Windows Analysis Report o4c8AUtX1g

AV Detection:

Found malware configuration

Source: 9.2.plcd-player.exe.39494a0.2.raw.unpack

Malware Configuration Extractor: Ursnif {"RSA Public Key": "GP2bItvzCMVimwFhSq2LMu3Hl69+F5VOC4HbUzLcgCFvHPQPwYycui0JiyqQuwt1jV1IDboN9TEBxLB8CQWBGqcjZkZnRvT4fL8wjq8CCeHOLprVhSXFIxyR2QXzTHDcHr2ux9/r22BaiLqlqlqcKQ1PI6I3WFn39M0K5k1WypMPthcpEVFSO8sVBHvcqRSV", "c2_domain": ["get.updates.avast.cn", "huyasos.in", "curves.ws", "huyasos.in", "rorobrun.in", "huyasos.in", "tfslld.ws", "huyasos.in"], "botnet": "2002", "server": "12", "serpent_key": "44004499FJFHGTYB", "sleep_time": "10", "CONF_TIMEOUT": "20", "SetWaitableTimer_value": "0", "DGA_count": "10"}

Multi AV Scanner detection for submitted file

Source: o4c8AUtX1g.exe

ReversingLabs: Detection: 28%

Antivirus or Machine Learning detection for unpacked file

Source: 9.2.plcd-player.exe.a70000.0.unpack

Avira: Label: TR/Crypt.ZPACK.Gen8

Privilege Escalation:

EXE planting / hijacking vulnerabilities found

Source: C:\Windows\System32\msiexec.exe	EXE: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\plcd-player.exe			Jump to behavior
Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	EXE: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools 3.4.0.2\install\0CE0CF4\plcd-player.exe			Jump to behavior

DLL planting / hijacking vulnerabilities found

Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	DLL: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools 3.4.0.2\install\0CE0CF4\icuio58.dll			Jump to behavior
Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	DLL: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools 3.4.0.2\install\0CE0CF4\libeay32.dll			Jump to behavior
Source: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\plcd-player.exe	DLL: bcrypt.dll			Jump to behavior
Source: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\plcd-player.exe	DLL: GLU32.dll			Jump to behavior
Source: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\plcd-player.exe	DLL: Secur32.dll			Jump to behavior
Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	DLL: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools 3.4.0.2\install\0CE0CF4\AWSSDK.SimpleDB.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	DLL: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\Microsoft.Azure.KeyVault.Core.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	DLL: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\libeay32.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	DLL: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\AWSSDK.SimpleDB.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	DLL: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\ssleay32.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	DLL: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\icuio58.dll			Jump to behavior
Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	DLL: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools 3.4.0.2\install\0CE0CF4\SslCertBinding.Net.dll			Jump to behavior
Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	DLL: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools 3.4.0.2\install\0CE0CF4\lcms-5.0.dll			Jump to behavior
Source: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\plcd-player.exe	DLL: WININET.dll			Jump to behavior
Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	DLL: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools 3.4.0.2\install\0CE0CF4\ssleay32.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	DLL: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\System.Threading.Tasks.dll			Jump to behavior
Source: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\plcd-player.exe	DLL: OPENGL32.dll			Jump to behavior
Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	DLL: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools 3.4.0.2\install\decoder.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	DLL: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\SslCertBinding.Net.dll			Jump to behavior
Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	DLL: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools 3.4.0.2\install\0CE0CF4\System.Threading.Tasks.dll			Jump to behavior
Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	DLL: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools 3.4.0.2\install\0CE0CF4\ICSharpCode.SharpZipLib.dll			Jump to behavior
Source: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\plcd-player.exe	DLL: iertutil.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	DLL: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\ICSharpCode.SharpZipLib.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	DLL: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\Delimon.Win32.IO.dll			Jump to behavior
Source: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\plcd-player.exe	DLL: urlmon.dll			Jump to behavior
Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	DLL: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools 3.4.0.2\install\0CE0CF4\Microsoft.Azure.KeyVault.Core.dll			Jump to behavior
Source: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\plcd-player.exe	DLL: libftl2.dll			Jump to behavior
Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	DLL: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools 3.4.0.2\install\0CE0CF4\Delimon.Win32.IO.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	DLL: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\lcms-5.0.dll			Jump to behavior

Compliance:

Uses 32bit PE files

Source: o4c8AUtX1g.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE

EXE planting / hijacking vulnerabilities found

Source: C:\Windows\System32\msiexec.exe	EXE: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\plcd-player.exe			Jump to behavior
Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	EXE: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools 3.4.0.2\install\0CE0CF4\plcd-player.exe			Jump to behavior

DLL planting / hijacking vulnerabilities found

Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	DLL: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools 3.4.0.2\install\0CE0CF4\icuio58.dll			Jump to behavior
Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	DLL: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools 3.4.0.2\install\0CE0CF4\libeay32.dll			Jump to behavior
Source: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\plcd-player.exe	DLL: bcrypt.dll			Jump to behavior
Source: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\plcd-player.exe	DLL: GLU32.dll			Jump to behavior
Source: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\plcd-player.exe	DLL: Secur32.dll			Jump to behavior
Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	DLL: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools 3.4.0.2\install\0CE0CF4\AWSSDK.SimpleDB.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	DLL: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\Microsoft.Azure.KeyVault.Core.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	DLL: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\libeay32.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	DLL: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\AWSSDK.SimpleDB.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	DLL: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\ssleay32.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	DLL: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\icuio58.dll			Jump to behavior
Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	DLL: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools 3.4.0.2\install\0CE0CF4\SslCertBinding.Net.dll			Jump to behavior
Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	DLL: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools 3.4.0.2\install\0CE0CF4\lcms-5.0.dll			Jump to behavior
Source: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\plcd-player.exe	DLL: WININET.dll			Jump to behavior
Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	DLL: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools 3.4.0.2\install\0CE0CF4\ssleay32.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	DLL: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\System.Threading.Tasks.dll			Jump to behavior
Source: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\plcd-player.exe	DLL: OPENGL32.dll			Jump to behavior
Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	DLL: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools 3.4.0.2\install\decoder.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	DLL: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\SslCertBinding.Net.dll			Jump to behavior
Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	DLL: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools 3.4.0.2\install\0CE0CF4\System.Threading.Tasks.dll			Jump to behavior
Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	DLL: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools 3.4.0.2\install\0CE0CF4\ICSharpCode.SharpZipLib.dll			Jump to behavior
Source: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\plcd-player.exe	DLL: iertutil.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	DLL: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\ICSharpCode.SharpZipLib.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	DLL: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\Delimon.Win32.IO.dll			Jump to behavior
Source: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\plcd-player.exe	DLL: urlmon.dll			Jump to behavior
Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	DLL: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools 3.4.0.2\install\0CE0CF4\Microsoft.Azure.KeyVault.Core.dll			Jump to behavior
Source: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\plcd-player.exe	DLL: libftl2.dll			Jump to behavior
Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	DLL: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools 3.4.0.2\install\0CE0CF4\Delimon.Win32.IO.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	DLL: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\lcms-5.0.dll			Jump to behavior

Creates license or readme file

Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	File created: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools 3.4.0.2\install\0CE0CF4\CrashRpt License.txt			Jump to behavior
Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	File created: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools 3.4.0.2\install\0CE0CF4\License.txt			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\License.txt			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\CrashRpt License.txt			Jump to behavior

PE / OLE file has a valid certificate

Source: o4c8AUtX1g.exe

Static PE information: certificate valid

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: o4c8AUtX1g.exe

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Binary contains paths to debug symbols

