Windows Analysis Report
INV_0893.exe

Overview

General Information

Sample Name: INV_0893.exe
Analysis ID: 715068
MD5: d23e1e317d68720216699e1c9e524a78
SHA1: 76b58185f5aa824e5bafc589aaa6c228b341b239
SHA256: 8dda840eccb53427037b3a06dd5f886c78e6e55fe69d96b256b05176e85172db
Tags: exeJustClickAm-com
Infos:

Detection

Score: 84
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Multi AV Scanner detection for submitted file
Antivirus / Scanner detection for submitted sample
Yara detected AntiVM autoit script
Antivirus detection for dropped file
Multi AV Scanner detection for dropped file
Drops PE files with a suspicious file extension
Uses 32bit PE files
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to query locales information (e.g. system language)
May sleep (evasive loops) to hinder dynamic analysis
Contains functionality to shutdown / reboot the system
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Contains functionality to query CPU information (cpuid)
Found potential string decryption / allocating functions
Contains functionality to launch a process as a different user
Sample execution stops while process was sleeping (likely an evasion)
Contains functionality to communicate with device drivers
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to dynamically determine API calls
Contains functionality to read the clipboard data
Found dropped PE file which has not been started or loaded
Contains functionality to simulate keystroke presses
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Sample file is different than original file name gathered from version info
OS version to string mapping found (often used in BOTs)
Drops PE files
Tries to load missing DLLs
Contains functionality to read the PEB
File is packed with WinRar
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to launch a program with higher privileges
Potential key logger detected (key state polling based)
Contains functionality to retrieve information about pressed keystrokes
Dropped file seen in connection with other malware
Found large amount of non-executed APIs
Creates a process in suspended mode (likely to inject code)
Contains functionality to simulate mouse events
Found WSH timer for Javascript or VBS script (likely evasive script)
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Contains functionality for read data from the clipboard

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: INV_0893.exe ReversingLabs: Detection: 68%
Source: INV_0893.exe Virustotal: Detection: 65% Perma Link
Antivirus / Scanner detection for submitted sample
Source: INV_0893.exe Avira: detected
Antivirus detection for dropped file
Source: C:\Users\user\1_102\uvbdlqfvw.pif Avira: detection malicious, Label: TR/Redcap.qnaqq
Multi AV Scanner detection for dropped file
Source: C:\Users\user\1_102\uvbdlqfvw.pif ReversingLabs: Detection: 84%
Source: C:\Users\user\1_102\uvbdlqfvw.pif Metadefender: Detection: 38% Perma Link
Uses 32bit PE files
Source: INV_0893.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: INV_0893.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: INV_0893.exe
Source: Binary string: RegSvcs.pdb, source: uvbdlqfvw.pif, 00000017.00000002.577019533.0000000001798000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: RegSvcs.pdb source: uvbdlqfvw.pif, 00000017.00000002.577019533.0000000001798000.00000004.00000020.00020000.00000000.sdmp
Source: C:\Users\user\Desktop\INV_0893.exe Code function: 0_2_0112A2DF FindFirstFileW,FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError, 0_2_0112A2DF
Source: C:\Users\user\Desktop\INV_0893.exe Code function: 0_2_0113AFB9 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW, 0_2_0113AFB9
Source: C:\Users\user\Desktop\INV_0893.exe Code function: 0_2_01149FD3 FindFirstFileExA, 0_2_01149FD3
Source: C:\Users\user\1_102\uvbdlqfvw.pif Code function: 3_2_0112399B GetFileAttributesW,FindFirstFileW,FindClose, 3_2_0112399B
Source: C:\Users\user\1_102\uvbdlqfvw.pif Code function: 3_2_01142408 FindFirstFileW,Sleep,FindNextFileW,FindClose, 3_2_01142408
Source: C:\Users\user\1_102\uvbdlqfvw.pif Code function: 3_2_0113280D FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, 3_2_0113280D
Source: C:\Users\user\1_102\uvbdlqfvw.pif Code function: 3_2_01168877 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf, 3_2_01168877
Source: C:\Users\user\1_102\uvbdlqfvw.pif Code function: 3_2_01121A73 FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, 3_2_01121A73
Source: C:\Users\user\1_102\uvbdlqfvw.pif Code function: 3_2_0114CAE7 FindFirstFileW,FindNextFileW,FindClose, 3_2_0114CAE7
Source: INV_0893.exe, 00000000.00000003.336111482.000000000499C000.00000004.00000800.00020000.00000000.sdmp, uvbdlqfvw.pif.0.dr String found in binary or memory: http://crl.globalsign.net/ObjectSign.crl0
Source: INV_0893.exe, 00000000.00000003.336111482.000000000499C000.00000004.00000800.00020000.00000000.sdmp, uvbdlqfvw.pif.0.dr String found in binary or memory: http://crl.globalsign.net/Root.crl0
Source: INV_0893.exe, 00000000.00000003.336111482.000000000499C000.00000004.00000800.00020000.00000000.sdmp, uvbdlqfvw.pif.0.dr String found in binary or memory: http://crl.globalsign.net/Timestamping1.crl0
Source: INV_0893.exe, 00000000.00000003.336111482.000000000499C000.00000004.00000800.00020000.00000000.sdmp, uvbdlqfvw.pif.0.dr String found in binary or memory: http://crl.globalsign.net/primobject.crl0N
Source: INV_0893.exe, 00000000.00000003.336111482.000000000499C000.00000004.00000800.00020000.00000000.sdmp, uvbdlqfvw.pif.0.dr String found in binary or memory: http://crl.globalsign.net/root.crl0
Source: INV_0893.exe, 00000000.00000003.336111482.000000000499C000.00000004.00000800.00020000.00000000.sdmp, uvbdlqfvw.pif.0.dr String found in binary or memory: http://secure.globalsign.net/cacert/ObjectSign.crt09
Source: INV_0893.exe, 00000000.00000003.336111482.000000000499C000.00000004.00000800.00020000.00000000.sdmp, uvbdlqfvw.pif.0.dr String found in binary or memory: http://secure.globalsign.net/cacert/PrimObject.crt0
Source: INV_0893.exe, 00000000.00000003.336111482.000000000499C000.00000004.00000800.00020000.00000000.sdmp, uvbdlqfvw.pif.0.dr String found in binary or memory: http://www.autoitscript.com/autoit3/0
Source: INV_0893.exe, 00000000.00000003.336111482.000000000499C000.00000004.00000800.00020000.00000000.sdmp, uvbdlqfvw.pif.0.dr String found in binary or memory: http://www.globalsign.net/repository/0
Source: INV_0893.exe, 00000000.00000003.336111482.000000000499C000.00000004.00000800.00020000.00000000.sdmp, uvbdlqfvw.pif.0.dr String found in binary or memory: http://www.globalsign.net/repository/03
Source: INV_0893.exe, 00000000.00000003.336111482.000000000499C000.00000004.00000800.00020000.00000000.sdmp, uvbdlqfvw.pif.0.dr String found in binary or memory: http://www.globalsign.net/repository09
Source: C:\Users\user\1_102\uvbdlqfvw.pif Code function: 3_2_01132361 InternetReadFile, 3_2_01132361
Contains functionality to read the clipboard data
Source: C:\Users\user\1_102\uvbdlqfvw.pif Code function: 3_2_0115D8E9 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard, 3_2_0115D8E9
Potential key logger detected (key state polling based)
