow sources
                      Source: 3.2.RegSvcs.exe.400000.0.unpackMalware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Username": "nbsupports@seshsupports.com", "Password": "User@40378", "Host": "sg2plcpnl0023.prod.sin2.secureserver.net"}
                      Source: 3.2.RegSvcs.exe.400000.0.unpackAvira: Label: TR/Spy.Gen8
                      Source: sale order.exeStatic PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED
                      Source: sale order.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
                      Source: Binary string: RegSvcs.pdb, source: NXLun.exe, 0000000D.00000002.344676668.0000000000F92000.00000002.00020000.sdmp, NXLun.exe, 0000000F.00000002.358260371.0000000000982000.00000002.00020000.sdmp, NXLun.exe.3.dr
                      Source: Binary string: RegSvcs.pdb source: NXLun.exe, NXLun.exe.3.dr
                      Source: Joe Sandbox ViewIP Address: 182.50.132.92 182.50.132.92
                      Source: global trafficTCP traffic: 192.168.2.3:49818 -> 182.50.132.92:587
                      Source: global trafficTCP traffic: 192.168.2.3:49818 -> 182.50.132.92:587
                      Source: RegSvcs.exe, 00000003.00000002.536098752.0000000002F11000.00000004.00000001.sdmpString found in binary or memory: http://127.0.0.1:HTTP/1.1
                      Source: RegSvcs.exe, 00000003.00000002.536098752.0000000002F11000.00000004.00000001.sdmpString found in binary or memory: http://DynDns.comDynDNS
                      Source: RegSvcs.exe, 00000003.00000003.483489630.00000000061DF000.00000004.00000001.sdmpString found in binary or memory: http://certificates.starfieldtech.com/repository/0
                      Source: RegSvcs.exe, 00000003.00000003.483489630.00000000061DF000.00000004.00000001.sdmpString found in binary or memory: http://certificates.starfieldtech.com/repository/sfig2.crt0
                      Source: RegSvcs.exe, 00000003.00000003.483489630.00000000061DF000.00000004.00000001.sdmpString found in binary or memory: http://certs.starfieldtech.com/reposi
                      Source: RegSvcs.exe, 00000003.00000003.483489630.00000000061DF000.00000004.00000001.sdmpString found in binary or memory: http://certs.starfieldtech.com/repository/1402
                      Source: RegSvcs.exe, 00000003.00000003.474129335.00000000061AE000.00000004.00000001.sdmpString found in binary or memory: http://crl.microsoft.co
                      Source: RegSvcs.exe, 00000003.00000003.483489630.00000000061DF000.00000004.00000001.sdmpString found in binary or memory: http://crl.starfieldtech.co
                      Source: RegSvcs.exe, 00000003.00000003.483489630.00000000061DF000.00000004.00000001.sdmpString found in binary or memory: http://crl.starfieldtech.com/sfig2s1-169.crl0c
                      Source: RegSvcs.exe, 00000003.00000003.483489630.00000000061DF000.00000004.00000001.sdmpString found in binary or memory: http://crl.starfieldtech.com/sfroot-g2.crl0L
                      Source: RegSvcs.exe, 00000003.00000002.536098752.0000000002F11000.00000004.00000001.sdmpString found in binary or memory: http://eOPeED.com
                      Source: sale order.exe, 00000000.00000002.282802350.0000000007042000.00000004.00000001.sdmpString found in binary or memory: http://fontfabrik.com
                      Source: RegSvcs.exe, 00000003.00000003.483489630.00000000061DF000.00000004.00000001.sdmpString found in binary or memory: http://ocsp.starfieldtech.com/0;
                      Source: RegSvcs.exe, 00000003.00000003.483489630.00000000061DF000.00000004.00000001.sdmpString found in binary or memory: http://ocsp.starfieldtech.com/0F
                      Source: RegSvcs.exe, 00000003.00000002.536831998.000000000327A000.00000004.00000001.sdmpString found in binary or memory: http://sg2plcpnl0023.prod.sin2.secureserver.net
                      Source: sale order.exe, 00000000.00000002.282802350.0000000007042000.00000004.00000001.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
                      Source: sale order.exe, 00000000.00000002.282802350.0000000007042000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.coml
                      Source: sale order.exe, 00000000.00000002.284684046.0000000007C20000.00000004.00020000.sdmpString found in binary or memory: http://www.collada.org/2005/11/COLLADASchema9Done
                      Source: sale order.exe, 00000000.00000002.282802350.0000000007042000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com
                      Source: sale order.exe, 00000000.00000002.282802350.0000000007042000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers
                      Source: sale order.exe, 00000000.00000002.282802350.0000000007042000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/?
                      Source: sale order.exe, 00000000.00000002.282802350.0000000007042000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