Source:	Binary string: wininet.pdb source: o4c8AUtX1g.exe, 00000001.00000003.673805273.0000000003E90000.00000004.00000001.sdmp
Source:	Binary string: c:\Data\SkyDrive\Programming\Projects\Delimon\Delimon.Win32.IO 2013\Win32FileLibrary\obj\Release\Delimon.Win32.IO.pdb source: o4c8AUtX1g.exe, 00000001.00000003.706113597.0000000005A36000.00000004.00000001.sdmp, Delimon.Win32.IO.dll.3.dr
Source:	Binary string: C:\JobRelease\win\Release\stubs\x86\Decoder.pdb source: o4c8AUtX1g.exe
Source:	Binary string: C:\OpenSSL\Temp\openssl-1.0.2g-x32\out32dll\ssleay32.pdb @ source: o4c8AUtX1g.exe, 00000001.00000003.706357287.0000000005BBE000.00000004.00000001.sdmp, ssleay32.dll.3.dr
Source:	Binary string: C:\JobRelease\win\Release\stubs\x86\Decoder.pdb2 source: o4c8AUtX1g.exe
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\SoftwareDetector.pdb source: o4c8AUtX1g.exe, 00000001.00000003.666504324.0000000003C10000.00000004.00000001.sdmp, MSI79F9.tmp.1.dr
Source:	Binary string: E:\JenkinsWorkspaces\v3-trebuchet-release\AWSDotNetPublic\sdk\src\Services\SimpleDB\obj\net35\Release\net35\AWSSDK.SimpleDB.pdbp source: o4c8AUtX1g.exe, 00000001.00000003.706113597.0000000005A36000.00000004.00000001.sdmp, AWSSDK.SimpleDB.dll.1.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\SoftwareDetector.pdb] source: o4c8AUtX1g.exe, 00000001.00000003.666504324.0000000003C10000.00000004.00000001.sdmp, MSI79F9.tmp.1.dr
Source:	Binary string: C:\JobRelease\win\Release\stubs\x86\ExternalUi.pdbk source: o4c8AUtX1g.exe
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\AICustAct.pdb source: o4c8AUtX1g.exe, 00000001.00000003.666504324.0000000003C10000.00000004.00000001.sdmp, 440bbd.msi.3.dr
Source:	Binary string: D:\a\1\s\artifacts\obj\Microsoft.Azure.KeyVault.Core\Release\net452\Microsoft.Azure.KeyVault.Core.pdb source: o4c8AUtX1g.exe, 00000001.00000003.706357287.0000000005BBE000.00000004.00000001.sdmp, Microsoft.Azure.KeyVault.Core.dll.1.dr
Source:	Binary string: C:\JobRelease\win\Release\stubs\x86\ExternalUi.pdb source: o4c8AUtX1g.exe
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\Prereq.pdb source: o4c8AUtX1g.exe, 00000001.00000003.666756331.0000000003D73000.00000004.00000001.sdmp, 440bbd.msi.3.dr
Source:	Binary string: C:\Users\User\AppData\Local\Temp\icu_32\lib\icuio.pdb source: o4c8AUtX1g.exe, 00000001.00000003.706357287.0000000005BBE000.00000004.00000001.sdmp, icuio58.dll.3.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\Prereq.pdbi source: o4c8AUtX1g.exe, 00000001.00000003.666756331.0000000003D73000.00000004.00000001.sdmp, 440bbd.msi.3.dr
Source:	Binary string: E:\JenkinsWorkspaces\v3-trebuchet-release\AWSDotNetPublic\sdk\src\Services\SimpleDB\obj\net35\Release\net35\AWSSDK.SimpleDB.pdb source: o4c8AUtX1g.exe, 00000001.00000003.706113597.0000000005A36000.00000004.00000001.sdmp, AWSSDK.SimpleDB.dll.1.dr
Source:	Binary string: C:\Users\User\AppData\Local\Temp\icu_32\lib\icuio.pdb"" source: o4c8AUtX1g.exe, 00000001.00000003.706357287.0000000005BBE000.00000004.00000001.sdmp, icuio58.dll.3.dr
Source:	Binary string: C:\OpenSSL\Temp\openssl-1.0.2g-x32\out32dll\libeay32.pdb0k source: o4c8AUtX1g.exe, 00000001.00000003.706357287.0000000005BBE000.00000004.00000001.sdmp
Source:	Binary string: C:\OpenSSL\Temp\openssl-1.0.2g-x32\out32dll\ssleay32.pdb source: o4c8AUtX1g.exe, 00000001.00000003.706357287.0000000005BBE000.00000004.00000001.sdmp, ssleay32.dll.3.dr
Source:	Binary string: C:\OpenSSL\Temp\openssl-1.0.2g-x32\out32dll\libeay32.pdb source: o4c8AUtX1g.exe, 00000001.00000003.706357287.0000000005BBE000.00000004.00000001.sdmp
Source:	Binary string: c:\b\4741\2125\src\intermediate\System.Threading.Tasks.v2.5.csproj_75e1c727\Release\System.Threading.Tasks.pdb source: o4c8AUtX1g.exe, 00000001.00000003.706357287.0000000005BBE000.00000004.00000001.sdmp, System.Threading.Tasks.dll.1.dr
Source:	Binary string: D:\a\1\s\artifacts\obj\Microsoft.Azure.KeyVault.Core\Release\net452\Microsoft.Azure.KeyVault.Core.pdbSHA256 source: o4c8AUtX1g.exe, 00000001.00000003.706357287.0000000005BBE000.00000004.00000001.sdmp, Microsoft.Azure.KeyVault.Core.dll.1.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\AICustAct.pdbj source: o4c8AUtX1g.exe, 00000001.00000003.666504324.0000000003C10000.00000004.00000001.sdmp, 440bbd.msi.3.dr
Source:	Binary string: wininet.pdbUGP source: o4c8AUtX1g.exe, 00000001.00000003.673805273.0000000003E90000.00000004.00000001.sdmp
Source:	Binary string: d:\projects\SslCertBinding.Net\src\SslCertBinding.Net\obj\Release\SslCertBinding.Net.pdb source: o4c8AUtX1g.exe, 00000001.00000003.706357287.0000000005BBE000.00000004.00000001.sdmp, SslCertBinding.Net.dll.1.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\lzmaextractor.pdb source: o4c8AUtX1g.exe, 00000001.00000003.666504324.0000000003C10000.00000004.00000001.sdmp, 440bbd.msi.3.dr

Spreading:

Checks for available system drives (often done to infect USB drives)

Source: C:\Windows\SysWOW64\msiexec.exe	File opened: z:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: x:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: v:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: t:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: r:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: p:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: n:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: l:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: j:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: h:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: f:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: b:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: y:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: w:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: u:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: s:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: q:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: o:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: m:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: k:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: i:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: g:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: e:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: c:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: a:			Jump to behavior

Contains functionality to enumerate / list files inside a directory

Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	Code function: 1_2_01342910 FindFirstFileW,FindClose,		1_2_01342910
Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	Code function: 1_2_01345B80 FindFirstFileW,FindClose,CloseHandle,CloseHandle,CloseHandle,CreateEventW,CreateThread,WaitForSingleObject,GetExitCodeThread,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,		1_2_01345B80
Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	Code function: 1_2_01346A30 FindFirstFileW,FindClose,		1_2_01346A30
Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	Code function: 1_2_013294D0 FindFirstFileW,GetLastError,FindClose,		1_2_013294D0
Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	Code function: 1_2_012A8740 FindClose,PathIsUNCW,FindFirstFileW,GetFullPathNameW,GetFullPathNameW,FindClose,SetLastError,PathIsUNCW,		1_2_012A8740
Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	Code function: 1_2_013529C0 FindFirstFileW,FindClose,		1_2_013529C0
Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	Code function: 1_2_013640F0 FindFirstFileW,FindNextFileW,FindFirstFileW,FindNextFileW,FindNextFileW,FindClose,		1_2_013640F0
Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	Code function: 1_2_01328B70 FindFirstFileW,FindFirstFileW,FindFirstFileW,FindClose,FindClose,		1_2_01328B70

Networking:

Tries to resolve domain names, but no domain seems valid (expired dropper behavior)

Source: unknown

DNS traffic detected: query: get.updates.avast.cn replaycode: Name error (3)

Found strings which match to known social media urls

Source: o4c8AUtX1g.exe

String found in binary or memory: !LShell32.dllShlwapi.dllbinSoftware\JavaSoft\Java Runtime Environment\Software\JavaSoft\Java Development Kit\JavaHomeFlashWindowFlashWindowExKernel32.dllGetPackagePathhttp://www.yahoo.comhttp://www.google.comTESThttp://www.example.comtin9999.tmp.partattachmentHEAD "=charsetfilename123DLDutf-8POSTISO-8859-1utf-16AdvancedInstallerUS-ASCIILocal Network ServerGET*/*FTP ServerRange: bytes=%u- equals www.yahoo.com (Yahoo)

Source: o4c8AUtX1g.exe, 00000001.00000000.664338769.0000000001415000.00000002.00020000.sdmp

String found in binary or memory: Shell32.dllShlwapi.dllbinSoftware\JavaSoft\Java Runtime Environment\Software\JavaSoft\Java Development Kit\JavaHomeFlashWindowFlashWindowExKernel32.dllGetPackagePathhttp://www.yahoo.comhttp://www.google.comTESThttp://www.example.comtin9999.tmp.partattachmentHEAD "=charsetfilename123DLDutf-8POSTISO-8859-1utf-16AdvancedInstallerUS-ASCIILocal Network ServerGET*/*FTP ServerRange: bytes=%u- equals www.yahoo.com (Yahoo)