Source: C:\Users\user\1_102\uvbdlqfvw.pif Code function: 3_2_0116C7D6 SendMessageW,DefDlgProcW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,GetWindowLongW,SendMessageW,SendMessageW,SendMessageW,_wcsncpy,SendMessageW,SendMessageW,SendMessageW,InvalidateRect,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW, 3_2_0116C7D6
Contains functionality to retrieve information about pressed keystrokes
Source: C:\Users\user\1_102\uvbdlqfvw.pif Code function: 3_2_01146308 GetCursorPos,ScreenToClient,GetAsyncKeyState,GetAsyncKeyState,GetWindowLongW, 3_2_01146308
Contains functionality for read data from the clipboard
Source: C:\Users\user\1_102\uvbdlqfvw.pif Code function: 3_2_0114A0FC OpenClipboard,EmptyClipboard,CloseClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard, 3_2_0114A0FC
Uses 32bit PE files
Source: INV_0893.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Contains functionality to shutdown / reboot the system
Source: C:\Users\user\1_102\uvbdlqfvw.pif Code function: 3_2_011233A3 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,SetSystemPowerState, 3_2_011233A3
Detected potential crypto function
Source: C:\Users\user\Desktop\INV_0893.exe Code function: 0_2_011283C0 0_2_011283C0
Source: C:\Users\user\Desktop\INV_0893.exe Code function: 0_2_0113626D 0_2_0113626D
Source: C:\Users\user\Desktop\INV_0893.exe Code function: 0_2_01140113 0_2_01140113
Source: C:\Users\user\Desktop\INV_0893.exe Code function: 0_2_0114C0B0 0_2_0114C0B0
Source: C:\Users\user\Desktop\INV_0893.exe Code function: 0_2_011230FC 0_2_011230FC
Source: C:\Users\user\Desktop\INV_0893.exe Code function: 0_2_011333D3 0_2_011333D3
Source: C:\Users\user\Desktop\INV_0893.exe Code function: 0_2_0113F3CA 0_2_0113F3CA
Source: C:\Users\user\Desktop\INV_0893.exe Code function: 0_2_0112E510 0_2_0112E510
Source: C:\Users\user\Desktop\INV_0893.exe Code function: 0_2_0114C55E 0_2_0114C55E
Source: C:\Users\user\Desktop\INV_0893.exe Code function: 0_2_01140548 0_2_01140548
Source: C:\Users\user\Desktop\INV_0893.exe Code function: 0_2_0112F5C5 0_2_0112F5C5
Source: C:\Users\user\Desktop\INV_0893.exe Code function: 0_2_01150654 0_2_01150654
Source: C:\Users\user\Desktop\INV_0893.exe Code function: 0_2_0113364E 0_2_0113364E
Source: C:\Users\user\Desktop\INV_0893.exe Code function: 0_2_01122692 0_2_01122692
Source: C:\Users\user\Desktop\INV_0893.exe Code function: 0_2_011366A2 0_2_011366A2
Source: C:\Users\user\Desktop\INV_0893.exe Code function: 0_2_0112E973 0_2_0112E973
Source: C:\Users\user\Desktop\INV_0893.exe Code function: 0_2_0113397F 0_2_0113397F
Source: C:\Users\user\Desktop\INV_0893.exe Code function: 0_2_0113589E 0_2_0113589E
Source: C:\Users\user\Desktop\INV_0893.exe Code function: 0_2_0113F8C6 0_2_0113F8C6
Source: C:\Users\user\Desktop\INV_0893.exe Code function: 0_2_0112BAD1 0_2_0112BAD1
Source: C:\Users\user\Desktop\INV_0893.exe Code function: 0_2_0112DADD 0_2_0112DADD
Source: C:\Users\user\Desktop\INV_0893.exe Code function: 0_2_01125D7E 0_2_01125D7E
Source: C:\Users\user\Desktop\INV_0893.exe Code function: 0_2_01143CBA 0_2_01143CBA
Source: C:\Users\user\Desktop\INV_0893.exe Code function: 0_2_01136CDB 0_2_01136CDB
Source: C:\Users\user\Desktop\INV_0893.exe Code function: 0_2_0113FCDE 0_2_0113FCDE
Source: C:\Users\user\Desktop\INV_0893.exe Code function: 0_2_0112DF12 0_2_0112DF12
Source: C:\Users\user\Desktop\INV_0893.exe Code function: 0_2_01123EAD 0_2_01123EAD
Source: C:\Users\user\Desktop\INV_0893.exe Code function: 0_2_01143EE9 0_2_01143EE9
Source: C:\Users\user\1_102\uvbdlqfvw.pif Code function: 3_2_010F35F0 3_2_010F35F0
Source: C:\Users\user\1_102\uvbdlqfvw.pif Code function: 3_2_010F98F0 3_2_010F98F0
Source: C:\Users\user\1_102\uvbdlqfvw.pif Code function: 3_2_01102136 3_2_01102136
Source: C:\Users\user\1_102\uvbdlqfvw.pif Code function: 3_2_0110A137 3_2_0110A137
Source: C:\Users\user\1_102\uvbdlqfvw.pif Code function: 3_2_0113F3A6 3_2_0113F3A6
Source: C:\Users\user\1_102\uvbdlqfvw.pif Code function: 3_2_0111427D 3_2_0111427D
Source: C:\Users\user\1_102\uvbdlqfvw.pif Code function: 3_2_01102508 3_2_01102508
Source: C:\Users\user\1_102\uvbdlqfvw.pif Code function: 3_2_0113655F 3_2_0113655F
Source: C:\Users\user\1_102\uvbdlqfvw.pif Code function: 3_2_010F98F0 3_2_010F98F0
Source: C:\Users\user\1_102\uvbdlqfvw.pif Code function: 3_2_01103721 3_2_01103721
Source: C:\Users\user\1_102\uvbdlqfvw.pif Code function: 3_2_010FF730 3_2_010FF730
Source: C:\Users\user\1_102\uvbdlqfvw.pif Code function: 3_2_01101903 3_2_01101903
Source: C:\Users\user\1_102\uvbdlqfvw.pif Code function: 3_2_0111088F 3_2_0111088F
Source: C:\Users\user\1_102\uvbdlqfvw.pif Code function: 3_2_0110C8CE 3_2_0110C8CE
Source: C:\Users\user\1_102\uvbdlqfvw.pif Code function: 3_2_011028F0 3_2_011028F0
Source: C:\Users\user\1_102\uvbdlqfvw.pif Code function: 3_2_01113BA1 3_2_01113BA1
Source: C:\Users\user\1_102\uvbdlqfvw.pif Code function: 3_2_0116EA2B 3_2_0116EA2B
Source: C:\Users\user\1_102\uvbdlqfvw.pif Code function: 3_2_0113EAD5 3_2_0113EAD5
Found potential string decryption / allocating functions
Source: C:\Users\user\Desktop\INV_0893.exe Code function: String function: 0113D870 appears 35 times
Source: C:\Users\user\Desktop\INV_0893.exe Code function: String function: 0113E2F0 appears 31 times
Source: C:\Users\user\Desktop\INV_0893.exe Code function: String function: 0113D940 appears 51 times
Source: C:\Users\user\1_102\uvbdlqfvw.pif Code function: String function: 011014F7 appears 36 times
Source: C:\Users\user\1_102\uvbdlqfvw.pif Code function: String function: 011359E6 appears 38 times
Source: C:\Users\user\1_102\uvbdlqfvw.pif Code function: String function: 01106B90 appears 33 times
Contains functionality to launch a process as a different user
Source: C:\Users\user\1_102\uvbdlqfvw.pif Code function: 3_2_01136219 DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,_wcsncpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock, 3_2_01136219
Contains functionality to communicate with device drivers
Source: C:\Users\user\Desktop\INV_0893.exe Code function: 0_2_01126FC6: __EH_prolog,CreateFileW,CloseHandle,CreateDirectoryW,CreateFileW,DeviceIoControl,CloseHandle,GetLastError,RemoveDirectoryW,DeleteFileW, 0_2_01126FC6
Sample file is different than original file name gathered from version info
Source: INV_0893.exe, 00000000.00000003.336111482.000000000499C000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameMSEInstall.exeT4 vs INV_0893.exe
Tries to load missing DLLs
Source: C:\Users\user\Desktop\INV_0893.exe Section loaded: <pi-ms-win-core-synch-l1-2-0.dll Jump to behavior
Source: C:\Users\user\Desktop\INV_0893.exe Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll Jump to behavior
Source: C:\Users\user\Desktop\INV_0893.exe Section loaded: <pi-ms-win-core-synch-l1-2-0.dll Jump to behavior
Source: C:\Users\user\Desktop\INV_0893.exe Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll Jump to behavior
Source: C:\Users\user\Desktop\INV_0893.exe Section loaded: <pi-ms-win-core-localization-l1-2-1.dll Jump to behavior
Source: C:\Users\user\Desktop\INV_0893.exe Section loaded: dxgidebug.dll Jump to behavior
Dropped file seen in connection with other malware
Source: Joe Sandbox View Dropped File: C:\Users\user\1_102\uvbdlqfvw.pif F99B9FC041C177F0BEE2C82D09F451EF0833696111B1B37CBFFF8C975232ECE2
