SmartHawk

15.2

0-day

56 个模型检测该样本为恶意！

重新分析

下载样本

5ea020f7df06bbca91fd6ac92d3412cf5eeda1141eaff2eb8d9edf09054bf32e

01ed0a4bf1cc716a392069ab71bd796f.exe

分析耗时

75s

最近分析

文件大小

735.0KB

静态报毒动态报毒 100% AI SCORE=84 ALI2000016 ARTEMIS ATTRIBUTE AUTO BHJP CONFIDENCE DHPP DOWNLOADER33 ENEA GDSDA GENKRYPTIK HIGH CONFIDENCE HIGHCONFIDENCE HNASUI KCLOUD KRYPT KRYPTIK MALICIOUS PE MALWARE@#2FBMUTHZSJ50A OWARU R066C0DJ720 RAZY REMCOS SCORE STATIC AI SUSGEN TM0@AKIUCIJI TSCOPE UNSAFE ZEMSILF 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee	Artemis!01ED0A4BF1CC	20201219	6.0.6.653
Alibaba	Trojan:Win32/Kryptik.ali2000016	20190527	0.3.0.5
Baidu		20190318	1.0.0.2
Avast	Win32:Trojan-gen	20201219	21.1.5827.0
Tencent	Win32.Trojan.Inject.Auto	20201220	1.0.0.1
Kingsoft	Win32.Hack.Undef.(kcloud)	20201220	2017.9.26.565
CrowdStrike	win/malicious_confidence_100% (W)	20190702	1.0

Queries for the computername (6 个事件)

Time & API	Arguments	Status	Return
1619152452.318626 GetComputerNameW	computer_name: OSKAR-PC	success	1
1619152453.522626 GetComputerNameW	computer_name: OSKAR-PC	success	1
1619152455.553626 GetComputerNameW	computer_name: OSKAR-PC	success	1
1619152479.396874 GetComputerNameW	computer_name: OSKAR-PC	success	1
1619152482.552874 GetComputerNameW	computer_name: OSKAR-PC	success	1
1619152484.489874 GetComputerNameW	computer_name: OSKAR-PC	success	1

Checks if process is being debugged by a debugger (4 个事件)

Time & API	Arguments	Status	Return	Repeated
1619152450.850626 IsDebuggerPresent		failed	0	0
1619152450.850626 IsDebuggerPresent		failed	0	0
1619152478.692874 IsDebuggerPresent		failed	0	0
1619152478.692874 IsDebuggerPresent		failed	0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619152450.881626 GlobalMemoryStatusEx		success	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (50 out of 176 个事件)