                      Source: sale order.exe, 00000000.00000002.282802350.0000000007042000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
                      Source: sale order.exe, 00000000.00000002.282802350.0000000007042000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers8
                      Source: sale order.exe, 00000000.00000002.282802350.0000000007042000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers?
                      Source: sale order.exe, 00000000.00000002.282802350.0000000007042000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designersG
                      Source: sale order.exe, 00000000.00000003.279577057.0000000005E30000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comm
                      Source: sale order.exe, 00000000.00000003.279577057.0000000005E30000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.como
                      Source: sale order.exe, 00000000.00000002.282802350.0000000007042000.00000004.00000001.sdmpString found in binary or memory: http://www.fonts.com
                      Source: sale order.exe, 00000000.00000003.271353212.0000000005E54000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn
                      Source: sale order.exe, 00000000.00000002.282802350.0000000007042000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/bThe
                      Source: sale order.exe, 00000000.00000003.271653953.0000000005E44000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/c
                      Source: sale order.exe, 00000000.00000002.282802350.0000000007042000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/cThe
                      Source: sale order.exe, 00000000.00000002.282802350.0000000007042000.00000004.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/DPlease
                      Source: sale order.exe, 00000000.00000002.282802350.0000000007042000.00000004.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
                      Source: sale order.exe, 00000000.00000002.282802350.0000000007042000.00000004.00000001.sdmpString found in binary or memory: http://www.goodfont.co.kr
                      Source: sale order.exe, 00000000.00000002.282802350.0000000007042000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/
                      Source: sale order.exe, 00000000.00000002.282802350.0000000007042000.00000004.00000001.sdmpString found in binary or memory: http://www.sajatypeworks.com
                      Source: sale order.exe, 00000000.00000002.282802350.0000000007042000.00000004.00000001.sdmpString found in binary or memory: http://www.sakkal.com
                      Source: sale order.exe, 00000000.00000002.282802350.0000000007042000.00000004.00000001.sdmpString found in binary or memory: http://www.sandoll.co.kr
                      Source: sale order.exe, 00000000.00000002.282802350.0000000007042000.00000004.00000001.sdmpString found in binary or memory: http://www.tiro.com
                      Source: sale order.exe, 00000000.00000003.271714351.0000000005E38000.00000004.00000001.sdmpString found in binary or memory: http://www.tiro.comn
                      Source: sale order.exe, 00000000.00000002.282802350.0000000007042000.00000004.00000001.sdmpString found in binary or memory: http://www.typography.netD
                      Source: sale order.exe, 00000000.00000002.282802350.0000000007042000.00000004.00000001.sdmpString found in binary or memory: http://www.urwpp.deDPlease
                      Source: sale order.exe, 00000000.00000002.282802350.0000000007042000.00000004.00000001.sdmpString found in binary or memory: http://www.zhongyicts.com.cn
                      Source: RegSvcs.exe, 00000003.00000002.536714817.0000000003215000.00000004.00000001.sdmp, RegSvcs.exe, 00000003.00000002.536883763.00000000032A6000.00000004.00000001.sdmpString found in binary or memory: https://92rgATMXZYKxK.net
                      Source: RegSvcs.exe, 00000003.00000002.536098752.0000000002F11000.00000004.00000001.sdmpString found in binary or memory: https://api.ipify.org%$
                      Source: RegSvcs.exe, 00000003.00000002.536098752.0000000002F11000.00000004.00000001.sdmpString found in binary or memory: https://api.ipify.org%GETMozilla/5.0
                      Source: RegSvcs.exe, 00000003.00000003.483489630.00000000061DF000.00000004.00000001.sdmpString found in binary or memory: https://certs.starfieldtech.com/repository/0
                      Source: sale order.exe, 00000000.00000002.281050930.00000000040E9000.00000004.00000001.sdmp, RegSvcs.exe, 00000003.00000002.534073873.0000000000402000.00000040.00000001.sdmpString found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
                      Source: RegSvcs.exe, 00000003.00000002.536098752.0000000002F11000.00000004.00000001.sdmpString found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha
                      Source: unknownDNS traffic detected: queries for: sg2plcpnl0023.prod.sin2.secureserver.net