Source: Joe Sandbox View Dropped File: C:\Users\user\AppData\Local\Temp\RegSvcs.exe 43026DCFF238F20CFF0419924486DEE45178119CFDD0D366B79D67D950A9BF50
Source: INV_0893.exe ReversingLabs: Detection: 68%
Source: INV_0893.exe Virustotal: Detection: 65%
Source: C:\Users\user\Desktop\INV_0893.exe File read: C:\Users\user\Desktop\INV_0893.exe Jump to behavior
Source: INV_0893.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\INV_0893.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\INV_0893.exe C:\Users\user\Desktop\INV_0893.exe
Source: C:\Users\user\Desktop\INV_0893.exe Process created: C:\Users\user\1_102\uvbdlqfvw.pif "C:\Users\user\1_102\uvbdlqfvw.pif" faeupdrjbw.afr
Source: C:\Users\user\1_102\uvbdlqfvw.pif Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\1_102\run.vbs"
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Users\user\1_102\uvbdlqfvw.pif "C:\Users\user\1_102\UVBDLQ~1.PIF" FAEUPD~1.AFR
Source: unknown Process created: C:\Users\user\1_102\uvbdlqfvw.pif "C:\Users\user\1_102\UVBDLQ~1.PIF" C:\Users\user\1_102\FAEUPD~1.AFR
Source: C:\Users\user\1_102\uvbdlqfvw.pif Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\1_102\run.vbs"
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Users\user\1_102\uvbdlqfvw.pif "C:\Users\user\1_102\UVBDLQ~1.PIF" FAEUPD~1.AFR
Source: C:\Users\user\1_102\uvbdlqfvw.pif Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\1_102\run.vbs"
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Users\user\1_102\uvbdlqfvw.pif "C:\Users\user\1_102\UVBDLQ~1.PIF" FAEUPD~1.AFR
Source: unknown Process created: C:\Users\user\1_102\uvbdlqfvw.pif "C:\Users\user\1_102\UVBDLQ~1.PIF" C:\Users\user\1_102\FAEUPD~1.AFR
Source: unknown Process created: C:\Users\user\1_102\uvbdlqfvw.pif "C:\Users\user\1_102\UVBDLQ~1.PIF" C:\Users\user\1_102\FAEUPD~1.AFR
Source: C:\Users\user\1_102\uvbdlqfvw.pif Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\1_102\run.vbs"
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Users\user\1_102\uvbdlqfvw.pif "C:\Users\user\1_102\UVBDLQ~1.PIF" FAEUPD~1.AFR
Source: C:\Users\user\1_102\uvbdlqfvw.pif Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\1_102\run.vbs"
Source: C:\Users\user\1_102\uvbdlqfvw.pif Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\1_102\run.vbs"
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Users\user\1_102\uvbdlqfvw.pif "C:\Users\user\1_102\UVBDLQ~1.PIF" FAEUPD~1.AFR
Source: C:\Users\user\1_102\uvbdlqfvw.pif Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\1_102\run.vbs"
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Users\user\1_102\uvbdlqfvw.pif "C:\Users\user\1_102\UVBDLQ~1.PIF" FAEUPD~1.AFR
Source: C:\Users\user\1_102\uvbdlqfvw.pif Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\1_102\run.vbs"
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Users\user\1_102\uvbdlqfvw.pif "C:\Users\user\1_102\UVBDLQ~1.PIF" FAEUPD~1.AFR
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Users\user\1_102\uvbdlqfvw.pif "C:\Users\user\1_102\UVBDLQ~1.PIF" FAEUPD~1.AFR
Source: C:\Users\user\1_102\uvbdlqfvw.pif Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\1_102\run.vbs"
Source: C:\Users\user\Desktop\INV_0893.exe Process created: C:\Users\user\1_102\uvbdlqfvw.pif "C:\Users\user\1_102\uvbdlqfvw.pif" faeupdrjbw.afr Jump to behavior
Source: C:\Users\user\1_102\uvbdlqfvw.pif Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\1_102\run.vbs" Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Users\user\1_102\uvbdlqfvw.pif "C:\Users\user\1_102\UVBDLQ~1.PIF" FAEUPD~1.AFR Jump to behavior
Source: C:\Users\user\1_102\uvbdlqfvw.pif Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\1_102\run.vbs" Jump to behavior
Source: C:\Users\user\1_102\uvbdlqfvw.pif Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\1_102\run.vbs" Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Users\user\1_102\uvbdlqfvw.pif "C:\Users\user\1_102\UVBDLQ~1.PIF" FAEUPD~1.AFR Jump to behavior
Source: C:\Users\user\1_102\uvbdlqfvw.pif Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\1_102\run.vbs"
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Users\user\1_102\uvbdlqfvw.pif "C:\Users\user\1_102\UVBDLQ~1.PIF" FAEUPD~1.AFR
Source: C:\Users\user\1_102\uvbdlqfvw.pif Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\1_102\run.vbs"
Source: C:\Users\user\1_102\uvbdlqfvw.pif Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\1_102\run.vbs"
Source: C:\Users\user\1_102\uvbdlqfvw.pif Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\1_102\run.vbs"
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Users\user\1_102\uvbdlqfvw.pif "C:\Users\user\1_102\UVBDLQ~1.PIF" FAEUPD~1.AFR
Source: C:\Users\user\1_102\uvbdlqfvw.pif Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\1_102\run.vbs"
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Users\user\1_102\uvbdlqfvw.pif "C:\Users\user\1_102\UVBDLQ~1.PIF" FAEUPD~1.AFR
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Users\user\1_102\uvbdlqfvw.pif "C:\Users\user\1_102\UVBDLQ~1.PIF" FAEUPD~1.AFR
Source: C:\Users\user\1_102\uvbdlqfvw.pif Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\1_102\run.vbs"
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Users\user\1_102\uvbdlqfvw.pif "C:\Users\user\1_102\UVBDLQ~1.PIF" FAEUPD~1.AFR
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Users\user\1_102\uvbdlqfvw.pif "C:\Users\user\1_102\UVBDLQ~1.PIF" FAEUPD~1.AFR
Source: C:\Users\user\Desktop\INV_0893.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32 Jump to behavior
Source: C:\Users\user\1_102\uvbdlqfvw.pif Code function: 3_2_011233A3 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,SetSystemPowerState, 3_2_011233A3
Source: C:\Users\user\1_102\uvbdlqfvw.pif Code function: 3_2_01154AEB OpenProcess,GetLastError,GetLastError,GetCurrentThread,OpenThreadToken,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,AdjustTokenPrivileges,GetLastError,OpenProcess,AdjustTokenPrivileges,CloseHandle,TerminateProcess,GetLastError,CloseHandle, 3_2_01154AEB
Source: C:\Users\user\Desktop\INV_0893.exe File created: C:\Users\user\1_102 Jump to behavior
Source: C:\Users\user\1_102\uvbdlqfvw.pif File created: C:\Users\user\temp\qdmmn.ppt Jump to behavior
Source: classification engine Classification label: mal84.evad.winEXE@40/60@0/1
Source: C:\Users\user\1_102\uvbdlqfvw.pif Code function: 3_2_0115E0F6 CoInitialize,CoCreateInstance,CoUninitialize, 3_2_0115E0F6
Source: C:\Users\user\Desktop\INV_0893.exe File read: C:\Windows\win.ini Jump to behavior
Source: C:\Users\user\1_102\uvbdlqfvw.pif Code function: 3_2_0114D766 SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode, 3_2_0114D766
Source: C:\Users\user\Desktop\INV_0893.exe Code function: 0_2_01126D06 GetLastError,FormatMessageW, 0_2_01126D06
Source: C:\Users\user\1_102\uvbdlqfvw.pif Code function: 3_2_01123EC5 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,__wsplitpath,_wcscat,__wcsicoll,FindCloseChangeNotification, 3_2_01123EC5
Source: C:\Users\user\Desktop\INV_0893.exe Code function: 0_2_0113963A FindResourceW,DeleteObject,SizeofResource,LoadResource,LockResource,GlobalAlloc,GlobalLock,GdipCreateHBITMAPFromBitmap,GlobalUnlock,GlobalFree, 0_2_0113963A
Source: C:\Users\user\1_102\uvbdlqfvw.pif Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\1_102\run.vbs"