URLs found in memory or binary data

Source: o4c8AUtX1g.exe, 00000001.00000003.673805273.0000000003E90000.00000004.00000001.sdmp	String found in binary or memory: http://.css
Source: o4c8AUtX1g.exe, 00000001.00000003.673805273.0000000003E90000.00000004.00000001.sdmp	String found in binary or memory: http://.jpg
Source: o4c8AUtX1g.exe, 00000001.00000003.706357287.0000000005BBE000.00000004.00000001.sdmp, ssleay32.dll.3.dr	String found in binary or memory: http://aia.startssl.com/certs/ca.crt02
Source: o4c8AUtX1g.exe, 00000001.00000003.706357287.0000000005BBE000.00000004.00000001.sdmp, ssleay32.dll.3.dr	String found in binary or memory: http://aia.startssl.com/certs/sub.class2.code.ca.crt0#
Source: o4c8AUtX1g.exe, 00000001.00000003.706016324.0000000005969000.00000004.00000001.sdmp, plcd-player.exe, 00000009.00000002.934202867.0000000000CDA000.00000002.00020000.sdmp, plcd-player.exe.3.dr	String found in binary or memory: http://apache.org/xml/UnknownNSUCS4UCS-4UCS_4UTF-32ISO-10646-UCS-4UCS-4
Source: o4c8AUtX1g.exe, 00000001.00000003.706016324.0000000005969000.00000004.00000001.sdmp, plcd-player.exe, 00000009.00000002.934202867.0000000000CDA000.00000002.00020000.sdmp, plcd-player.exe.3.dr	String found in binary or memory: http://apache.org/xml/messages/XML4CErrors#FIXEDEBCDIC-CP-USIBM037IBM1047IBM-1047IBM1140IBM01140CCSI
Source: o4c8AUtX1g.exe, 00000001.00000003.706016324.0000000005969000.00000004.00000001.sdmp, plcd-player.exe, 00000009.00000002.934202867.0000000000CDA000.00000002.00020000.sdmp, plcd-player.exe.3.dr	String found in binary or memory: http://apache.org/xml/messages/XMLValidityWINDOWS-1252XERCES-XMLCHhttp://apache.org/xml/messages/XML
Source: o4c8AUtX1g.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: o4c8AUtX1g.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: o4c8AUtX1g.exe	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: o4c8AUtX1g.exe	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: o4c8AUtX1g.exe, 00000001.00000003.706113597.0000000005A36000.00000004.00000001.sdmp, AWSSDK.SimpleDB.dll.1.dr	String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
Source: o4c8AUtX1g.exe, 00000001.00000003.706113597.0000000005A36000.00000004.00000001.sdmp, AWSSDK.SimpleDB.dll.1.dr	String found in binary or memory: http://crl.comodoca.com/COMODORSAExtendedValidationCodeSigningCA.crl0
Source: o4c8AUtX1g.exe, 00000001.00000003.706357287.0000000005BBE000.00000004.00000001.sdmp, ssleay32.dll.3.dr	String found in binary or memory: http://crl.globalsign.com/gs/gstimestampingg2.crl0T
Source: o4c8AUtX1g.exe, 00000001.00000003.707309857.0000000003B11000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: o4c8AUtX1g.exe, 00000001.00000003.706357287.0000000005BBE000.00000004.00000001.sdmp, ssleay32.dll.3.dr	String found in binary or memory: http://crl.globalsign.net/root.crl0
Source: o4c8AUtX1g.exe	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAEVR36.crl0
Source: o4c8AUtX1g.exe	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: o4c8AUtX1g.exe, 00000001.00000003.706357287.0000000005BBE000.00000004.00000001.sdmp, icuio58.dll.3.dr	String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: o4c8AUtX1g.exe, 00000001.00000003.706357287.0000000005BBE000.00000004.00000001.sdmp, ssleay32.dll.3.dr	String found in binary or memory: http://crl.startssl.com/crtc2-crl.crl0
Source: o4c8AUtX1g.exe, 00000001.00000003.706357287.0000000005BBE000.00000004.00000001.sdmp, ssleay32.dll.3.dr	String found in binary or memory: http://crl.startssl.com/sfsca.crl0C
Source: o4c8AUtX1g.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: o4c8AUtX1g.exe	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: o4c8AUtX1g.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: o4c8AUtX1g.exe	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: o4c8AUtX1g.exe	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#
Source: o4c8AUtX1g.exe	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: o4c8AUtX1g.exe, 00000001.00000003.706357287.0000000005BBE000.00000004.00000001.sdmp, icuio58.dll.3.dr	String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: o4c8AUtX1g.exe, 00000001.00000003.707309857.0000000003B11000.00000004.00000001.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: o4c8AUtX1g.exe, 00000001.00000003.673805273.0000000003E90000.00000004.00000001.sdmp	String found in binary or memory: http://html4/loose.dtd
Source: o4c8AUtX1g.exe, 00000001.00000003.706357287.0000000005BBE000.00000004.00000001.sdmp, icuio58.dll.3.dr	String found in binary or memory: http://icu-project.org
Source: o4c8AUtX1g.exe, 00000001.00000003.706357287.0000000005BBE000.00000004.00000001.sdmp, ssleay32.dll.3.dr	String found in binary or memory: http://mybusinesscatalog.com0
Source: o4c8AUtX1g.exe	String found in binary or memory: http://ocsp.comodoca.com0
Source: o4c8AUtX1g.exe, 00000001.00000003.706113597.0000000005A36000.00000004.00000001.sdmp, AWSSDK.SimpleDB.dll.1.dr	String found in binary or memory: http://ocsp.comodoca.com0B
Source: o4c8AUtX1g.exe	String found in binary or memory: http://ocsp.digicert.com0C
Source: o4c8AUtX1g.exe	String found in binary or memory: http://ocsp.digicert.com0O
Source: o4c8AUtX1g.exe, icuio58.dll.3.dr	String found in binary or memory: http://ocsp.sectigo.com0
Source: o4c8AUtX1g.exe	String found in binary or memory: http://ocsp.sectigo.com0)
Source: o4c8AUtX1g.exe, 00000001.00000003.706357287.0000000005BBE000.00000004.00000001.sdmp, ssleay32.dll.3.dr	String found in binary or memory: http://ocsp.startssl.com/ca00
Source: o4c8AUtX1g.exe, 00000001.00000003.706357287.0000000005BBE000.00000004.00000001.sdmp, ssleay32.dll.3.dr	String found in binary or memory: http://ocsp.startssl.com/sub/class2/code/ca0
Source: o4c8AUtX1g.exe, 00000001.00000003.706357287.0000000005BBE000.00000004.00000001.sdmp, ssleay32.dll.3.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gstimestampingg2.crt0
Source: o4c8AUtX1g.exe, 00000001.00000003.666504324.0000000003C10000.00000004.00000001.sdmp, MSI79F9.tmp.1.dr	String found in binary or memory: http://t1.symcb.com/ThawtePCA.crl0
Source: o4c8AUtX1g.exe, 00000001.00000003.666504324.0000000003C10000.00000004.00000001.sdmp, MSI79F9.tmp.1.dr	String found in binary or memory: http://t2.symcb.com0
Source: o4c8AUtX1g.exe, 00000001.00000003.666504324.0000000003C10000.00000004.00000001.sdmp, MSI79F9.tmp.1.dr	String found in binary or memory: http://tl.symcb.com/tl.crl0
Source: o4c8AUtX1g.exe, 00000001.00000003.666504324.0000000003C10000.00000004.00000001.sdmp, MSI79F9.tmp.1.dr	String found in binary or memory: http://tl.symcb.com/tl.crt0
Source: o4c8AUtX1g.exe, 00000001.00000003.666504324.0000000003C10000.00000004.00000001.sdmp, MSI79F9.tmp.1.dr	String found in binary or memory: http://tl.symcd.com0&
Source: o4c8AUtX1g.exe, 00000001.00000003.703979629.0000000005640000.00000004.00000001.sdmp, License.txt.1.dr	String found in binary or memory: http://www.MyBusinessCatalog.com
Source: o4c8AUtX1g.exe	String found in binary or memory: http://www.digicert.com/CPS0
Source: o4c8AUtX1g.exe, 00000001.00000003.703979629.0000000005640000.00000004.00000001.sdmp, ecb-eurofxref-daily.xml.3.dr	String found in binary or memory: http://www.ecb.int/vocabulary/2002-08-01/eurofxref
Source: o4c8AUtX1g.exe, 00000001.00000003.703979629.0000000005640000.00000004.00000001.sdmp, ecb-eurofxref-daily.xml.3.dr	String found in binary or memory: http://www.gesmes.org/xml/2002-08-01
Source: o4c8AUtX1g.exe, 00000001.00000003.706357287.0000000005BBE000.00000004.00000001.sdmp, ssleay32.dll.3.dr	String found in binary or memory: http://www.openssl.org/V
Source: o4c8AUtX1g.exe, 00000001.00000003.706357287.0000000005BBE000.00000004.00000001.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.html
Source: o4c8AUtX1g.exe, 00000001.00000003.706357287.0000000005BBE000.00000004.00000001.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.html....................rbwb.rndC:HOMERANDFILEPRNG
Source: o4c8AUtX1g.exe, 00000001.00000003.706357287.0000000005BBE000.00000004.00000001.sdmp, ssleay32.dll.3.dr	String found in binary or memory: http://www.startssl.com/0
Source: o4c8AUtX1g.exe, 00000001.00000003.706357287.0000000005BBE000.00000004.00000001.sdmp, ssleay32.dll.3.dr	String found in binary or memory: http://www.startssl.com/policy.pdf0
Source: icuio58.dll.3.dr	String found in binary or memory: http://www.unicode.org/copyright.html
Source: o4c8AUtX1g.exe, 00000001.00000003.706357287.0000000005BBE000.00000004.00000001.sdmp, Microsoft.Azure.KeyVault.Core.dll.1.dr	String found in binary or memory: https://aka.ms/azsdkvalueprop.
Source: currencysystem5.json.3.dr	String found in binary or memory: https://currencysystem.com
Source: o4c8AUtX1g.exe, 00000001.00000003.703979629.0000000005640000.00000004.00000001.sdmp, currencysystem4.js.3.dr	String found in binary or memory: https://currencysystem.com/gfx/pub/script-button-88x31.gif
Source: o4c8AUtX1g.exe, 00000001.00000003.703979629.0000000005640000.00000004.00000001.sdmp, currencysystem5.js.3.dr, currencysystem5.json.3.dr	String found in binary or memory: https://currencysystem.com/gfx/pub/script-button-88x31.png
Source: o4c8AUtX1g.exe, 00000001.00000003.703979629.0000000005640000.00000004.00000001.sdmp, currencysystem4.js.3.dr	String found in binary or memory: https://currencysystem.com/gfx/pub/script-icon-16x16.gif
Source: o4c8AUtX1g.exe, 00000001.00000003.703979629.0000000005640000.00000004.00000001.sdmp, currencysystem5.js.3.dr, currencysystem5.json.3.dr	String found in binary or memory: https://currencysystem.com/gfx/pub/script-icon-16x16.png
Source: o4c8AUtX1g.exe	String found in binary or memory: https://sectigo.com/CPS0
Source: o4c8AUtX1g.exe, 00000001.00000003.706357287.0000000005BBE000.00000004.00000001.sdmp, icuio58.dll.3.dr	String found in binary or memory: https://sectigo.com/CPS0D
Source: o4c8AUtX1g.exe, 00000001.00000003.706113597.0000000005A36000.00000004.00000001.sdmp, AWSSDK.SimpleDB.dll.1.dr	String found in binary or memory: https://secure.comodo.com/CPS0L
Source: o4c8AUtX1g.exe, 00000001.00000003.666504324.0000000003C10000.00000004.00000001.sdmp, MSI79F9.tmp.1.dr	String found in binary or memory: https://www.advancedinstaller.com
Source: o4c8AUtX1g.exe	String found in binary or memory: https://www.digicert.com/CPS0
Source: o4c8AUtX1g.exe, 00000001.00000003.706357287.0000000005BBE000.00000004.00000001.sdmp, ssleay32.dll.3.dr	String found in binary or memory: https://www.globalsign.com/repository/0
Source: o4c8AUtX1g.exe, 00000001.00000003.706357287.0000000005BBE000.00000004.00000001.sdmp, ssleay32.dll.3.dr	String found in binary or memory: https://www.globalsign.com/repository/03
Source: o4c8AUtX1g.exe, 00000001.00000003.706357287.0000000005BBE000.00000004.00000001.sdmp, Microsoft.Azure.KeyVault.Core.dll.1.dr	String found in binary or memory: https://www.nuget.org/packages/Azure.Security.KeyVault.Certificates
Source: o4c8AUtX1g.exe, 00000001.00000003.706357287.0000000005BBE000.00000004.00000001.sdmp, Microsoft.Azure.KeyVault.Core.dll.1.dr	String found in binary or memory: https://www.nuget.org/packages/Azure.Security.KeyVault.Keys
Source: o4c8AUtX1g.exe, 00000001.00000003.706357287.0000000005BBE000.00000004.00000001.sdmp, Microsoft.Azure.KeyVault.Core.dll.1.dr	String found in binary or memory: https://www.nuget.org/packages/Azure.Security.KeyVault.Secrets
Source: o4c8AUtX1g.exe, 00000001.00000003.666504324.0000000003C10000.00000004.00000001.sdmp, MSI79F9.tmp.1.dr	String found in binary or memory: https://www.thawte.com/cps0/
Source: o4c8AUtX1g.exe, 00000001.00000003.666504324.0000000003C10000.00000004.00000001.sdmp, MSI79F9.tmp.1.dr	String found in binary or memory: https://www.thawte.com/repository0W