Time & API	Arguments	Status
1619152450.490626 NtAllocateVirtualMemory	process_identifier: 2256 region_size: 1572864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00650000	success
1619152450.490626 NtAllocateVirtualMemory	process_identifier: 2256 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00790000	success
1619152450.740626 NtAllocateVirtualMemory	process_identifier: 2256 region_size: 1572864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00af0000	success
1619152450.740626 NtAllocateVirtualMemory	process_identifier: 2256 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00c30000	success
1619152450.787626 NtProtectVirtualMemory	process_identifier: 2256 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73e71000	success
1619152450.850626 NtAllocateVirtualMemory	process_identifier: 2256 region_size: 2293760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00c70000	success
1619152450.850626 NtAllocateVirtualMemory	process_identifier: 2256 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00e60000	success
1619152450.850626 NtAllocateVirtualMemory	process_identifier: 2256 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0056a000	success
1619152450.850626 NtProtectVirtualMemory	process_identifier: 2256 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73e72000	success
1619152450.850626 NtAllocateVirtualMemory	process_identifier: 2256 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00562000	success
1619152451.022626 NtAllocateVirtualMemory	process_identifier: 2256 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00572000	success
1619152451.115626 NtAllocateVirtualMemory	process_identifier: 2256 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005b5000	success
1619152451.115626 NtAllocateVirtualMemory	process_identifier: 2256 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005bb000	success
1619152451.115626 NtAllocateVirtualMemory	process_identifier: 2256 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005b7000	success
1619152451.240626 NtAllocateVirtualMemory	process_identifier: 2256 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00573000	success
1619152451.303626 NtAllocateVirtualMemory	process_identifier: 2256 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0057c000	success
1619152451.662626 NtAllocateVirtualMemory	process_identifier: 2256 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00574000	success
1619152451.678626 NtAllocateVirtualMemory	process_identifier: 2256 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00576000	success
1619152451.756626 NtAllocateVirtualMemory	process_identifier: 2256 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00740000	success
1619152451.834626 NtAllocateVirtualMemory	process_identifier: 2256 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00577000	success
1619152452.068626 NtAllocateVirtualMemory	process_identifier: 2256 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00578000	success
1619152452.209626 NtAllocateVirtualMemory	process_identifier: 2256 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00c80000	success
1619152452.209626 NtAllocateVirtualMemory	process_identifier: 2256 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0057a000	success
1619152452.365626 NtAllocateVirtualMemory	process_identifier: 2256 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005aa000	success
1619152452.365626 NtAllocateVirtualMemory	process_identifier: 2256 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005a7000	success
1619152452.506626 NtAllocateVirtualMemory	process_identifier: 2256 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00579000	success
1619152452.693626 NtAllocateVirtualMemory	process_identifier: 2256 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005a6000	success
1619152452.850626 NtAllocateVirtualMemory	process_identifier: 2256 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00c31000	success
1619152452.943626 NtAllocateVirtualMemory	process_identifier: 2256 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00f90000	success
1619152452.943626 NtAllocateVirtualMemory	process_identifier: 2256 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00f91000	success
1619152452.943626 NtAllocateVirtualMemory	process_identifier: 2256 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00f93000	success
1619152452.943626 NtAllocateVirtualMemory	process_identifier: 2256 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00f94000	success
1619152452.943626 NtAllocateVirtualMemory	process_identifier: 2256 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00f95000	success
1619152452.943626 NtAllocateVirtualMemory	process_identifier: 2256 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00f96000	success
1619152452.943626 NtAllocateVirtualMemory	process_identifier: 2256 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00f97000	success
1619152452.943626 NtAllocateVirtualMemory	process_identifier: 2256 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00f98000	success
1619152452.943626 NtAllocateVirtualMemory	process_identifier: 2256 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00f99000	success
1619152452.975626 NtAllocateVirtualMemory	process_identifier: 2256 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0056c000	success
1619152453.037626 NtAllocateVirtualMemory	process_identifier: 2256 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00f9a000	success
1619152453.100626 NtAllocateVirtualMemory	process_identifier: 2256 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00f9b000	success
1619152453.100626 NtAllocateVirtualMemory	process_identifier: 2256 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00f9c000	success
1619152453.115626 NtAllocateVirtualMemory	process_identifier: 2256 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00f9d000	success
1619152453.115626 NtAllocateVirtualMemory	process_identifier: 2256 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00741000	success
1619152453.115626 NtAllocateVirtualMemory	process_identifier: 2256 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00f9e000	success
1619152453.147626 NtAllocateVirtualMemory	process_identifier: 2256 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00563000	success
1619152453.178626 NtAllocateVirtualMemory	process_identifier: 2256 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) base_address: 0x7ef40000	success
1619152453.178626 NtAllocateVirtualMemory	process_identifier: 2256 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x7ef40000	success
1619152453.178626 NtAllocateVirtualMemory	process_identifier: 2256 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x7ef40000	success
1619152453.178626 NtAllocateVirtualMemory	process_identifier: 2256 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x7ef48000	success
1619152453.178626 NtAllocateVirtualMemory	process_identifier: 2256 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) base_address: 0x7ef30000	success

Creates executable files on the filesystem (1 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\install.vbs