Source: C:\Users\user\Desktop\INV_0893.exe Command line argument: sfxname 0_2_0113CBB8
Source: C:\Users\user\Desktop\INV_0893.exe Command line argument: sfxstime 0_2_0113CBB8
Source: C:\Users\user\Desktop\INV_0893.exe Command line argument: STARTDLG 0_2_0113CBB8
Source: C:\Users\user\Desktop\INV_0893.exe File written: C:\Users\user\1_102\xfsxuexxqf.ini Jump to behavior
Source: INV_0893.exe Static file information: File size 1248871 > 1048576
Source: INV_0893.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: INV_0893.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: INV_0893.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: INV_0893.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: INV_0893.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: INV_0893.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: INV_0893.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: INV_0893.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: INV_0893.exe
Source: Binary string: RegSvcs.pdb, source: uvbdlqfvw.pif, 00000017.00000002.577019533.0000000001798000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: RegSvcs.pdb source: uvbdlqfvw.pif, 00000017.00000002.577019533.0000000001798000.00000004.00000020.00020000.00000000.sdmp
Source: INV_0893.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: INV_0893.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: INV_0893.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: INV_0893.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: INV_0893.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\INV_0893.exe Code function: 0_2_0113E336 push ecx; ret 0_2_0113E349
Source: C:\Users\user\Desktop\INV_0893.exe Code function: 0_2_0113D870 push eax; ret 0_2_0113D88E
Source: C:\Users\user\1_102\uvbdlqfvw.pif Code function: 3_2_0111D53C push 740111CFh; iretd 3_2_0111D541
Source: C:\Users\user\1_102\uvbdlqfvw.pif Code function: 3_2_01106BD5 push ecx; ret 3_2_01106BE8
Contains functionality to dynamically determine API calls
Source: C:\Users\user\1_102\uvbdlqfvw.pif Code function: 3_2_010FEE30 LoadLibraryA,GetProcAddress, 3_2_010FEE30
File is packed with WinRar
Source: C:\Users\user\Desktop\INV_0893.exe File created: C:\Users\user\1_102\__tmp_rar_sfx_access_check_3848296 Jump to behavior

Persistence and Installation Behavior
barindex
Drops PE files with a suspicious file extension
Source: C:\Users\user\Desktop\INV_0893.exe File created: C:\Users\user\1_102\uvbdlqfvw.pif Jump to dropped file
Drops PE files
Source: C:\Users\user\1_102\uvbdlqfvw.pif File created: C:\Users\user\AppData\Local\Temp\RegSvcs.exe Jump to dropped file
Source: C:\Users\user\Desktop\INV_0893.exe File created: C:\Users\user\1_102\uvbdlqfvw.pif Jump to dropped file
Source: C:\Users\user\1_102\uvbdlqfvw.pif Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run WindowsUpdate Jump to behavior
Source: C:\Users\user\1_102\uvbdlqfvw.pif Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run WindowsUpdate Jump to behavior
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Source: C:\Users\user\1_102\uvbdlqfvw.pif Code function: 3_2_011243FF GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput, 3_2_011243FF
Source: C:\Users\user\1_102\uvbdlqfvw.pif Code function: 3_2_0116A2EA IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed, 3_2_0116A2EA
Source: C:\Users\user\Desktop\INV_0893.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\1_102\uvbdlqfvw.pif Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\1_102\uvbdlqfvw.pif Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\1_102\uvbdlqfvw.pif Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\1_102\uvbdlqfvw.pif Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\1_102\uvbdlqfvw.pif Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\1_102\uvbdlqfvw.pif Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\1_102\uvbdlqfvw.pif Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\1_102\uvbdlqfvw.pif Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\1_102\uvbdlqfvw.pif Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\1_102\uvbdlqfvw.pif Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\1_102\uvbdlqfvw.pif Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\1_102\uvbdlqfvw.pif Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\1_102\uvbdlqfvw.pif Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\1_102\uvbdlqfvw.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\1_102\uvbdlqfvw.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\1_102\uvbdlqfvw.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\1_102\uvbdlqfvw.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\1_102\uvbdlqfvw.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\1_102\uvbdlqfvw.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\1_102\uvbdlqfvw.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\1_102\uvbdlqfvw.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\1_102\uvbdlqfvw.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\1_102\uvbdlqfvw.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\1_102\uvbdlqfvw.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\1_102\uvbdlqfvw.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\1_102\uvbdlqfvw.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\1_102\uvbdlqfvw.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\1_102\uvbdlqfvw.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\1_102\uvbdlqfvw.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\1_102\uvbdlqfvw.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\1_102\uvbdlqfvw.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\1_102\uvbdlqfvw.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\1_102\uvbdlqfvw.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\1_102\uvbdlqfvw.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\1_102\uvbdlqfvw.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\1_102\uvbdlqfvw.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\1_102\uvbdlqfvw.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\1_102\uvbdlqfvw.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\1_102\uvbdlqfvw.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\1_102\uvbdlqfvw.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\1_102\uvbdlqfvw.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\1_102\uvbdlqfvw.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\1_102\uvbdlqfvw.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\1_102\uvbdlqfvw.pif Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion
barindex
Yara detected AntiVM autoit script
Source: Yara match File source: Process Memory Space: uvbdlqfvw.pif PID: 2528, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: uvbdlqfvw.pif PID: 5336, type: MEMORYSTR
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\1_102\uvbdlqfvw.pif TID: 3340 Thread sleep count: 65 > 30 Jump to behavior
Source: C:\Users\user\1_102\uvbdlqfvw.pif TID: 3340 Thread sleep count: 42 > 30 Jump to behavior
Source: C:\Users\user\1_102\uvbdlqfvw.pif TID: 3760 Thread sleep count: 51 > 30 Jump to behavior
Source: C:\Users\user\1_102\uvbdlqfvw.pif TID: 3760 Thread sleep count: 40 > 30 Jump to behavior