Performs DNS lookups

Source: unknown

DNS traffic detected: queries for: get.updates.avast.cn

Contains functionality to download additional files from the internet

Source: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\plcd-player.exe

Code function: 9_2_00A903A0 RtlEnterCriticalSection,RtlLeaveCriticalSection,Sleep,select,__WSAFDIsSet,WSARecv,WSAGetLastError,RtlLeaveCriticalSection,

9_2_00A903A0

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Yara detected Ursnif

Source: Yara match	File source: 00000009.00000003.913796145.0000000003E68000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.913762032.0000000003E68000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.913941910.0000000003E68000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.937726154.0000000003E68000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.913912827.0000000003E68000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.914001553.0000000003E68000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.913978289.0000000003E68000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.913841738.0000000003E68000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.913966024.0000000003E68000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: plcd-player.exe PID: 4744, type: MEMORYSTR
Source: Yara match	File source: 9.2.plcd-player.exe.39494a0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.plcd-player.exe.39494a0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.plcd-player.exe.1270000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.937676135.0000000003949000.00000004.00000040.sdmp, type: MEMORY

E-Banking Fraud:

Yara detected Ursnif

Source: Yara match	File source: 00000009.00000003.913796145.0000000003E68000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.913762032.0000000003E68000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.913941910.0000000003E68000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.937726154.0000000003E68000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.913912827.0000000003E68000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.914001553.0000000003E68000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.913978289.0000000003E68000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.913841738.0000000003E68000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.913966024.0000000003E68000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: plcd-player.exe PID: 4744, type: MEMORYSTR
Source: Yara match	File source: 9.2.plcd-player.exe.39494a0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.plcd-player.exe.39494a0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.plcd-player.exe.1270000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.937676135.0000000003949000.00000004.00000040.sdmp, type: MEMORY

System Summary:

PE file has a writeable .text section

Source: plcd-player.exe.1.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: plcd-player.exe.3.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Writes or reads registry keys via WMI

Source: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\plcd-player.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetBinaryValue
Source: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\plcd-player.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetStringValue
Source: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\plcd-player.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
Source: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\plcd-player.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\plcd-player.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue

Writes registry values via WMI

Source: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\plcd-player.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
Source: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\plcd-player.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\plcd-player.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue

Uses 32bit PE files

Source: o4c8AUtX1g.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE

Deletes files inside the Windows folder

Source: C:\Windows\System32\msiexec.exe

File deleted: C:\Windows\Installer\MSI11D7.tmp

Jump to behavior

Creates files inside the system directory

Source: C:\Windows\System32\msiexec.exe

File created: C:\Windows\Installer\440bbd.msi

Jump to behavior

Detected potential crypto function

Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	Code function: 1_2_01342910		1_2_01342910
Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	Code function: 1_2_012A8740		1_2_012A8740
Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	Code function: 1_2_013446B0		1_2_013446B0
Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	Code function: 1_2_01292080		1_2_01292080
Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	Code function: 1_2_012AC080		1_2_012AC080
Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	Code function: 1_2_013038F0		1_2_013038F0
Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	Code function: 1_2_013D7354		1_2_013D7354
Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	Code function: 1_2_013C2241		1_2_013C2241
Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	Code function: 1_2_012A6AC0		1_2_012A6AC0
Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	Code function: 1_2_012BF560		1_2_012BF560
Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	Code function: 1_2_013D8F4E		1_2_013D8F4E
Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	Code function: 1_2_013D8E2E		1_2_013D8E2E
Source: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\plcd-player.exe	Code function: 9_2_00AB0130		9_2_00AB0130
Source: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\plcd-player.exe	Code function: 9_2_00ACB960		9_2_00ACB960
Source: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\plcd-player.exe	Code function: 9_2_00AA6AF0		9_2_00AA6AF0
Source: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\plcd-player.exe	Code function: 9_2_00C43483		9_2_00C43483
Source: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\plcd-player.exe	Code function: 9_2_00C344AF		9_2_00C344AF
Source: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\plcd-player.exe	Code function: 9_2_00C274B9		9_2_00C274B9
Source: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\plcd-player.exe	Code function: 9_2_00C3FC19		9_2_00C3FC19
Source: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\plcd-player.exe	Code function: 9_2_00C435A3		9_2_00C435A3
Source: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\plcd-player.exe	Code function: 9_2_00AA75D0		9_2_00AA75D0
Source: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\plcd-player.exe	Code function: 9_2_00AD5D70		9_2_00AD5D70
Source: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\plcd-player.exe	Code function: 9_2_00AAAF30		9_2_00AAAF30

Found potential string decryption / allocating functions

Source: C:\Users\user\Desktop\o4c8AUtX1g.exe

Code function: String function: 01296990 appears 186 times

Contains functionality to call native functions

Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	Code function: 1_2_0129D890 NtdllDefWindowProc_W,		1_2_0129D890
Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	Code function: 1_2_012A0320 NtdllDefWindowProc_W,		1_2_012A0320
Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	Code function: 1_2_0129D260 SysFreeString,SysAllocString,NtdllDefWindowProc_W,GlobalAlloc,GlobalLock,GlobalUnlock,SysFreeString,NtdllDefWindowProc_W,SysFreeString,		1_2_0129D260
Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	Code function: 1_2_012AA2E0 NtdllDefWindowProc_W,DeleteCriticalSection,		1_2_012AA2E0
Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	Code function: 1_2_0129FD60 NtdllDefWindowProc_W,		1_2_0129FD60
Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	Code function: 1_2_0129CCB0 NtdllDefWindowProc_W,GlobalAlloc,GlobalLock,GlobalUnlock,NtdllDefWindowProc_W,		1_2_0129CCB0
Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	Code function: 1_2_012C7CF0 NtdllDefWindowProc_W,		1_2_012C7CF0
Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	Code function: 1_2_012A6760 NtdllDefWindowProc_W,		1_2_012A6760
Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	Code function: 1_2_0129F740 NtdllDefWindowProc_W,		1_2_0129F740
Source: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\plcd-player.exe	Code function: 9_2_00A719A0 NtQuerySystemInformation,Sleep,GetLongPathNameW,GetLongPathNameW,GetLongPathNameW,CreateThread,GetLastError,QueueUserAPC,CloseHandle,GetLastError,TerminateThread,CloseHandle,SetLastError,WaitForSingleObject,GetExitCodeThread,CloseHandle,GetLastError,GetLastError,		9_2_00A719A0
Source: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\plcd-player.exe	Code function: 9_2_00A71703 NtMapViewOfSection,		9_2_00A71703
Source: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\plcd-player.exe	Code function: 9_2_00A71C90 GetProcAddress,NtCreateSection,memset,		9_2_00A71C90