Creates a suspicious process (1 个事件)

cmdline

"C:\Windows\System32\cmd.exe" /c "C:\Users\Administrator.Oskar-PC\AppData\Roaming\System32\PXServiceNet.exe"

Drops a binary and executes it (1 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\install.vbs

A process created a hidden window (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619152473.428499 ShellExecuteExW	parameters: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\install.vbs filepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\install.vbs show_type: 0	success	1	0
1619152476.881124 ShellExecuteExW	parameters: /c "C:\Users\Administrator.Oskar-PC\AppData\Roaming\System32\PXServiceNet.exe" filepath: cmd filepath_r: cmd show_type: 0	success	1	0

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

7.676447434677702

section

{'size_of_data': '0x00044200', 'virtual_address': '0x00002000', 'entropy': 7.676447434677702, 'name': '.text', 'virtual_size': '0x00044104'}

description

A section with a high entropy has been found

entropy

0.371000680735194

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619152455.318626 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1	0
1619152484.255874 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1	0

Terminates another process (10 个事件)

Time & API	Arguments	Status
1619152471.115626 NtTerminateProcess	status_code: 0xffffffff process_identifier: 2340 process_handle: 0x000003c0	failed
1619152471.115626 NtTerminateProcess	status_code: 0xffffffff process_identifier: 2340 process_handle: 0x000003c0	success
1619152471.443626 NtTerminateProcess	status_code: 0xffffffff process_identifier: 1940 process_handle: 0x000003d0	failed
1619152471.443626 NtTerminateProcess	status_code: 0xffffffff process_identifier: 1940 process_handle: 0x000003d0	success
1619152489.006626 NtTerminateProcess	status_code: 0xffffffff process_identifier: 2256 process_handle: 0x000003d8	failed
1619152500.036874 NtTerminateProcess	status_code: 0xffffffff process_identifier: 3256 process_handle: 0x000003c0	failed
1619152500.036874 NtTerminateProcess	status_code: 0xffffffff process_identifier: 3256 process_handle: 0x000003c0	success
1619152500.427874 NtTerminateProcess	status_code: 0xffffffff process_identifier: 3316 process_handle: 0x000003d0	failed
1619152500.427874 NtTerminateProcess	status_code: 0xffffffff process_identifier: 3316 process_handle: 0x000003d0	success
1619152506.380874 NtTerminateProcess	status_code: 0xffffffff process_identifier: 1948 process_handle: 0x000003d8	failed

Uses Windows utilities for basic Windows functionality (3 个事件)

cmdline	cmd /c "C:\Users\Administrator.Oskar-PC\AppData\Roaming\System32\PXServiceNet.exe"
cmdline	"C:\Windows\System32\cmd.exe" /c "C:\Users\Administrator.Oskar-PC\AppData\Roaming\System32\PXServiceNet.exe"
cmdline	C:\Users\Administrator.Oskar-PC\AppData\Roaming\System32\PXServiceNet.exe

One or more of the buffers contains an embedded PE file (1 个事件)

buffer

Buffer with sha1: 784a6d6ad198eb4bca7cf06c0d59dbe49b314a98

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Allocates execute permission to another process indicative of possible code injection (6 个事件)

Time & API	Arguments	Status	Return
1619152470.834626 NtAllocateVirtualMemory	process_identifier: 2340 region_size: 131072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x000003b8 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496
1619152471.209626 NtAllocateVirtualMemory	process_identifier: 1940 region_size: 131072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x000003bc allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496
1619152471.537626 NtAllocateVirtualMemory	process_identifier: 3060 region_size: 131072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x000003cc allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	success	0
1619152499.802874 NtAllocateVirtualMemory	process_identifier: 3256 region_size: 131072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x000003b0 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496
1619152500.130874 NtAllocateVirtualMemory	process_identifier: 3316 region_size: 131072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x000003bc allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496
1619152500.552874 NtAllocateVirtualMemory	process_identifier: 3380 region_size: 131072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x000003cc allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	success	0