Source: C:\Users\user\1_102\uvbdlqfvw.pif TID: 4852 Thread sleep count: 55 > 30 Jump to behavior
Source: C:\Users\user\1_102\uvbdlqfvw.pif TID: 4852 Thread sleep count: 32 > 30 Jump to behavior
Source: C:\Users\user\1_102\uvbdlqfvw.pif TID: 5224 Thread sleep count: 35 > 30
Source: C:\Users\user\1_102\uvbdlqfvw.pif TID: 4644 Thread sleep count: 35 > 30
Source: C:\Users\user\1_102\uvbdlqfvw.pif TID: 5676 Thread sleep count: 41 > 30
Source: C:\Users\user\1_102\uvbdlqfvw.pif TID: 5832 Thread sleep count: 33 > 30
Source: C:\Users\user\1_102\uvbdlqfvw.pif TID: 4348 Thread sleep count: 37 > 30
Source: C:\Users\user\1_102\uvbdlqfvw.pif TID: 3300 Thread sleep count: 36 > 30
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Users\user\1_102\uvbdlqfvw.pif Last function: Thread delayed
Source: C:\Users\user\1_102\uvbdlqfvw.pif Last function: Thread delayed
Source: C:\Users\user\1_102\uvbdlqfvw.pif Last function: Thread delayed
Found dropped PE file which has not been started or loaded
Source: C:\Users\user\1_102\uvbdlqfvw.pif Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\RegSvcs.exe Jump to dropped file
Found large amount of non-executed APIs
Source: C:\Users\user\1_102\uvbdlqfvw.pif API coverage: 5.9 %
Found WSH timer for Javascript or VBS script (likely evasive script)
Source: C:\Windows\SysWOW64\wscript.exe Window found: window name: WSH-Timer Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Window found: window name: WSH-Timer Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Window found: window name: WSH-Timer
Source: C:\Windows\SysWOW64\wscript.exe Window found: window name: WSH-Timer
Source: C:\Windows\SysWOW64\wscript.exe Window found: window name: WSH-Timer
Source: C:\Windows\SysWOW64\wscript.exe Window found: window name: WSH-Timer
Source: C:\Windows\SysWOW64\wscript.exe Window found: window name: WSH-Timer
Source: C:\Windows\SysWOW64\wscript.exe Window found: window name: WSH-Timer
Source: C:\Windows\SysWOW64\wscript.exe Window found: window name: WSH-Timer
Source: C:\Users\user\1_102\uvbdlqfvw.pif Process information queried: ProcessInformation Jump to behavior
Source: C:\Users\user\Desktop\INV_0893.exe Code function: 0_2_0113D353 VirtualQuery,GetSystemInfo, 0_2_0113D353
Source: C:\Users\user\Desktop\INV_0893.exe Code function: 0_2_0112A2DF FindFirstFileW,FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError, 0_2_0112A2DF
Source: C:\Users\user\Desktop\INV_0893.exe Code function: 0_2_0113AFB9 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW, 0_2_0113AFB9
Source: C:\Users\user\Desktop\INV_0893.exe Code function: 0_2_01149FD3 FindFirstFileExA, 0_2_01149FD3
Source: C:\Users\user\1_102\uvbdlqfvw.pif Code function: 3_2_0112399B GetFileAttributesW,FindFirstFileW,FindClose, 3_2_0112399B
Source: C:\Users\user\1_102\uvbdlqfvw.pif Code function: 3_2_01142408 FindFirstFileW,Sleep,FindNextFileW,FindClose, 3_2_01142408
Source: C:\Users\user\1_102\uvbdlqfvw.pif Code function: 3_2_0113280D FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, 3_2_0113280D
Source: C:\Users\user\1_102\uvbdlqfvw.pif Code function: 3_2_01168877 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf, 3_2_01168877
Source: C:\Users\user\1_102\uvbdlqfvw.pif Code function: 3_2_01121A73 FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, 3_2_01121A73
Source: C:\Users\user\1_102\uvbdlqfvw.pif Code function: 3_2_0114CAE7 FindFirstFileW,FindNextFileW,FindClose, 3_2_0114CAE7
Source: C:\Users\user\Desktop\INV_0893.exe API call chain: ExitProcess graph end node
Source: uvbdlqfvw.pif, 00000017.00000003.553072884.0000000004EF1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: If DriveSpaceFree("d:\") < 1 And ProcessExists("VMwareUser.exe") Then0Rb
Source: uvbdlqfvw.pif, 0000000E.00000003.547420704.000000000303A000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMwareUser.exe
Source: uvbdlqfvw.pif, 0000000E.00000003.522771884.000000000302B000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMwaretray.exe}
Source: uvbdlqfvw.pif, 0000000C.00000003.505492001.00000000045B5000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMwaretray.exeq
Source: uvbdlqfvw.pif, 00000003.00000003.393961109.0000000003C55000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VboxService.exepz3t
Source: faeupdrjbw.afr.0.dr Binary or memory string: If ProcessExists("VMwaretray.exe") Then
Source: faeupdrjbw.afr.0.dr Binary or memory string: If DriveSpaceFree("d:\") < 1 And ProcessExists("VMwareUser.exe") Then
Source: uvbdlqfvw.pif, 00000017.00000002.577839213.0000000004EF0000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VBoxTray.exe0~
Source: uvbdlqfvw.pif, 00000019.00000003.564256844.0000000002F91000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: If DriveSpaceFree("d:\") < 1 And ProcessExists("VMwareService.exe") Then79o
Source: uvbdlqfvw.pif, 0000000E.00000003.547420704.000000000303A000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMwareService.exe444D6
Source: uvbdlqfvw.pif, 00000019.00000002.577415132.0000000002F90000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMwaretray.exe
Source: uvbdlqfvw.pif, 0000000E.00000002.551652003.0000000000C48000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: om&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000y
Source: uvbdlqfvw.pif, 0000000E.00000003.513468475.0000000003011000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: If DriveSpaceFree("d:\") < 1 And ProcessExists("VMwareService.exe") Thenp
Source: faeupdrjbw.afr.0.dr Binary or memory string: If ProcessExists("VboxService.exe") Then
Source: uvbdlqfvw.pif, 0000000D.00000003.504116609.0000000003AED000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMwaretray.exeZ!
Source: uvbdlqfvw.pif, 00000017.00000002.577839213.0000000004EF0000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMwareUser.exe3A765687
Source: uvbdlqfvw.pif, 00000019.00000002.577415132.0000000002F90000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMwareService.exe536C7
Source: uvbdlqfvw.pif, 00000003.00000003.394404593.0000000003C60000.00000004.00000800.00020000.00000000.sdmp, uvbdlqfvw.pif, 00000003.00000003.401152033.0000000003C74000.00000004.00000800.00020000.00000000.sdmp, uvbdlqfvw.pif, 00000003.00000003.393237133.0000000003C51000.00000004.00000800.00020000.00000000.sdmp, uvbdlqfvw.pif, 00000003.00000003.394189569.0000000003C5D000.00000004.00000800.00020000.00000000.sdmp, uvbdlqfvw.pif, 00000003.00000003.395107791.0000000003C6B000.00000004.00000800.00020000.00000000.sdmp, uvbdlqfvw.pif, 00000003.00000003.396289082.0000000003C70000.00000004.00000800.00020000.00000000.sdmp, uvbdlqfvw.pif, 00000003.00000003.393961109.0000000003C55000.00000004.00000800.00020000.00000000.sdmp, uvbdlqfvw.pif, 00000005.00000003.432760043.0000000004440000.00000004.00000800.00020000.00000000.sdmp, uvbdlqfvw.pif, 00000005.00000003.430843861.0000000004434000.00000004.00000800.00020000.00000000.sdmp, uvbdlqfvw.pif, 00000005.00000003.428968439.0000000004431000.00000004.00000800.00020000.00000000.sdmp, uvbdlqfvw.pif, 00000005.00000003.432877001.000000000444C000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VBoxTray.exe
Source: uvbdlqfvw.pif, 0000000D.00000003.504116609.0000000003AED000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VboxService.exeu!