Sample file is different than original file name gathered from version info

Source: o4c8AUtX1g.exe, 00000001.00000002.723507064.000000000147D000.00000002.00020000.sdmp	Binary or memory string: OriginalFileNameplcd-player.exe> vs o4c8AUtX1g.exe
Source: o4c8AUtX1g.exe, 00000001.00000003.673805273.0000000003E90000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamewininet.dllD vs o4c8AUtX1g.exe
Source: o4c8AUtX1g.exe, 00000001.00000003.666504324.0000000003C10000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamelzmaextractor.dllF vs o4c8AUtX1g.exe
Source: o4c8AUtX1g.exe, 00000001.00000003.666504324.0000000003C10000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameAICustAct.dllF vs o4c8AUtX1g.exe
Source: o4c8AUtX1g.exe, 00000001.00000003.706113597.0000000005A36000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameJDesktop.tools vs o4c8AUtX1g.exe
Source: o4c8AUtX1g.exe, 00000001.00000003.706113597.0000000005A36000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameAWSSDK.SimpleDB.dllb! vs o4c8AUtX1g.exe
Source: o4c8AUtX1g.exe, 00000001.00000003.706113597.0000000005A36000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameDelimon.Win32.IO.dllD vs o4c8AUtX1g.exe
Source: o4c8AUtX1g.exe, 00000001.00000003.706113597.0000000005A36000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameICSharpCode.SharpZipLib.dll8 vs o4c8AUtX1g.exe
Source: o4c8AUtX1g.exe, 00000001.00000003.666756331.0000000003D73000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameSoftwareDetector.dllF vs o4c8AUtX1g.exe
Source: o4c8AUtX1g.exe, 00000001.00000003.666756331.0000000003D73000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamePrereq.dllF vs o4c8AUtX1g.exe
Source: o4c8AUtX1g.exe, 00000001.00000003.706357287.0000000005BBE000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameicuio58.dll vs o4c8AUtX1g.exe
Source: o4c8AUtX1g.exe, 00000001.00000003.706357287.0000000005BBE000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameUtilities_HelperlL vs o4c8AUtX1g.exe
Source: o4c8AUtX1g.exe, 00000001.00000003.706357287.0000000005BBE000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamelibeay32.dllH vs o4c8AUtX1g.exe
Source: o4c8AUtX1g.exe, 00000001.00000003.706357287.0000000005BBE000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Azure.KeyVault.Core.dll> vs o4c8AUtX1g.exe
Source: o4c8AUtX1g.exe, 00000001.00000003.706357287.0000000005BBE000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameSslCertBinding.Net.dllH vs o4c8AUtX1g.exe
Source: o4c8AUtX1g.exe, 00000001.00000003.706357287.0000000005BBE000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamessleay32.dllH vs o4c8AUtX1g.exe
Source: o4c8AUtX1g.exe, 00000001.00000003.706357287.0000000005BBE000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameSystem.Threading.Tasks.dllP vs o4c8AUtX1g.exe
Source: o4c8AUtX1g.exe	Binary or memory string: OriginalFileNameplcd-player.exe> vs o4c8AUtX1g.exe
Source: o4c8AUtX1g.exe	Binary or memory string: OriginalFilenameDecoder.dllF vs o4c8AUtX1g.exe

PE file contains strange resources

Source: o4c8AUtX1g.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: plcd-player.exe.1.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: plcd-player.exe.3.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Tries to load missing DLLs

Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	Section loaded: lpk.dll			Jump to behavior
Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	Section loaded: tsappcmp.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: tsappcmp.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll			Jump to behavior
Source: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\plcd-player.exe	Section loaded: libftl2.dll			Jump to behavior

PE file has an executable .text section which is very likely to contain packed code (zlib compression ratio < 0.3)

Source: Delimon.Win32.IO.dll.1.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: Delimon.Win32.IO.dll.3.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Sample is known by Antivirus

Source: o4c8AUtX1g.exe

ReversingLabs: Detection: 28%

Sample reads its own file content

Source: C:\Users\user\Desktop\o4c8AUtX1g.exe

File read: C:\Users\user\Desktop\o4c8AUtX1g.exe

Jump to behavior

PE file has an executable .text section and no other executable section

Source: o4c8AUtX1g.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Reads software policies

Source: C:\Users\user\Desktop\o4c8AUtX1g.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Spawns processes

Source: unknown	Process created: C:\Users\user\Desktop\o4c8AUtX1g.exe 'C:\Users\user\Desktop\o4c8AUtX1g.exe'
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding D90C408BAA115D1625882500CC5A128E C
Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	Process created: C:\Windows\SysWOW64\msiexec.exe 'C:\Windows\system32\msiexec.exe' /i 'C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools 3.4.0.2\install\0CE0CF4\adv.msi' AI_SETUPEXEPATH=C:\Users\user\Desktop\o4c8AUtX1g.exe SETUPEXEDIR=C:\Users\user\Desktop\ EXE_CMD_LINE='/exenoupdates /forcecleanup /wintime 1635154532 ' AI_EUIMSI=''
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 97E0B76AE09D0E82CE071E7BABCE98E1
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\plcd-player.exe C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\plcd-player.exe
Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	Process created: C:\Windows\SysWOW64\msiexec.exe 'C:\Windows\system32\msiexec.exe' /i 'C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools 3.4.0.2\install\0CE0CF4\adv.msi' AI_SETUPEXEPATH=C:\Users\user\Desktop\o4c8AUtX1g.exe SETUPEXEDIR=C:\Users\user\Desktop\ EXE_CMD_LINE='/exenoupdates /forcecleanup /wintime 1635154532 ' AI_EUIMSI=''			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding D90C408BAA115D1625882500CC5A128E C			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 97E0B76AE09D0E82CE071E7BABCE98E1			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\plcd-player.exe C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\plcd-player.exe			Jump to behavior

Uses an in-process (OLE) Automation server

Source: C:\Users\user\Desktop\o4c8AUtX1g.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Creates files inside the user directory

Source: C:\Users\user\Desktop\o4c8AUtX1g.exe

File created: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project

Jump to behavior

Creates temporary files

Source: C:\Users\user\Desktop\o4c8AUtX1g.exe

File created: C:\Users\user\AppData\Local\Temp\shi7515.tmp

Jump to behavior

Classification label

Source: classification engine

Classification label: mal69.troj.evad.winEXE@10/55@1/0

Reads ini files

Source: C:\Users\user\Desktop\o4c8AUtX1g.exe

File read: C:\Users\desktop.ini

Jump to behavior

Contains functionality to check free disk space

Source: C:\Users\user\Desktop\o4c8AUtX1g.exe

Code function: 1_2_01350E70 GetDiskFreeSpaceExW,

1_2_01350E70

.NET source code contains functionality to register a task

Source: System.Threading.Tasks.dll.1.dr, Runtime.CompilerServices/AsyncTaskMethodBuilder<TResult>.cs	Task registration methods: 'Create'
Source: System.Threading.Tasks.dll.1.dr, Runtime.CompilerServices/AsyncMethodTaskCache<TResult>.cs	Task registration methods: 'CreateCache', 'CreateCompleted'
Source: System.Threading.Tasks.dll.1.dr, Runtime.CompilerServices/AsyncTaskMethodBuilder.cs	Task registration methods: 'Create'

Found detection on Joe Sandbox Cloud Basic with higher score

Source: o4c8AUtX1g

Joe Sandbox Cloud Basic: Detection: clean Score: 0

Perma Link

Contains functionality to load and extract PE file embedded resources

Source: C:\Users\user\Desktop\o4c8AUtX1g.exe

Code function: 1_2_01297B80 LoadResource,LockResource,SizeofResource,

1_2_01297B80

Binary contains paths to development resources

Source: o4c8AUtX1g.exe, 00000001.00000003.706357287.0000000005BBE000.00000004.00000001.sdmp, System.Threading.Tasks.dll.1.dr

Binary or memory string: c:\b\4741\2125\src\intermediate\System.Threading.Tasks.v2.5.csproj_75e1c727\Release\System.Threading.Tasks.pdb

.NET source code contains calls to encryption/decryption functions

Source: ICSharpCode.SharpZipLib.dll.1.dr, ICSharpCode.SharpZipLib/Zip/Compression/Streams/InflaterInputBuffer.cs	Cryptographic APIs: 'TransformBlock'
Source: ICSharpCode.SharpZipLib.dll.1.dr, ICSharpCode.SharpZipLib/Zip/Compression/Streams/InflaterInputBuffer.cs	Cryptographic APIs: 'TransformBlock'
Source: ICSharpCode.SharpZipLib.dll.1.dr, ICSharpCode.SharpZipLib/Zip/Compression/Streams/DeflaterOutputStream.cs	Cryptographic APIs: 'TransformBlock'
Source: ICSharpCode.SharpZipLib.dll.1.dr, ICSharpCode.SharpZipLib/Encryption/ZipAESTransform.cs	Cryptographic APIs: 'TransformBlock'

Reads the hosts file

Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\plcd-player.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\plcd-player.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

PE file has a big code size

Source: o4c8AUtX1g.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Submission file is bigger than most known malware samples

Source: o4c8AUtX1g.exe

Static file information: File size 7840232 > 1048576

PE / OLE file has a valid certificate

Source: o4c8AUtX1g.exe

Static PE information: certificate valid

PE file has a big raw section

Source: o4c8AUtX1g.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x183c00

PE file contains a mix of data directories often seen in goodware

Source: o4c8AUtX1g.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: o4c8AUtX1g.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: o4c8AUtX1g.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: o4c8AUtX1g.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: o4c8AUtX1g.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: o4c8AUtX1g.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: o4c8AUtX1g.exe

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

PE file contains a debug data directory

Source: o4c8AUtX1g.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Binary contains paths to debug symbols