Attempts to identify installed AV products by installation directory (2 个事件)

file	C:\Program Files\AVAST Software
file	C:\Program Files (x86)\AVAST Software

A process attempted to delay the analysis task. (2 个事件)

description	PXServiceNet.exe tried to sleep 2728218 seconds, actually delayed analysis time by 2728218 seconds
description	01ed0a4bf1cc716a392069ab71bd796f.exe tried to sleep 2728179 seconds, actually delayed analysis time by 2728179 seconds

Installs itself for autorun at Windows startup (2 个事件)

reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\MServices				reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Roaming\System32\PXServiceNet.exe"
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\MServices				reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Roaming\System32\PXServiceNet.exe"

Manipulates memory of a non-child process indicative of process injection (8 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2256 manipulating memory of non-child process 2340
Process injection	Process 2256 manipulating memory of non-child process 1940
Process injection	Process 1948 manipulating memory of non-child process 3256
Process injection	Process 1948 manipulating memory of non-child process 3316
1619152470.834626 NtAllocateVirtualMemory	process_identifier: 2340 region_size: 131072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x000003b8 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496	0
1619152471.209626 NtAllocateVirtualMemory	process_identifier: 1940 region_size: 131072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x000003bc allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496	0
1619152499.802874 NtAllocateVirtualMemory	process_identifier: 3256 region_size: 131072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x000003b0 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496	0
1619152500.130874 NtAllocateVirtualMemory	process_identifier: 3316 region_size: 131072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x000003bc allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496	0

Potential code injection by writing to the memory of another process (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619152471.537626 WriteProcessMemory	process_identifier: 3060 buffer: @ process_handle: 0x000003cc base_address: 0x7efde008	success	1	0
1619152500.552874 WriteProcessMemory	process_identifier: 3380 buffer: @ process_handle: 0x000003cc base_address: 0x7efde008	success	1	0

Creates a windows hook that monitors keyboard input (keylogger) (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619152501.146749 SetWindowsHookExA	thread_identifier: 0 callback_function: 0x0040519b module_address: 0x00000000 hook_identifier: 13 (WH_KEYBOARD_LL)	success	2621793	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (4 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2256 called NtSetContextThread to modify thread in remote process 3060
Process injection	Process 1948 called NtSetContextThread to modify thread in remote process 3380
1619152471.537626 NtSetContextThread	thread_handle: 0x000003d0 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4275060 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 3060	success	0	0
1619152500.567874 NtSetContextThread	thread_handle: 0x000003d0 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4275060 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 3380	success	0	0

One or more non-safelisted processes were created (2 个事件)

parent_process	wscript.exe				martian_process	"C:\Windows\System32\cmd.exe" /c "C:\Users\Administrator.Oskar-PC\AppData\Roaming\System32\PXServiceNet.exe"
parent_process	wscript.exe				martian_process	cmd /c "C:\Users\Administrator.Oskar-PC\AppData\Roaming\System32\PXServiceNet.exe"

Resumed a suspended thread in a remote process potentially indicative of process injection (4 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2256 resumed a thread in remote process 3060
Process injection	Process 1948 resumed a thread in remote process 3380
1619152471.787626 NtResumeThread	thread_handle: 0x000003d0 suspend_count: 1 process_identifier: 3060	success	0	0
1619152500.817874 NtResumeThread	thread_handle: 0x000003d0 suspend_count: 1 process_identifier: 3380	success	0	0

Executed a process and injected code into it, probably while unpacking (50 out of 52 个事件)