Source: uvbdlqfvw.pif, 00000017.00000003.553072884.0000000004EF1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: If DriveSpaceFree("d:\") < 1 And ProcessExists("VMwareService.exe") ThenT4E`
Source: uvbdlqfvw.pif, 00000005.00000003.431697192.000000000443D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMwaretray.exea
Source: uvbdlqfvw.pif, 00000010.00000003.543862397.00000000048A4000.00000004.00000800.00020000.00000000.sdmp, uvbdlqfvw.pif, 00000010.00000003.545397422.00000000048AD000.00000004.00000800.00020000.00000000.sdmp, uvbdlqfvw.pif, 00000010.00000003.546967670.00000000048B0000.00000004.00000800.00020000.00000000.sdmp, uvbdlqfvw.pif, 00000010.00000003.553574188.00000000048C0000.00000004.00000800.00020000.00000000.sdmp, uvbdlqfvw.pif, 00000010.00000003.548851878.00000000048BC000.00000004.00000800.00020000.00000000.sdmp, uvbdlqfvw.pif, 00000010.00000003.534687720.00000000048A1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VBoxTray.exe\
Source: uvbdlqfvw.pif, 00000003.00000003.393237133.0000000003C51000.00000004.00000800.00020000.00000000.sdmp, uvbdlqfvw.pif, 00000003.00000003.393961109.0000000003C55000.00000004.00000800.00020000.00000000.sdmp, uvbdlqfvw.pif, 00000005.00000003.430843861.0000000004434000.00000004.00000800.00020000.00000000.sdmp, uvbdlqfvw.pif, 00000005.00000003.406326241.0000000004421000.00000004.00000800.00020000.00000000.sdmp, uvbdlqfvw.pif, 00000005.00000003.428968439.0000000004431000.00000004.00000800.00020000.00000000.sdmp, uvbdlqfvw.pif, 00000006.00000003.436870784.0000000003441000.00000004.00000800.00020000.00000000.sdmp, uvbdlqfvw.pif, 0000000A.00000003.481069326.0000000003E91000.00000004.00000800.00020000.00000000.sdmp, uvbdlqfvw.pif, 0000000A.00000003.446377357.0000000003E81000.00000004.00000800.00020000.00000000.sdmp, uvbdlqfvw.pif, 0000000A.00000003.483217881.0000000003E94000.00000004.00000800.00020000.00000000.sdmp, uvbdlqfvw.pif, 0000000C.00000003.470607041.00000000045A1000.00000004.00000800.00020000.00000000.sdmp, uvbdlqfvw.pif, 0000000C.00000003.503415232.00000000045B1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: If ProcessExists("VBoxTray.exe") Then
Source: faeupdrjbw.afr.0.dr Binary or memory string: If ProcessExists("VBoxTray.exe") Then
Source: uvbdlqfvw.pif, 00000019.00000003.564256844.0000000002F91000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: If ProcessExists("VboxService.exe") Then
Source: uvbdlqfvw.pif, 00000010.00000003.543862397.00000000048A4000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: rocessExists("VboxService.exe") Then
Source: uvbdlqfvw.pif, 0000000A.00000003.483217881.0000000003E94000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMwareService.execroso
Source: uvbdlqfvw.pif, 00000010.00000003.534687720.00000000048A1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: If ProcessExists("VMwaretray.exe") Thena
Source: uvbdlqfvw.pif, 00000003.00000002.408624142.0000000003C7A000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMwareService.exe65687
Source: uvbdlqfvw.pif, 00000010.00000003.534687720.00000000048A1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMwareService.exe
Source: uvbdlqfvw.pif, 00000017.00000002.577839213.0000000004EF0000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMwaretray.exe1x
Source: uvbdlqfvw.pif, 00000006.00000003.445620543.000000000345B000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VboxService.exe5
Source: uvbdlqfvw.pif, 00000010.00000003.534687720.00000000048A1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMwaretray.exe5
Source: uvbdlqfvw.pif, 00000013.00000003.524003657.0000000003D31000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: If DriveSpaceFree("d:\") < 1 And ProcessExists("VMwareService.exe") ThenT4Ej
Source: uvbdlqfvw.pif, 00000005.00000003.431697192.000000000443D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMwareUser.exe3A765687
Source: uvbdlqfvw.pif, 00000010.00000003.534687720.00000000048A1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMwareUser.exe6BA444D6
Source: uvbdlqfvw.pif, 00000019.00000003.564256844.0000000002F91000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: If ProcessExists("VMwaretray.exe") Then
Source: uvbdlqfvw.pif, 00000006.00000003.445620543.000000000345B000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMwaretray.exeA
Source: faeupdrjbw.afr.0.dr Binary or memory string: If DriveSpaceFree("d:\") < 1 And ProcessExists("VMwareService.exe") Then
Source: uvbdlqfvw.pif, 00000005.00000003.428968439.0000000004431000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: If DriveSpaceFree("d:\") < 1 And ProcessExists("VMwareService.exe") Then79o-
Source: uvbdlqfvw.pif, 00000006.00000003.472201009.000000000346A000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMwareService.exe637D6
Source: uvbdlqfvw.pif, 00000017.00000002.577839213.0000000004EF0000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMwareService.exe536C7k
Source: uvbdlqfvw.pif, 0000000A.00000003.484193504.0000000003E9D000.00000004.00000800.00020000.00000000.sdmp, uvbdlqfvw.pif, 0000000A.00000003.481069326.0000000003E91000.00000004.00000800.00020000.00000000.sdmp, uvbdlqfvw.pif, 0000000A.00000003.488423943.0000000003EB0000.00000004.00000800.00020000.00000000.sdmp, uvbdlqfvw.pif, 0000000A.00000003.486092254.0000000003EA0000.00000004.00000800.00020000.00000000.sdmp, uvbdlqfvw.pif, 0000000A.00000003.506597786.0000000003EB9000.00000004.00000800.00020000.00000000.sdmp, uvbdlqfvw.pif, 0000000A.00000003.487397857.0000000003EAC000.00000004.00000800.00020000.00000000.sdmp, uvbdlqfvw.pif, 0000000A.00000003.483217881.0000000003E94000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VBoxTray.exe|u1%#
Source: uvbdlqfvw.pif, 00000006.00000003.472201009.000000000346A000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMwareUser.exec
Source: uvbdlqfvw.pif, 00000003.00000002.408624142.0000000003C7A000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMwareUser.exe'~
Source: uvbdlqfvw.pif, 00000005.00000003.431697192.000000000443D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMwareService.exe444D62
Source: uvbdlqfvw.pif, 0000000E.00000003.522771884.000000000302B000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VboxService.exeV
Source: uvbdlqfvw.pif, 0000000D.00000003.504116609.0000000003AED000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMwareUser.exe$H
Source: uvbdlqfvw.pif, 0000000E.00000003.513468475.0000000003011000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: If DriveSpaceFree("d:\") < 1 And ProcessExists("VMwareUser.exe") Then
Source: uvbdlqfvw.pif, 00000010.00000003.534687720.00000000048A1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VboxService.exeR
Source: uvbdlqfvw.pif, 00000019.00000003.564256844.0000000002F91000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: If DriveSpaceFree("d:\") < 1 And ProcessExists("VMwareUser.exe") Thenkn
Source: uvbdlqfvw.pif, 0000000D.00000003.504116609.0000000003AED000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMwareService.exe536C7d$d