Source:	Binary string: wininet.pdb source: o4c8AUtX1g.exe, 00000001.00000003.673805273.0000000003E90000.00000004.00000001.sdmp
Source:	Binary string: c:\Data\SkyDrive\Programming\Projects\Delimon\Delimon.Win32.IO 2013\Win32FileLibrary\obj\Release\Delimon.Win32.IO.pdb source: o4c8AUtX1g.exe, 00000001.00000003.706113597.0000000005A36000.00000004.00000001.sdmp, Delimon.Win32.IO.dll.3.dr
Source:	Binary string: C:\JobRelease\win\Release\stubs\x86\Decoder.pdb source: o4c8AUtX1g.exe
Source:	Binary string: C:\OpenSSL\Temp\openssl-1.0.2g-x32\out32dll\ssleay32.pdb @ source: o4c8AUtX1g.exe, 00000001.00000003.706357287.0000000005BBE000.00000004.00000001.sdmp, ssleay32.dll.3.dr
Source:	Binary string: C:\JobRelease\win\Release\stubs\x86\Decoder.pdb2 source: o4c8AUtX1g.exe
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\SoftwareDetector.pdb source: o4c8AUtX1g.exe, 00000001.00000003.666504324.0000000003C10000.00000004.00000001.sdmp, MSI79F9.tmp.1.dr
Source:	Binary string: E:\JenkinsWorkspaces\v3-trebuchet-release\AWSDotNetPublic\sdk\src\Services\SimpleDB\obj\net35\Release\net35\AWSSDK.SimpleDB.pdbp source: o4c8AUtX1g.exe, 00000001.00000003.706113597.0000000005A36000.00000004.00000001.sdmp, AWSSDK.SimpleDB.dll.1.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\SoftwareDetector.pdb] source: o4c8AUtX1g.exe, 00000001.00000003.666504324.0000000003C10000.00000004.00000001.sdmp, MSI79F9.tmp.1.dr
Source:	Binary string: C:\JobRelease\win\Release\stubs\x86\ExternalUi.pdbk source: o4c8AUtX1g.exe
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\AICustAct.pdb source: o4c8AUtX1g.exe, 00000001.00000003.666504324.0000000003C10000.00000004.00000001.sdmp, 440bbd.msi.3.dr
Source:	Binary string: D:\a\1\s\artifacts\obj\Microsoft.Azure.KeyVault.Core\Release\net452\Microsoft.Azure.KeyVault.Core.pdb source: o4c8AUtX1g.exe, 00000001.00000003.706357287.0000000005BBE000.00000004.00000001.sdmp, Microsoft.Azure.KeyVault.Core.dll.1.dr
Source:	Binary string: C:\JobRelease\win\Release\stubs\x86\ExternalUi.pdb source: o4c8AUtX1g.exe
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\Prereq.pdb source: o4c8AUtX1g.exe, 00000001.00000003.666756331.0000000003D73000.00000004.00000001.sdmp, 440bbd.msi.3.dr
Source:	Binary string: C:\Users\User\AppData\Local\Temp\icu_32\lib\icuio.pdb source: o4c8AUtX1g.exe, 00000001.00000003.706357287.0000000005BBE000.00000004.00000001.sdmp, icuio58.dll.3.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\Prereq.pdbi source: o4c8AUtX1g.exe, 00000001.00000003.666756331.0000000003D73000.00000004.00000001.sdmp, 440bbd.msi.3.dr
Source:	Binary string: E:\JenkinsWorkspaces\v3-trebuchet-release\AWSDotNetPublic\sdk\src\Services\SimpleDB\obj\net35\Release\net35\AWSSDK.SimpleDB.pdb source: o4c8AUtX1g.exe, 00000001.00000003.706113597.0000000005A36000.00000004.00000001.sdmp, AWSSDK.SimpleDB.dll.1.dr
Source:	Binary string: C:\Users\User\AppData\Local\Temp\icu_32\lib\icuio.pdb"" source: o4c8AUtX1g.exe, 00000001.00000003.706357287.0000000005BBE000.00000004.00000001.sdmp, icuio58.dll.3.dr
Source:	Binary string: C:\OpenSSL\Temp\openssl-1.0.2g-x32\out32dll\libeay32.pdb0k source: o4c8AUtX1g.exe, 00000001.00000003.706357287.0000000005BBE000.00000004.00000001.sdmp
Source:	Binary string: C:\OpenSSL\Temp\openssl-1.0.2g-x32\out32dll\ssleay32.pdb source: o4c8AUtX1g.exe, 00000001.00000003.706357287.0000000005BBE000.00000004.00000001.sdmp, ssleay32.dll.3.dr
Source:	Binary string: C:\OpenSSL\Temp\openssl-1.0.2g-x32\out32dll\libeay32.pdb source: o4c8AUtX1g.exe, 00000001.00000003.706357287.0000000005BBE000.00000004.00000001.sdmp
Source:	Binary string: c:\b\4741\2125\src\intermediate\System.Threading.Tasks.v2.5.csproj_75e1c727\Release\System.Threading.Tasks.pdb source: o4c8AUtX1g.exe, 00000001.00000003.706357287.0000000005BBE000.00000004.00000001.sdmp, System.Threading.Tasks.dll.1.dr
Source:	Binary string: D:\a\1\s\artifacts\obj\Microsoft.Azure.KeyVault.Core\Release\net452\Microsoft.Azure.KeyVault.Core.pdbSHA256 source: o4c8AUtX1g.exe, 00000001.00000003.706357287.0000000005BBE000.00000004.00000001.sdmp, Microsoft.Azure.KeyVault.Core.dll.1.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\AICustAct.pdbj source: o4c8AUtX1g.exe, 00000001.00000003.666504324.0000000003C10000.00000004.00000001.sdmp, 440bbd.msi.3.dr
Source:	Binary string: wininet.pdbUGP source: o4c8AUtX1g.exe, 00000001.00000003.673805273.0000000003E90000.00000004.00000001.sdmp
Source:	Binary string: d:\projects\SslCertBinding.Net\src\SslCertBinding.Net\obj\Release\SslCertBinding.Net.pdb source: o4c8AUtX1g.exe, 00000001.00000003.706357287.0000000005BBE000.00000004.00000001.sdmp, SslCertBinding.Net.dll.1.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\lzmaextractor.pdb source: o4c8AUtX1g.exe, 00000001.00000003.666504324.0000000003C10000.00000004.00000001.sdmp, 440bbd.msi.3.dr

PE file contains a valid data directory to section mapping

Source: o4c8AUtX1g.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: o4c8AUtX1g.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: o4c8AUtX1g.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: o4c8AUtX1g.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: o4c8AUtX1g.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation:

Detected unpacking (changes PE section rights)

Source: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\plcd-player.exe

Unpacked PE file: 9.2.plcd-player.exe.a70000.0.unpack .text:EW;.rdata:R;.data:W;.rsrc:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.bss:W;.rsrc:R;.reloc:R;

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	Code function: 1_2_013BC4AC push ecx; ret		1_2_013BC4BF
Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	Code function: 1_2_012A3CB0 push ecx; mov dword ptr [esp], ecx		1_2_012A3CB1
Source: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\plcd-player.exe	Code function: 9_2_00C55731 push ecx; ret		9_2_00C55744

PE file contains sections with non-standard names

Source: shi7515.tmp.1.dr	Static PE information: section name: .wpp_sf
Source: shi7515.tmp.1.dr	Static PE information: section name: .didat

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\o4c8AUtX1g.exe

Code function: 1_2_01363D80 LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

1_2_01363D80

PE file contains an invalid checksum

Source: lcms-5.0.dll.3.dr	Static PE information: real checksum: 0x4a44af should be: 0x4c891f
Source: lcms-5.0.dll.1.dr	Static PE information: real checksum: 0x4a44af should be: 0x4c891f
Source: decoder.dll.1.dr	Static PE information: real checksum: 0x0 should be: 0x378b8

Binary contains a suspicious time stamp

Source: shi7515.tmp.1.dr

Static PE information: 0x72F9C735 [Sun Feb 16 01:34:45 2031 UTC]

Binary may include packed or encrypted code

Source: initial sample	Static PE information: section name: .text entropy: 7.27378716859
Source: initial sample	Static PE information: section name: .text entropy: 7.27378716859

Persistence and Installation Behavior:

Drops files with a non-matching file extension (content does not match file extension)

Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	File created: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools 3.4.0.2\install\0CE0CF4\ml			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\ml			Jump to dropped file

Drops PE files

Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	File created: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools 3.4.0.2\install\0CE0CF4\icuio58.dll			Jump to dropped file
Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	File created: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools 3.4.0.2\install\0CE0CF4\libeay32.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI11D7.tmp			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI193F.tmp			Jump to dropped file
Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	File created: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools 3.4.0.2\install\0CE0CF4\AWSSDK.SimpleDB.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\Microsoft.Azure.KeyVault.Core.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI1488.tmp			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\libeay32.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\AWSSDK.SimpleDB.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\ssleay32.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\icuio58.dll			Jump to dropped file
Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	File created: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools 3.4.0.2\install\0CE0CF4\SslCertBinding.Net.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\plcd-player.exe			Jump to dropped file
Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	File created: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools 3.4.0.2\install\0CE0CF4\lcms-5.0.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI1815.tmp			Jump to dropped file
Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	File created: C:\Users\user\AppData\Local\Temp\shi7515.tmp			Jump to dropped file
Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	File created: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools 3.4.0.2\install\0CE0CF4\ssleay32.dll			Jump to dropped file
Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	File created: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools 3.4.0.2\install\0CE0CF4\plcd-player.exe			Jump to dropped file
Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	File created: C:\Users\user\AppData\Local\Temp\MSI76CC.tmp			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\System.Threading.Tasks.dll			Jump to dropped file
Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	File created: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools 3.4.0.2\install\decoder.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI16EB.tmp			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\SslCertBinding.Net.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI15F0.tmp			Jump to dropped file
Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	File created: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools 3.4.0.2\install\0CE0CF4\ICSharpCode.SharpZipLib.dll			Jump to dropped file
Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	File created: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools 3.4.0.2\install\0CE0CF4\System.Threading.Tasks.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\ICSharpCode.SharpZipLib.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\Delimon.Win32.IO.dll			Jump to dropped file
Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	File created: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools 3.4.0.2\install\0CE0CF4\Microsoft.Azure.KeyVault.Core.dll			Jump to dropped file
Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	File created: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools 3.4.0.2\install\0CE0CF4\Delimon.Win32.IO.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\lcms-5.0.dll			Jump to dropped file
Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	File created: C:\Users\user\AppData\Local\Temp\MSI79F9.tmp			Jump to dropped file