Time & API	Arguments	Status	Return
1619152450.850626 NtResumeThread	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 2256	success	0
1619152450.865626 NtResumeThread	thread_handle: 0x0000012c suspend_count: 1 process_identifier: 2256	success	0
1619152450.881626 NtResumeThread	thread_handle: 0x00000170 suspend_count: 1 process_identifier: 2256	success	0
1619152453.147626 NtResumeThread	thread_handle: 0x000002b8 suspend_count: 1 process_identifier: 2256	success	0
1619152453.334626 NtResumeThread	thread_handle: 0x00000330 suspend_count: 1 process_identifier: 2256	success	0
1619152455.522626 NtResumeThread	thread_handle: 0x000003a0 suspend_count: 1 process_identifier: 2256	success	0
1619152470.834626 CreateProcessInternalW	thread_identifier: 2468 thread_handle: 0x000003ac process_identifier: 2340 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\01ed0a4bf1cc716a392069ab71bd796f.exe track: 1 command_line: filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\01ed0a4bf1cc716a392069ab71bd796f.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) process_handle: 0x000003b8 inherit_handles: 0	success	1
1619152470.834626 NtGetContextThread	thread_handle: 0x000003ac	success	0
1619152470.834626 NtAllocateVirtualMemory	process_identifier: 2340 region_size: 131072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x000003b8 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496
1619152471.209626 CreateProcessInternalW	thread_identifier: 1932 thread_handle: 0x000003c0 process_identifier: 1940 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\01ed0a4bf1cc716a392069ab71bd796f.exe track: 1 command_line: filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\01ed0a4bf1cc716a392069ab71bd796f.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) process_handle: 0x000003bc inherit_handles: 0	success	1
1619152471.209626 NtGetContextThread	thread_handle: 0x000003c0	success	0
1619152471.209626 NtAllocateVirtualMemory	process_identifier: 1940 region_size: 131072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x000003bc allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496
1619152471.537626 CreateProcessInternalW	thread_identifier: 2264 thread_handle: 0x000003d0 process_identifier: 3060 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\01ed0a4bf1cc716a392069ab71bd796f.exe track: 1 command_line: filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\01ed0a4bf1cc716a392069ab71bd796f.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) process_handle: 0x000003cc inherit_handles: 0	success	1
1619152471.537626 NtGetContextThread	thread_handle: 0x000003d0	success	0
1619152471.537626 NtAllocateVirtualMemory	process_identifier: 3060 region_size: 131072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x000003cc allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	success	0
1619152471.537626 WriteProcessMemory	process_identifier: 3060 buffer: process_handle: 0x000003cc base_address: 0x00400000	success	1
1619152471.537626 WriteProcessMemory	process_identifier: 3060 buffer: process_handle: 0x000003cc base_address: 0x00401000	success	1
1619152471.537626 WriteProcessMemory	process_identifier: 3060 buffer: process_handle: 0x000003cc base_address: 0x00414000	success	1
1619152471.537626 WriteProcessMemory	process_identifier: 3060 buffer: process_handle: 0x000003cc base_address: 0x0041a000	success	1
1619152471.537626 WriteProcessMemory	process_identifier: 3060 buffer: process_handle: 0x000003cc base_address: 0x0041c000	success	1
1619152471.537626 WriteProcessMemory	process_identifier: 3060 buffer: process_handle: 0x000003cc base_address: 0x0041d000	success	1
1619152471.537626 WriteProcessMemory	process_identifier: 3060 buffer: @ process_handle: 0x000003cc base_address: 0x7efde008	success	1
1619152471.537626 NtSetContextThread	thread_handle: 0x000003d0 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4275060 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 3060	success	0
1619152471.787626 NtResumeThread	thread_handle: 0x000003d0 suspend_count: 1 process_identifier: 3060	success	0
1619152472.959499 NtResumeThread	thread_handle: 0x000001e0 suspend_count: 1 process_identifier: 3060	success	0
1619152473.412499 CreateProcessInternalW	thread_identifier: 2968 thread_handle: 0x00000174 process_identifier: 2964 current_directory: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp filepath: C:\Windows\System32\wscript.exe track: 1 command_line: "C:\Windows\System32\WScript.exe" "C:\Users\ADMINI~1.OSK\AppData\Local\Temp\install.vbs" filepath_r: C:\Windows\System32\WScript.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) process_handle: 0x00000188 inherit_handles: 0	success	1