Source: uvbdlqfvw.pif, 00000019.00000002.577415132.0000000002F90000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMwareUser.exe5FB536C7*^
Source: uvbdlqfvw.pif, 00000015.00000003.532638592.0000000000FE1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: If DriveSpaceFree("d:\") < 1 And ProcessExists("VMwareService.exe") ThenT4E
Source: uvbdlqfvw.pif, 0000000A.00000003.483217881.0000000003E94000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMwareUser.exe5FB536C7_v
Source: uvbdlqfvw.pif, 00000019.00000002.577415132.0000000002F90000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VboxService.exe
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\Desktop\INV_0893.exe Code function: 0_2_0113E4F5 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_0113E4F5
Contains functionality to dynamically determine API calls
Source: C:\Users\user\1_102\uvbdlqfvw.pif Code function: 3_2_010FEE30 LoadLibraryA,GetProcAddress, 3_2_010FEE30
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\Desktop\INV_0893.exe Code function: 0_2_0114ACA1 GetProcessHeap, 0_2_0114ACA1
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\INV_0893.exe Code function: 0_2_01146AF3 mov eax, dword ptr fs:[00000030h] 0_2_01146AF3
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Source: C:\Users\user\1_102\uvbdlqfvw.pif Code function: 3_2_0114A35D BlockInput, 3_2_0114A35D
Source: C:\Users\user\Desktop\INV_0893.exe Code function: 0_2_0113E643 SetUnhandledExceptionFilter, 0_2_0113E643
Source: C:\Users\user\Desktop\INV_0893.exe Code function: 0_2_0113E4F5 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_0113E4F5
Source: C:\Users\user\Desktop\INV_0893.exe Code function: 0_2_0113E7FB SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 0_2_0113E7FB
Source: C:\Users\user\Desktop\INV_0893.exe Code function: 0_2_01147BE1 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_01147BE1
Source: C:\Users\user\1_102\uvbdlqfvw.pif Code function: 3_2_0110F170 SetUnhandledExceptionFilter, 3_2_0110F170
Source: C:\Users\user\1_102\uvbdlqfvw.pif Code function: 3_2_0110A128 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 3_2_0110A128
Contains functionality to simulate keystroke presses
Source: C:\Users\user\1_102\uvbdlqfvw.pif Code function: 3_2_011243FF GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput, 3_2_011243FF
Contains functionality to launch a program with higher privileges
Source: C:\Users\user\1_102\uvbdlqfvw.pif Code function: 3_2_010FD7A0 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetModuleFileNameW,GetForegroundWindow,ShellExecuteW,GetForegroundWindow,ShellExecuteW, 3_2_010FD7A0
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\INV_0893.exe Process created: C:\Users\user\1_102\uvbdlqfvw.pif "C:\Users\user\1_102\uvbdlqfvw.pif" faeupdrjbw.afr Jump to behavior
Source: C:\Users\user\1_102\uvbdlqfvw.pif Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\1_102\run.vbs" Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Users\user\1_102\uvbdlqfvw.pif "C:\Users\user\1_102\UVBDLQ~1.PIF" FAEUPD~1.AFR Jump to behavior
Source: C:\Users\user\1_102\uvbdlqfvw.pif Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\1_102\run.vbs" Jump to behavior
Source: C:\Users\user\1_102\uvbdlqfvw.pif Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\1_102\run.vbs" Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Users\user\1_102\uvbdlqfvw.pif "C:\Users\user\1_102\UVBDLQ~1.PIF" FAEUPD~1.AFR Jump to behavior
Source: C:\Users\user\1_102\uvbdlqfvw.pif Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\1_102\run.vbs"
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Users\user\1_102\uvbdlqfvw.pif "C:\Users\user\1_102\UVBDLQ~1.PIF" FAEUPD~1.AFR
Source: C:\Users\user\1_102\uvbdlqfvw.pif Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\1_102\run.vbs"
Source: C:\Users\user\1_102\uvbdlqfvw.pif Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\1_102\run.vbs"
Source: C:\Users\user\1_102\uvbdlqfvw.pif Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\1_102\run.vbs"
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Users\user\1_102\uvbdlqfvw.pif "C:\Users\user\1_102\UVBDLQ~1.PIF" FAEUPD~1.AFR
Source: C:\Users\user\1_102\uvbdlqfvw.pif Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\1_102\run.vbs"
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Users\user\1_102\uvbdlqfvw.pif "C:\Users\user\1_102\UVBDLQ~1.PIF" FAEUPD~1.AFR
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Users\user\1_102\uvbdlqfvw.pif "C:\Users\user\1_102\UVBDLQ~1.PIF" FAEUPD~1.AFR
Source: C:\Users\user\1_102\uvbdlqfvw.pif Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\1_102\run.vbs"
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Users\user\1_102\uvbdlqfvw.pif "C:\Users\user\1_102\UVBDLQ~1.PIF" FAEUPD~1.AFR
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Users\user\1_102\uvbdlqfvw.pif "C:\Users\user\1_102\UVBDLQ~1.PIF" FAEUPD~1.AFR
Contains functionality to simulate mouse events
Source: C:\Users\user\1_102\uvbdlqfvw.pif Code function: 3_2_01123321 __wcsicoll,mouse_event,__wcsicoll,mouse_event, 3_2_01123321
Source: C:\Users\user\1_102\uvbdlqfvw.pif Code function: 3_2_0113602A GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity, 3_2_0113602A
Source: INV_0893.exe, 00000000.00000003.335985605.0000000004907000.00000004.00000800.00020000.00000000.sdmp, uvbdlqfvw.pif.0.dr Binary or memory string: IDASCRWINUPRWINDOWNLWINUPLWINDOWNSHIFTUPSHIFTDOWNALTUPALTDOWNCTRLUPCTRLDOWNMOUSE_XBUTTON2MOUSE_XBUTTON1MOUSE_MBUTTONMOUSE_RBUTTONMOUSE_LBUTTONLAUNCH_APP2LAUNCH_APP1LAUNCH_MEDIALAUNCH_MAILMEDIA_PLAY_PAUSEMEDIA_STOPMEDIA_PREVMEDIA_NEXTVOLUME_UPVOLUME_DOWNVOLUME_MUTEBROWSER_HOMEBROWSER_FAVORTIESBROWSER_SEARCHBROWSER_STOPBROWSER_REFRESHBROWSER_FORWARDBROWSER_BACKNUMPADENTERSLEEPRSHIFTLSHIFTRALTLALTRCTRLLCTRLAPPSKEYNUMPADDIVNUMPADDOTNUMPADSUBNUMPADADDNUMPADMULTNUMPAD9NUMPAD8NUMPAD7NUMPAD6NUMPAD5NUMPAD4NUMPAD3NUMPAD2NUMPAD1NUMPAD0CAPSLOCKPAUSEBREAKNUMLOCKSCROLLLOCKRWINLWINPRINTSCREENUPTABSPACERIGHTPGUPPGDNLEFTINSERTINSHOMEF12F11F10F9F8F7F6F5F4F3F2F1ESCAPEESCENTERENDDOWNDELETEDELBSBACKSPACEALTONOFF0%d%dShell_TrayWndExitScript PausedblankinfoquestionstopwarningAutoIt -
Source: uvbdlqfvw.pif, 00000006.00000003.436870784.0000000003441000.00000004.00000800.00020000.00000000.sdmp, uvbdlqfvw.pif, 00000006.00000003.442051689.000000000344D000.00000004.00000800.00020000.00000000.sdmp, uvbdlqfvw.pif, 00000006.00000003.471767396.0000000003467000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Program Manager
Source: uvbdlqfvw.pif Binary or memory string: Shell_TrayWnd
Source: uvbdlqfvw.pif, 00000003.00000003.393237133.0000000003C51000.00000004.00000800.00020000.00000000.sdmp, uvbdlqfvw.pif, 00000003.00000003.393961109.0000000003C55000.00000004.00000800.00020000.00000000.sdmp, uvbdlqfvw.pif, 00000005.00000003.430843861.0000000004434000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: If WinGetText("Program Manager") = "0" Then