Drops PE files to the windows directory (C:\Windows)

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI16EB.tmp			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI11D7.tmp			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI193F.tmp			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI15F0.tmp			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI1488.tmp			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI1815.tmp			Jump to dropped file

Creates license or readme file

Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	File created: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools 3.4.0.2\install\0CE0CF4\CrashRpt License.txt			Jump to behavior
Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	File created: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools 3.4.0.2\install\0CE0CF4\License.txt			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\License.txt			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\CrashRpt License.txt			Jump to behavior

Hooking and other Techniques for Hiding and Protection:

Yara detected Ursnif

Source: Yara match	File source: 00000009.00000003.913796145.0000000003E68000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.913762032.0000000003E68000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.913941910.0000000003E68000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.937726154.0000000003E68000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.913912827.0000000003E68000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.914001553.0000000003E68000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.913978289.0000000003E68000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.913841738.0000000003E68000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.913966024.0000000003E68000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: plcd-player.exe PID: 4744, type: MEMORYSTR
Source: Yara match	File source: 9.2.plcd-player.exe.39494a0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.plcd-player.exe.39494a0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.plcd-player.exe.1270000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.937676135.0000000003949000.00000004.00000040.sdmp, type: MEMORY

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Source: C:\Users\user\Desktop\o4c8AUtX1g.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Disables application error messsages (SetErrorMode)

Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\plcd-player.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\plcd-player.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\plcd-player.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\plcd-player.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\plcd-player.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\plcd-player.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\plcd-player.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\plcd-player.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\plcd-player.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\plcd-player.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\plcd-player.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\plcd-player.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\plcd-player.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\plcd-player.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\plcd-player.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\plcd-player.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\plcd-player.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\plcd-player.exe	Process information set: NOGPFAULTERRORBOX			Jump to behavior

Malware Analysis System Evasion:

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Users\user\Desktop\o4c8AUtX1g.exe TID: 4660	Thread sleep time: -30000s >= -30000s			Jump to behavior
Source: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\plcd-player.exe TID: 6480	Thread sleep time: -30000s >= -30000s			Jump to behavior
Source: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\plcd-player.exe TID: 6424	Thread sleep time: -240000s >= -30000s			Jump to behavior
Source: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\plcd-player.exe TID: 4552	Thread sleep count: 42 > 30			Jump to behavior
Source: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\plcd-player.exe TID: 4552	Thread sleep count: 32 > 30			Jump to behavior
Source: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\plcd-player.exe TID: 4552	Thread sleep count: 32 > 30			Jump to behavior

Found dropped PE file which has not been started or loaded

Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools 3.4.0.2\install\0CE0CF4\icuio58.dll			Jump to dropped file
Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools 3.4.0.2\install\0CE0CF4\libeay32.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI15F0.tmp			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\SslCertBinding.Net.dll			Jump to dropped file
Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools 3.4.0.2\install\0CE0CF4\System.Threading.Tasks.dll			Jump to dropped file
Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools 3.4.0.2\install\0CE0CF4\ICSharpCode.SharpZipLib.dll			Jump to dropped file
Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools 3.4.0.2\install\0CE0CF4\AWSSDK.SimpleDB.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\Microsoft.Azure.KeyVault.Core.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI1488.tmp			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\libeay32.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\AWSSDK.SimpleDB.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\ssleay32.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\ICSharpCode.SharpZipLib.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\Delimon.Win32.IO.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\icuio58.dll			Jump to dropped file
Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools 3.4.0.2\install\0CE0CF4\Microsoft.Azure.KeyVault.Core.dll			Jump to dropped file
Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools 3.4.0.2\install\0CE0CF4\SslCertBinding.Net.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI1815.tmp			Jump to dropped file
Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools 3.4.0.2\install\0CE0CF4\ssleay32.dll			Jump to dropped file
Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\shi7515.tmp			Jump to dropped file
Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools 3.4.0.2\install\0CE0CF4\Delimon.Win32.IO.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\System.Threading.Tasks.dll			Jump to dropped file

Contains long sleeps (>= 3 min)

Source: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\plcd-player.exe

Thread delayed: delay time: 240000

Jump to behavior

Queries a list of all running processes

Source: C:\Windows\System32\msiexec.exe

Process information queried: ProcessInformation

Jump to behavior

Contains functionality to enumerate / list files inside a directory

Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	Code function: 1_2_01342910 FindFirstFileW,FindClose,		1_2_01342910
Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	Code function: 1_2_01345B80 FindFirstFileW,FindClose,CloseHandle,CloseHandle,CloseHandle,CreateEventW,CreateThread,WaitForSingleObject,GetExitCodeThread,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,		1_2_01345B80
Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	Code function: 1_2_01346A30 FindFirstFileW,FindClose,		1_2_01346A30
Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	Code function: 1_2_013294D0 FindFirstFileW,GetLastError,FindClose,		1_2_013294D0
Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	Code function: 1_2_012A8740 FindClose,PathIsUNCW,FindFirstFileW,GetFullPathNameW,GetFullPathNameW,FindClose,SetLastError,PathIsUNCW,		1_2_012A8740
Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	Code function: 1_2_013529C0 FindFirstFileW,FindClose,		1_2_013529C0
Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	Code function: 1_2_013640F0 FindFirstFileW,FindNextFileW,FindFirstFileW,FindNextFileW,FindNextFileW,FindClose,		1_2_013640F0
Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	Code function: 1_2_01328B70 FindFirstFileW,FindFirstFileW,FindFirstFileW,FindClose,FindClose,		1_2_01328B70

Contains medium sleeps (>= 30s)

Source: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\plcd-player.exe	Thread delayed: delay time: 30000			Jump to behavior
Source: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\plcd-player.exe	Thread delayed: delay time: 240000			Jump to behavior

Checks the free space of harddrives

Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	File Volume queried: C:\Users\user\AppData\Roaming FullSizeInformation			Jump to behavior
Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	File Volume queried: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools 3.4.0.2\install FullSizeInformation			Jump to behavior
Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	File Volume queried: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools 3.4.0.2\install\0CE0CF4 FullSizeInformation			Jump to behavior
Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	File Volume queried: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools 3.4.0.2\install\0CE0CF4 FullSizeInformation			Jump to behavior
Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	File Volume queried: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools 3.4.0.2\install\0CE0CF4 FullSizeInformation			Jump to behavior
Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	File Volume queried: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools 3.4.0.2\install\0CE0CF4 FullSizeInformation			Jump to behavior
Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	File Volume queried: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools 3.4.0.2\install\0CE0CF4 FullSizeInformation			Jump to behavior
Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	File Volume queried: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools 3.4.0.2\install\0CE0CF4 FullSizeInformation			Jump to behavior
Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	File Volume queried: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools 3.4.0.2\install\0CE0CF4 FullSizeInformation			Jump to behavior
Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	File Volume queried: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools 3.4.0.2\install\0CE0CF4 FullSizeInformation			Jump to behavior
Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	File Volume queried: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools 3.4.0.2\install\0CE0CF4 FullSizeInformation			Jump to behavior
Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	File Volume queried: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools 3.4.0.2\install\0CE0CF4 FullSizeInformation			Jump to behavior
Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	File Volume queried: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools 3.4.0.2\install\0CE0CF4 FullSizeInformation			Jump to behavior
Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	File Volume queried: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools 3.4.0.2\install\0CE0CF4 FullSizeInformation			Jump to behavior
Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	File Volume queried: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools 3.4.0.2\install\0CE0CF4 FullSizeInformation			Jump to behavior
Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	File Volume queried: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools 3.4.0.2\install\0CE0CF4 FullSizeInformation			Jump to behavior
Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	File Volume queried: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools 3.4.0.2\install\0CE0CF4 FullSizeInformation			Jump to behavior
Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	File Volume queried: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools 3.4.0.2\install\0CE0CF4 FullSizeInformation			Jump to behavior
Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	File Volume queried: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools 3.4.0.2\install\0CE0CF4 FullSizeInformation			Jump to behavior
Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	File Volume queried: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools 3.4.0.2\install\0CE0CF4 FullSizeInformation			Jump to behavior
Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	File Volume queried: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools 3.4.0.2\install\0CE0CF4 FullSizeInformation			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior

May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)

Source: MSI79F9.tmp.1.dr

Binary or memory string: RegOpenKeyTransactedW::NetUserGetInfo() failed with error: \@invalid string_view positionVMware, Inc.VMware Virtual PlatformVMware7,1innotek GmbHVirtualBoxMicrosoft CorporationVirtual MachineVRTUALACRSYSA M IGetting system informationManufacturer [Model [BIOS [\\?\UNC\\\?\shim_clone%d.%d.%d.%dDllGetVersion[%!]%!ProgramFilesFolderCommonFilesFolderDesktopFolderAllUsersDesktopFolderAppDataFolderFavoritesFolderStartMenuFolderProgramMenuFolderStartupFolderFontsFolderLocalAppDataFolderCommonAppDataFolderProgramFiles64FolderProgramFilesProgramW6432SystemFolderSystem32FolderWindowsFolderWindowsVolumeTempFolderSETUPEXEDIRshfolder.dllSHGetFolderPathWProgramFilesAPPDATAPROGRAMFILES&+