                      Spam, unwanted Advertisements and Ransom Demands:

                      barindex
                      Modifies the hosts fileShow sources
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeFile written: C:\Windows\System32\drivers\etc\hostsJump to behavior

                      System Summary:

                      barindex
                      Initial sample is a PE file and has a suspicious nameShow sources
                      Source: initial sampleStatic PE information: Filename: sale order.exe
                      .NET source code contains very large array initializationsShow sources
                      Source: 3.2.RegSvcs.exe.400000.0.unpack, u003cPrivateImplementationDetailsu003eu007b11491063u002dF973u002d4D9Fu002d8EF9u002dE310068DA354u007d/u00315C1B4CCu002d2D3Du002d464Au002d978Au002dD3B3D66E249A.csLarge array initialization: .cctor: array initializer size 11976
                      Source: sale order.exeStatic PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED
                      Source: C:\Users\user\Desktop\sale order.exeCode function: 0_2_0149C934
                      Source: C:\Users\user\Desktop\sale order.exeCode function: 0_2_0149E8E3
                      Source: C:\Users\user\Desktop\sale order.exeCode function: 0_2_0149E8F0
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 3_2_015647A0
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 3_2_015646B0
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 3_2_0156D660
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 3_2_06406850
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 3_2_064090D8
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 3_2_06407120
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 3_2_068DA228
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 3_2_068D3764
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: String function: 0640BEB8 appears 48 times
                      Source: sale order.exe, 00000000.00000000.268260989.0000000000BF2000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameGetEnumeratord.exe8 vs sale order.exe
                      Source: sale order.exe, 00000000.00000002.284725976.0000000007E30000.00000004.00020000.sdmpBinary or memory string: OriginalFilenameUI.dll< vs sale order.exe
                      Source: sale order.exe, 00000000.00000002.281236179.000000000426E000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameTflIVczzDXbBygSDTYesuzKjHX.exe4 vs sale order.exe
                      Source: sale order.exe, 00000000.00000002.280713991.00000000030E1000.00000004.00000001.sdmpBinary or memory string: OriginalFilename vs sale order.exe
                      Source: sale order.exeBinary or memory string: OriginalFilenameGetEnumeratord.exe8 vs sale order.exe
                      Source: Joe Sandbox ViewDropped File: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe 43026DCFF238F20CFF0419924486DEE45178119CFDD0D366B79D67D950A9BF50
                      Source: sale order.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                      Source: sale order.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                      Source: C:\Users\user\Desktop\sale order.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
                      Source: unknownProcess created: C:\Users\user\Desktop\sale order.exe 'C:\Users\user\Desktop\sale order.exe'
                      Source: C:\Users\user\Desktop\sale order.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
                      Source: unknownProcess created: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe 'C:\Users\user\AppData\Roaming\NXLun\NXLun.exe'
                      Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                      Source: unknownProcess created: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe 'C:\Users\user\AppData\Roaming\NXLun\NXLun.exe'
                      Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                      Source: C:\Users\user\Desktop\sale order.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\InProcServer32
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                      Source: C:\Users\user\Desktop\sale order.exeFile created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\sale order.exe.logJump to behavior
                      Source: classification engineClassification label: mal100.troj.adwa.spyw.evad.winEXE@7/6@1/1
                      Source: C:\Users\user\Desktop\sale order.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
                      Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
                      Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
                      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3732:120:WilError_01
                      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6436:120:WilError_01
                      Source: C:\Users\user\Desktop\sale order.exeMutant created: \Sessions\1\BaseNamedObjects\WPBvFnYGuWTCXnk
                      Source: 3.2.RegSvcs.exe.400000.0.unpack, A/b2.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
                      Source: 3.2.RegSvcs.exe.400000.0.unpack, A/b2.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                      Source: Window RecorderWindow detected: More than 3 window changes detected
                      Source: C:\Users\user\Desktop\sale order.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
                      Source: sale order.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
                      Source: sale order.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
                      Source: Binary string: RegSvcs.pdb, source: NXLun.exe, 0000000D.00000002.344676668.0000000000F92000.00000002.00020000.sdmp, NXLun.exe, 0000000F.00000002.358260371.0000000000982000.00000002.00020000.sdmp, NXLun.exe.3.dr
                      Source: Binary string: RegSvcs.pdb source: NXLun.exe, NXLun.exe.3.dr