Source: uvbdlqfvw.pif, 00000017.00000002.577839213.0000000004EF0000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Program Manager,x
Source: uvbdlqfvw.pif, 00000017.00000002.577839213.0000000004EF0000.00000004.00000800.00020000.00000000.sdmp, uvbdlqfvw.pif, 00000017.00000003.553072884.0000000004EF1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: If WinGetText("Program Manager") = "0" Thenm
Source: uvbdlqfvw.pif, 00000005.00000003.432760043.0000000004440000.00000004.00000800.00020000.00000000.sdmp, uvbdlqfvw.pif, 00000005.00000003.430843861.0000000004434000.00000004.00000800.00020000.00000000.sdmp, uvbdlqfvw.pif, 00000005.00000003.428968439.0000000004431000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Program ManagerL
Source: faeupdrjbw.afr.0.dr Binary or memory string: If WinGetText("Program Manager") = "0" Then
Source: uvbdlqfvw.pif, 00000005.00000003.406326241.0000000004421000.00000004.00000800.00020000.00000000.sdmp, uvbdlqfvw.pif, 00000005.00000003.428968439.0000000004431000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: If WinGetText("Program Manager") = "0" Then
Source: uvbdlqfvw.pif, 00000013.00000003.524003657.0000000003D31000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: If WinGetText("Program Manager") = "0" Theng
Source: uvbdlqfvw.pif, 0000000C.00000003.509609607.00000000045D0000.00000004.00000800.00020000.00000000.sdmp, uvbdlqfvw.pif, 0000000C.00000003.508522641.00000000045CC000.00000004.00000800.00020000.00000000.sdmp, uvbdlqfvw.pif, 0000000C.00000003.507327420.00000000045BD000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Program Managerr
Source: uvbdlqfvw.pif, 00000003.00000000.359780847.0000000001172000.00000002.00000001.01000000.00000007.sdmp, uvbdlqfvw.pif, 00000003.00000002.405404161.0000000001172000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: ASCRWINUPRWINDOWNLWINUPLWINDOWNSHIFTUPSHIFTDOWNALTUPALTDOWNCTRLUPCTRLDOWNMOUSE_XBUTTON2MOUSE_XBUTTON1MOUSE_MBUTTONMOUSE_RBUTTONMOUSE_LBUTTONLAUNCH_APP2LAUNCH_APP1LAUNCH_MEDIALAUNCH_MAILMEDIA_PLAY_PAUSEMEDIA_STOPMEDIA_PREVMEDIA_NEXTVOLUME_UPVOLUME_DOWNVOLUME_MUTEBROWSER_HOMEBROWSER_FAVORTIESBROWSER_SEARCHBROWSER_STOPBROWSER_REFRESHBROWSER_FORWARDBROWSER_BACKNUMPADENTERSLEEPRSHIFTLSHIFTRALTLALTRCTRLLCTRLAPPSKEYNUMPADDIVNUMPADDOTNUMPADSUBNUMPADADDNUMPADMULTNUMPAD9NUMPAD8NUMPAD7NUMPAD6NUMPAD5NUMPAD4NUMPAD3NUMPAD2NUMPAD1NUMPAD0CAPSLOCKPAUSEBREAKNUMLOCKSCROLLLOCKRWINLWINPRINTSCREENUPTABSPACERIGHTPGUPPGDNLEFTINSERTINSHOMEF12F11F10F9F8F7F6F5F4F3F2F1ESCAPEESCENTERENDDOWNDELETEDELBSBACKSPACEALTONOFF0%d%dShell_TrayWndExitScript PausedblankinfoquestionstopwarningAutoIt -
Source: uvbdlqfvw.pif, 00000003.00000003.394404593.0000000003C60000.00000004.00000800.00020000.00000000.sdmp, uvbdlqfvw.pif, 00000003.00000003.401152033.0000000003C74000.00000004.00000800.00020000.00000000.sdmp, uvbdlqfvw.pif, 00000003.00000003.393237133.0000000003C51000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Program Managermz(t
Contains functionality to query locales information (e.g. system language)
Source: C:\Users\user\Desktop\INV_0893.exe Code function: GetLocaleInfoW,GetNumberFormatW, 0_2_01139D99
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\Desktop\INV_0893.exe Code function: 0_2_0113E34B cpuid 0_2_0113E34B
Source: C:\Windows\SysWOW64\wscript.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
Source: C:\Users\user\Desktop\INV_0893.exe Code function: 0_2_0113CBB8 GetCommandLineW,OpenFileMappingW,MapViewOfFile,UnmapViewOfFile,CloseHandle,GetModuleFileNameW,SetEnvironmentVariableW,SetEnvironmentVariableW,GetLocalTime,_swprintf,SetEnvironmentVariableW,GetModuleHandleW,LoadIconW,DialogBoxParamW,Sleep,DeleteObject,DeleteObject,DeleteObject,CloseHandle, 0_2_0113CBB8
Source: C:\Users\user\1_102\uvbdlqfvw.pif Code function: 3_2_0110E284 __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,_strcpy_s,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte, 3_2_0110E284
Source: C:\Users\user\Desktop\INV_0893.exe Code function: 0_2_0112A995 GetVersionExW, 0_2_0112A995
Source: C:\Users\user\1_102\uvbdlqfvw.pif Code function: 3_2_01162BF9 GetUserNameW, 3_2_01162BF9
OS version to string mapping found (often used in BOTs)
Source: uvbdlqfvw.pif Binary or memory string: WIN_XP
Source: uvbdlqfvw.pif Binary or memory string: WIN_XPe
Source: uvbdlqfvw.pif Binary or memory string: WIN_VISTA
Source: uvbdlqfvw.pif.0.dr Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPWIN_2000InstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 8, 1USERPROFILEUSERDOMAINUSERDNSDOMAINDefaultGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte!
Source: uvbdlqfvw.pif Binary or memory string: WIN_7
Source: uvbdlqfvw.pif Binary or memory string: WIN_8
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Source: C:\Users\user\1_102\uvbdlqfvw.pif Code function: 3_2_0115C06C OleInitialize,_wcslen,CreateBindCtx,MkParseDisplayName,CLSIDFromProgID,GetActiveObject, 3_2_0115C06C
Source: C:\Users\user\1_102\uvbdlqfvw.pif Code function: 3_2_011665D3 socket,WSAGetLastError,bind,WSAGetLastError,closesocket, 3_2_011665D3
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 715068 Sample: INV_0893.exe Startdate: 03/10/2022 Architecture: WINDOWS Score: 84 69 Antivirus / Scanner detection for submitted sample 2->69 71 Multi AV Scanner detection for submitted file 2->71 73 Yara detected AntiVM autoit script 2->73 14 INV_0893.exe 62 2->14         started        18 uvbdlqfvw.pif 2->18         started        20 uvbdlqfvw.pif 1 2->20         started        22 uvbdlqfvw.pif 2->22         started        process3 file4 65 C:\Users\user\1_102\uvbdlqfvw.pif, PE32 14->65 dropped 79 Drops PE files with a suspicious file extension 14->79 24 uvbdlqfvw.pif 4 3 14->24         started        28 wscript.exe 18->28         started        30 wscript.exe 20->30         started        32 wscript.exe 22->32         started        signatures5 process6 dnsIp7 67 192.168.2.1 unknown unknown 24->67 75 Antivirus detection for dropped file 24->75 77 Multi AV Scanner detection for dropped file 24->77 34 wscript.exe 1 24->34         started        36 uvbdlqfvw.pif 28->36         started        39 uvbdlqfvw.pif 30->39         started        41 uvbdlqfvw.pif 32->41         started        signatures8 process9 file10 43 uvbdlqfvw.pif 34->43         started        63 C:\Users\user\AppData\Local\...\RegSvcs.exe, PE32 36->63 dropped 45 wscript.exe 39->45         started        47 wscript.exe 41->47         started        process11 process12 49 wscript.exe 1 43->49         started        51 uvbdlqfvw.pif 45->51         started        process13 53 uvbdlqfvw.pif 49->53         started        process14 55 wscript.exe 53->55         started        process15 57 uvbdlqfvw.pif 55->57         started        process16 59 wscript.exe 57->59         started        process17 61 uvbdlqfvw.pif 59->61         started       
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious

Private

IP
192.168.2.1