Source: o4c8AUtX1g.exe, 00000001.00000002.723935810.0000000003B5A000.00000004.00000001.sdmp

Binary or memory string: Hyper-V RAW

Anti Debugging:

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Source: C:\Users\user\Desktop\o4c8AUtX1g.exe

Code function: 1_2_013C03A3 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

1_2_013C03A3

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Source: C:\Users\user\Desktop\o4c8AUtX1g.exe

Code function: 1_2_0135BAD0 CreateFileW,GetLastError,OutputDebugStringW,OutputDebugStringW,SetFilePointer,FlushFileBuffers,WriteFile,WriteFile,FlushFileBuffers,WriteFile,FlushFileBuffers,OutputDebugStringW,WriteFile,WriteFile,FlushFileBuffers,FlushFileBuffers,WriteFile,FlushFileBuffers,WriteFile,FlushFileBuffers,

1_2_0135BAD0

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\o4c8AUtX1g.exe

Code function: 1_2_01363D80 LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

1_2_01363D80

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Source: C:\Users\user\Desktop\o4c8AUtX1g.exe

Code function: 1_2_013B959D GetProcessHeap,HeapFree,InterlockedPushEntrySList,

1_2_013B959D

Contains functionality to read the PEB

Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	Code function: 1_2_013CB05F mov eax, dword ptr fs:[00000030h]		1_2_013CB05F
Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	Code function: 1_2_013B95CD mov esi, dword ptr fs:[00000030h]		1_2_013B95CD
Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	Code function: 1_2_013D5DCA mov eax, dword ptr fs:[00000030h]		1_2_013D5DCA
Source: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\plcd-player.exe	Code function: 9_2_6D855BE9 mov eax, dword ptr fs:[00000030h]		9_2_6D855BE9
Source: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\plcd-player.exe	Code function: 9_2_00C25B18 mov eax, dword ptr fs:[00000030h]		9_2_00C25B18
Source: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\plcd-player.exe	Code function: 9_2_00C36DDC mov eax, dword ptr fs:[00000030h]		9_2_00C36DDC
Source: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\plcd-player.exe	Code function: 9_2_00C6AC46 mov eax, dword ptr fs:[00000030h]		9_2_00C6AC46

Launches processes in debugging mode, may be used to hinder debugging

Source: C:\Windows\System32\msiexec.exe

Process created: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\plcd-player.exe C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\plcd-player.exe

Jump to behavior

Contains functionality to register its own exception handler

Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	Code function: 1_2_013C03A3 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		1_2_013C03A3
Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	Code function: 1_2_013BBE30 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		1_2_013BBE30
Source: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\plcd-player.exe	Code function: 9_2_6D837D41 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		9_2_6D837D41
Source: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\plcd-player.exe	Code function: 9_2_6D846FED IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		9_2_6D846FED
Source: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\plcd-player.exe	Code function: 9_2_00C29C76 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		9_2_00C29C76
Source: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\plcd-player.exe	Code function: 9_2_00C17C2C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		9_2_00C17C2C

HIPS / PFW / Operating System Protection Evasion:

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	Process created: C:\Windows\SysWOW64\msiexec.exe 'C:\Windows\system32\msiexec.exe' /i 'C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools 3.4.0.2\install\0CE0CF4\adv.msi' AI_SETUPEXEPATH=C:\Users\user\Desktop\o4c8AUtX1g.exe SETUPEXEDIR=C:\Users\user\Desktop\ EXE_CMD_LINE='/exenoupdates /forcecleanup /wintime 1635154532 ' AI_EUIMSI=''
Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	Process created: C:\Windows\SysWOW64\msiexec.exe 'C:\Windows\system32\msiexec.exe' /i 'C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools 3.4.0.2\install\0CE0CF4\adv.msi' AI_SETUPEXEPATH=C:\Users\user\Desktop\o4c8AUtX1g.exe SETUPEXEDIR=C:\Users\user\Desktop\ EXE_CMD_LINE='/exenoupdates /forcecleanup /wintime 1635154532 ' AI_EUIMSI=''			Jump to behavior

Contains functionality to create a new security descriptor

Source: C:\Users\user\Desktop\o4c8AUtX1g.exe

Code function: 1_2_01352DA0 GetCurrentProcess,OpenProcessToken,GetLastError,GetTokenInformation,GetTokenInformation,GetLastError,GetTokenInformation,AllocateAndInitializeSid,EqualSid,FreeSid,GetLastError,FindCloseChangeNotification,

1_2_01352DA0

May try to detect the Windows Explorer process (often used for injection)

Source: plcd-player.exe, 00000009.00000002.937406953.00000000019F0000.00000002.00020000.sdmp	Binary or memory string: Program Manager
Source: plcd-player.exe, 00000009.00000002.937406953.00000000019F0000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: plcd-player.exe, 00000009.00000002.937406953.00000000019F0000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: plcd-player.exe, 00000009.00000002.937406953.00000000019F0000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

Queries the volume information (name, serial number etc) of a device

Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Contains functionality to query locales information (e.g. system language)

Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	Code function: GetLocaleInfoW,		1_2_013CE806
Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,		1_2_013D2878
Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	Code function: GetACP,IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,		1_2_013D20EC
Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	Code function: EnumSystemLocalesW,		1_2_013D238E
Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	Code function: EnumSystemLocalesW,		1_2_013D23D9
Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,		1_2_013D2A4D
Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	Code function: EnumSystemLocalesW,		1_2_013CE28D
Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	Code function: EnumSystemLocalesW,		1_2_013D2474
Source: C:\Users\user\Desktop\o4c8AUtX1g.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,RegCloseKey,		1_2_013487A0
Source: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\plcd-player.exe	Code function: GetACP,IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,		9_2_00C3E1C8
Source: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\plcd-player.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,		9_2_00C3E954
Source: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\plcd-player.exe	Code function: GetLocaleInfoW,		9_2_00C36AC1
Source: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\plcd-player.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,		9_2_00C3EB29
Source: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\plcd-player.exe	Code function: EnumSystemLocalesW,		9_2_00C3E4B5
Source: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\plcd-player.exe	Code function: EnumSystemLocalesW,		9_2_00C3E46A
Source: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\plcd-player.exe	Code function: EnumSystemLocalesW,		9_2_00C3E550
Source: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\plcd-player.exe	Code function: EnumSystemLocalesW,		9_2_00C3655F

Contains functionality to query CPU information (cpuid)

Source: C:\Users\user\Desktop\o4c8AUtX1g.exe

Code function: 1_2_013BB9A6 cpuid

1_2_013BB9A6

Queries the cryptographic machine GUID

Source: C:\Users\user\Desktop\o4c8AUtX1g.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Contains functionality to create pipes for IPC

Source: C:\Users\user\Desktop\o4c8AUtX1g.exe

Code function: 1_2_0135FEF0 CreateNamedPipeW,CreateFileW,

1_2_0135FEF0

Contains functionality to query local / system time

Source: C:\Users\user\Desktop\o4c8AUtX1g.exe

Code function: 1_2_0135B9F0 GetLocalTime,

1_2_0135B9F0

Contains functionality to query windows version

Source: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\plcd-player.exe

Code function: 9_2_00A71752 CreateEventA,GetVersion,GetCurrentProcessId,OpenProcess,GetLastError,

9_2_00A71752

Stealing of Sensitive Information:

Yara detected Ursnif

Source: Yara match	File source: 00000009.00000003.913796145.0000000003E68000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.913762032.0000000003E68000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.913941910.0000000003E68000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.937726154.0000000003E68000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.913912827.0000000003E68000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.914001553.0000000003E68000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.913978289.0000000003E68000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.913841738.0000000003E68000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.913966024.0000000003E68000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: plcd-player.exe PID: 4744, type: MEMORYSTR
Source: Yara match	File source: 9.2.plcd-player.exe.39494a0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.plcd-player.exe.39494a0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.plcd-player.exe.1270000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.937676135.0000000003949000.00000004.00000040.sdmp, type: MEMORY

Remote Access Functionality:

Yara detected Ursnif

Source: Yara match	File source: 00000009.00000003.913796145.0000000003E68000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.913762032.0000000003E68000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.913941910.0000000003E68000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.937726154.0000000003E68000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.913912827.0000000003E68000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.914001553.0000000003E68000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.913978289.0000000003E68000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.913841738.0000000003E68000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.913966024.0000000003E68000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: plcd-player.exe PID: 4744, type: MEMORYSTR
Source: Yara match	File source: 9.2.plcd-player.exe.39494a0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.plcd-player.exe.39494a0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.plcd-player.exe.1270000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.937676135.0000000003949000.00000004.00000040.sdmp, type: MEMORY

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Source: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\plcd-player.exe	Code function: 9_2_00A910D0 WSAIoctl,bind,PostQueuedCompletionStatus,RtlEnterCriticalSection,RtlLeaveCriticalSection,WSAGetLastError,ioctlsocket,connect,		9_2_00A910D0
Source: C:\Users\user\AppData\Roaming\JDesktop Integration Components (JDIC) Project\JDesktop Tools\plcd-player.exe	Code function: 9_2_00A8F6D0 WSASocketW,setsockopt,bind,getsockname,listen,WSASocketW,connect,accept,ioctlsocket,setsockopt,ioctlsocket,setsockopt,		9_2_00A8F6D0