1619152476.881124 CreateProcessInternalW	thread_identifier: 920 thread_handle: 0x000002b0 process_identifier: 1208 current_directory: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp filepath: C:\Windows\System32\cmd.exe track: 1 command_line: "C:\Windows\System32\cmd.exe" /c "C:\Users\Administrator.Oskar-PC\AppData\Roaming\System32\PXServiceNet.exe" filepath_r: C:\Windows\System32\cmd.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) process_handle: 0x000002f8 inherit_handles: 0	success	1
1619152477.756124 CreateProcessInternalW	thread_identifier: 1804 thread_handle: 0x00000080 process_identifier: 1948 current_directory: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\System32\PXServiceNet.exe track: 1 command_line: C:\Users\Administrator.Oskar-PC\AppData\Roaming\System32\PXServiceNet.exe filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Roaming\System32\PXServiceNet.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) process_handle: 0x00000084 inherit_handles: 1	success	1
1619152478.692874 NtResumeThread	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 1948	success	0
1619152478.708874 NtResumeThread	thread_handle: 0x00000124 suspend_count: 1 process_identifier: 1948	success	0
1619152479.271874 NtResumeThread	thread_handle: 0x000001c4 suspend_count: 1 process_identifier: 1948	success	0
1619152481.911874 NtResumeThread	thread_handle: 0x000002ec suspend_count: 1 process_identifier: 1948	success	0
1619152482.271874 NtResumeThread	thread_handle: 0x0000033c suspend_count: 1 process_identifier: 1948	success	0
1619152484.442874 NtResumeThread	thread_handle: 0x000003a4 suspend_count: 1 process_identifier: 1948	success	0
1619152499.802874 CreateProcessInternalW	thread_identifier: 3260 thread_handle: 0x000003b8 process_identifier: 3256 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\System32\PXServiceNet.exe track: 1 command_line: filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Roaming\System32\PXServiceNet.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) process_handle: 0x000003b0 inherit_handles: 0	success	1
1619152499.802874 NtGetContextThread	thread_handle: 0x000003b8	success	0
1619152499.802874 NtAllocateVirtualMemory	process_identifier: 3256 region_size: 131072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x000003b0 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496
1619152500.114874 CreateProcessInternalW	thread_identifier: 3320 thread_handle: 0x000003c0 process_identifier: 3316 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\System32\PXServiceNet.exe track: 1 command_line: filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Roaming\System32\PXServiceNet.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) process_handle: 0x000003bc inherit_handles: 0	success	1
1619152500.130874 NtGetContextThread	thread_handle: 0x000003c0	success	0
1619152500.130874 NtAllocateVirtualMemory	process_identifier: 3316 region_size: 131072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x000003bc allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496
1619152500.552874 CreateProcessInternalW	thread_identifier: 3384 thread_handle: 0x000003d0 process_identifier: 3380 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\System32\PXServiceNet.exe track: 1 command_line: filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Roaming\System32\PXServiceNet.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) process_handle: 0x000003cc inherit_handles: 0	success	1
1619152500.552874 NtGetContextThread	thread_handle: 0x000003d0	success	0
1619152500.552874 NtAllocateVirtualMemory	process_identifier: 3380 region_size: 131072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x000003cc allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	success	0
1619152500.552874 WriteProcessMemory	process_identifier: 3380 buffer: process_handle: 0x000003cc base_address: 0x00400000	success	1
1619152500.552874 WriteProcessMemory	process_identifier: 3380 buffer: process_handle: 0x000003cc base_address: 0x00401000	success	1
1619152500.552874 WriteProcessMemory	process_identifier: 3380 buffer: process_handle: 0x000003cc base_address: 0x00414000	success	1
1619152500.552874 WriteProcessMemory	process_identifier: 3380 buffer: process_handle: 0x000003cc base_address: 0x0041a000	success	1
1619152500.552874 WriteProcessMemory	process_identifier: 3380 buffer: process_handle: 0x000003cc base_address: 0x0041c000	success	1
1619152500.552874 WriteProcessMemory	process_identifier: 3380 buffer: process_handle: 0x000003cc base_address: 0x0041d000	success	1
1619152500.552874 WriteProcessMemory	process_identifier: 3380 buffer: @ process_handle: 0x000003cc base_address: 0x7efde008	success	1