                      Data Obfuscation:

                      barindex
                      .NET source code contains potential unpackerShow sources
                      Source: sale order.exe, u000eu2004.cs.Net Code: \x02 System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
                      Source: 0.0.sale order.exe.b90000.0.unpack, u000eu2004.cs.Net Code: \x02 System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
                      Source: 0.2.sale order.exe.b90000.0.unpack, u000eu2004.cs.Net Code: \x02 System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
                      Source: C:\Users\user\Desktop\sale order.exeCode function: 0_2_00BE7672 push cs; ret
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 3_2_0640EC22 pushad ; ret
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 3_2_06407AE8 push 8BF04589h; iretd
                      Source: initial sampleStatic PE information: section name: .text entropy: 7.95448037982
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeFile created: C:\Users\user\AppData\Roaming\NXLun\NXLun.exeJump to dropped file
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeRegistry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run NXLunJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeRegistry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run NXLunJump to behavior

                      Hooking and other Techniques for Hiding and Protection:

                      barindex
                      Hides that the sample has been downloaded from the Internet (zone.identifier)Show sources
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeFile opened: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe:Zone.Identifier read attributes | delete
                      Source: C:\Users\user\Desktop\sale order.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\sale order.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\sale order.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\sale order.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\sale order.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\sale order.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\sale order.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\sale order.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\sale order.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\sale order.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\sale order.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\sale order.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\sale order.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\sale order.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\sale order.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\sale order.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\sale order.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\sale order.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\sale order.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\sale order.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\sale order.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\sale order.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\sale order.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\sale order.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\sale order.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\sale order.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\sale order.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\sale order.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\sale order.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\sale order.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\sale order.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\sale order.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\sale order.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\sale order.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\sale order.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\sale order.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\sale order.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exeProcess information set: NOOPENFILEERRORBOX

                      Malware Analysis System Evasion:

