OopsIE performs several anti-VM and sandbox checks on the victim's machine. One technique the group has used was to perform a WMI query "SELECT * FROM MSAcpi_ThermalZoneTemperature" to check the temperature to see if it’s running in a virtual environment.