File has been identified by 56 AntiVirus engines on VirusTotal as malicious (50 out of 56 个事件)

Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Razy.705390
FireEye	Generic.mg.01ed0a4bf1cc716a
CAT-QuickHeal	Trojan.Agent
McAfee	Artemis!01ED0A4BF1CC
Cylance	Unsafe
Zillya	Backdoor.Remcos.Win32.3466
Sangfor	Malware
K7AntiVirus	Trojan ( 005698ac1 )
Alibaba	Trojan:Win32/Kryptik.ali2000016
K7GW	Trojan ( 005698ac1 )
Cybereason	malicious.04f6f4
Arcabit	Trojan.Razy.DAC36E
Cyren	W32/Trojan.BHJP-8112
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Paloalto	generic.ml
Kaspersky	HEUR:Backdoor.MSIL.Remcos.gen
BitDefender	Gen:Variant.Razy.705390
NANO-Antivirus	Trojan.Win32.Remcos.hnasui
Avast	Win32:Trojan-gen
Tencent	Win32.Trojan.Inject.Auto
Ad-Aware	Gen:Variant.Razy.705390
Emsisoft	Gen:Variant.Razy.705390 (B)
Comodo	Malware@#2fbmuthzsj50a
F-Secure	Trojan.TR/AD.Remcos.owaru
DrWeb	Trojan.DownLoader33.59481
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	TROJ_GEN.R066C0DJ720
McAfee-GW-Edition	BehavesLike.Win32.Generic.bh
Sophos	Mal/Generic-S
Ikarus	Trojan.MSIL.Krypt
Jiangmin	Backdoor.MSIL.dhpp
Avira	TR/AD.Remcos.owaru
Antiy-AVL	Trojan[Backdoor]/MSIL.Remcos
Kingsoft	Win32.Hack.Undef.(kcloud)
Microsoft	Backdoor:MSIL/Remcos.VN!MTB
AegisLab	Trojan.Win32.Remcos.4!c
ZoneAlarm	HEUR:Backdoor.MSIL.Remcos.gen
GData	Gen:Variant.Razy.705390
Cynet	Malicious (score: 100)
AhnLab-V3	Malware/Win32.RL_Generic.C4160950
BitDefenderTheta	Gen:NN.ZemsilF.34700.Tm0@aKIUCiji
ALYac	Gen:Variant.Razy.705390
MAX	malware (ai score=84)
VBA32	TScope.Trojan.MSIL
Malwarebytes	Backdoor.Remcos
ESET-NOD32	a variant of MSIL/GenKryptik.ENEA
TrendMicro-HouseCall	TROJ_GEN.R066C0DJ720
SentinelOne	Static AI - Malicious PE

The process wscript.exe wrote an executable file to disk which it then attempted to execute (2 个事件)

file	C:\Windows\SysWOW64\wscript.exe
file	C:\Windows\System32\cmd.exe

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-06-25 02:41:43

Imports

Library mscoree.dll:

• 0x402000 _CorExeMain

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
recuperaciondecartera.website
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	50534	114.114.114.114	53
192.168.56.101	51808	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	58367	114.114.114.114	53
192.168.56.101	65004	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	55368	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	56540	239.255.255.250	3702
192.168.56.101	56807	239.255.255.250	1900
192.168.56.101	58368	239.255.255.250	3702
192.168.56.101	58370	239.255.255.250	3702
192.168.56.101	58707	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.