                      barindex
                      Yara detected AntiVM3Show sources
                      Source: Yara matchFile source: 00000000.00000002.280846228.0000000003187000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000000.00000002.280713991.00000000030E1000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: sale order.exe PID: 6128, type: MEMORYSTR
                      Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)Show sources
                      Source: sale order.exe, 00000000.00000002.280846228.0000000003187000.00000004.00000001.sdmpBinary or memory string: SBIEDLL.DLL
                      Source: sale order.exe, 00000000.00000002.280846228.0000000003187000.00000004.00000001.sdmpBinary or memory string: KERNEL32.DLL.WINE_GET_UNIX_FILE_NAME
                      Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)Show sources
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
                      Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)Show sources
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Source: C:\Users\user\Desktop\sale order.exe TID: 3180Thread sleep time: -922337203685477s >= -30000s
                      Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe TID: 6000Thread sleep time: -922337203685477s >= -30000s
                      Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe TID: 5072Thread sleep time: -922337203685477s >= -30000s
                      Source: C:\Users\user\Desktop\sale order.exeThread delayed: delay time: 922337203685477
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeThread delayed: delay time: 922337203685477
                      Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exeThread delayed: delay time: 922337203685477
                      Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exeThread delayed: delay time: 922337203685477
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeWindow / User API: threadDelayed 909
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeWindow / User API: threadDelayed 8911
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                      Source: C:\Users\user\Desktop\sale order.exeProcess information queried: ProcessInformation
                      Source: C:\Users\user\Desktop\sale order.exeThread delayed: delay time: 922337203685477
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeThread delayed: delay time: 922337203685477
                      Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exeThread delayed: delay time: 922337203685477
                      Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exeThread delayed: delay time: 922337203685477
                      Source: sale order.exe, 00000000.00000002.280846228.0000000003187000.00000004.00000001.sdmpBinary or memory string: VMware SVGA IIBAdd-MpPreference -ExclusionPath "
                      Source: sale order.exe, 00000000.00000002.280846228.0000000003187000.00000004.00000001.sdmpBinary or memory string: InstallPathJC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
                      Source: sale order.exe, 00000000.00000002.280846228.0000000003187000.00000004.00000001.sdmpBinary or memory string: vmware
                      Source: RegSvcs.exe, 00000003.00000002.537939565.0000000006190000.00000004.00000001.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllC:\Windows\system32\WindowsPowerShell\v1.0\Modules;C:\Program Files (x86)\AutoIt3\AutoItXPUBLIC=C:\Users\PublicSESSIONNAME=ConsoleSystemDrive=C:SystemRoot=C:\WindowsTEMP=C:\Users\user\AppData\Local\TempTMP=C:\Users\user\
                      Source: sale order.exe, 00000000.00000002.280846228.0000000003187000.00000004.00000001.sdmpBinary or memory string: VMWAREDSOFTWARE\VMware, Inc.\VMware Tools
                      Source: C:\Users\user\Desktop\sale order.exeProcess token adjusted: Debug
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeCode function: 3_2_0640CC44 KiUserExceptionDispatcher,KiUserExceptionDispatcher,LdrInitializeThunk,
                      Source: C:\Users\user\Desktop\sale order.exeMemory allocated: page read and write | page guard

                      HIPS / PFW / Operating System Protection Evasion:

                      barindex
                      Modifies the hosts fileShow sources
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeFile written: C:\Windows\System32\drivers\etc\hostsJump to behavior
                      Source: C:\Users\user\Desktop\sale order.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
                      Source: RegSvcs.exe, 00000003.00000002.535907003.00000000019A0000.00000002.00020000.sdmpBinary or memory string: Program Manager
                      Source: RegSvcs.exe, 00000003.00000002.535907003.00000000019A0000.00000002.00020000.sdmpBinary or memory string: Shell_TrayWnd
                      Source: RegSvcs.exe, 00000003.00000002.535907003.00000000019A0000.00000002.00020000.sdmpBinary or memory string: Progman
                      Source: RegSvcs.exe, 00000003.00000002.535907003.00000000019A0000.00000002.00020000.sdmpBinary or memory string: Progmanlock
                      Source: C:\Users\user\Desktop\sale order.exeQueries volume information: C:\Users\user\Desktop\sale order.exe VolumeInformation
                      Source: C:\Users\user\Desktop\sale order.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
                      Source: C:\Users\user\Desktop\sale order.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
                      Source: C:\Users\user\Desktop\sale order.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
                      Source: C:\Users\user\Desktop\sale order.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\sale order.exeQueries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\sale order.exeQueries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInf