SmartHawk

10.8

0-day

30 个模型检测该样本为恶意！

重新分析

下载样本

f1f2497dedda66c14a49c6ed901268d6043546d83eebbc963c9f94469869a042

2cba1661b8baa7136b5c77d3c97e3c62.exe

分析耗时

130s

最近分析

文件大小

7.4MB

静态报毒动态报毒 100% ADVANCEDPCCARE ARTEMIS CONFIDENCE DECEPTOR DECEPTPCCLEAN DUOFFER FNGCPK GENERIC PUA DC GT32SUPPORTGEEKS HACKTOOL HIGH CONFIDENCE HOAX HUQC PCCLEANER PCFIXER PCVARK SYSTEMOPTIMIZER UNSAFE 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee		20210210	6.0.6.653
Baidu		20190318	1.0.0.2
Avast		20210210	21.1.5827.0
Alibaba	RiskWare:Win32/PCFixer.06ae2d9f	20190527	0.3.0.5
Kingsoft		20210210	2017.9.26.565
Tencent	Win32.Trojan-psw.Deceptpcclean.Huqc	20210210	1.0.0.1
CrowdStrike	win/malicious_confidence_100% (D)	20210203	1.0

Queries for the computername (46 个事件)

Time & API	Arguments	Status	Return
1620126396.552126 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620126400.412126 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620126400.443126 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620126404.443126 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620126404.443126 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620126404.630126 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620126406.802126 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620126407.584126 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620126408.334126 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620126408.709126 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620126408.912126 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620126409.084126 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620126409.599126 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620126409.599126 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620126409.599126 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620126409.599126 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620126409.599126 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620126420.787876 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620126421.099876 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620126397.709751 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620125993.931022 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620125994.463022 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620125994.478022 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620125994.494022 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620125995.494022 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620125995.509022 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620126004.447022 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620126004.463022 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620126004.463022 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620126004.494022 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620126004.494022 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620126004.509022 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620126004.556022 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620126005.009022 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620126005.025022 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620126005.041022 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620126005.056022 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620126005.056022 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620126005.072022 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620126017.947022 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620126017.963022 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620126021.697022 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620126023.103022 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620126034.572022 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620126037.228022 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620126039.681022 GetComputerNameW	computer_name: OSKAR-PC	success	1

Checks if process is being debugged by a debugger (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1620119616.557139 IsDebuggerPresent		failed	0	0
1620125984.259022 IsDebuggerPresent		failed	0	0

Command line console output was observed (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620126398.005751 WriteConsoleW	buffer: 错误: 没有找到进程 "iytr.exe"。 console_handle: 0x0000000b	success	1	0

Uses Windows APIs to generate a cryptographic key (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1620125995.853022 CryptExportKey	crypto_handle: 0x000000001b2dc920 crypto_export_handle: 0x0000000000000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1	0
1620126005.900022 CryptExportKey	crypto_handle: 0x000000001b322f00 crypto_export_handle: 0x0000000000000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1	0

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 个事件)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

This executable is signed

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620126396.959126 GlobalMemoryStatusEx		success	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 个事件)

section

.itext

Allocates read-write-execute memory (usually to unpack itself) (50 out of 403 个事件)

Time & API	Arguments	Status
1620119616.057139 NtProtectVirtualMemory	process_identifier: 1476 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00400000	success
1620119616.057139 NtProtectVirtualMemory	process_identifier: 1476 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 69632 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00401000	success
1620119616.057139 NtProtectVirtualMemory	process_identifier: 1476 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 102400 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x0041b000	success
1620126395.334126 NtAllocateVirtualMemory	process_identifier: 3068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00550000	success
1620126467.427876 NtAllocateVirtualMemory	process_identifier: 1424 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0000000004030000	success
1620125980.900022 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 589824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00000000006d0000	success
1620125980.900022 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00000000006e0000	success
1620125982.775022 NtProtectVirtualMemory	process_identifier: 2440 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff base_address: 0x000007fef1531000	success
1620125983.900022 NtProtectVirtualMemory	process_identifier: 2440 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff base_address: 0x000007fef17ae000	success
1620125983.900022 NtProtectVirtualMemory	process_identifier: 2440 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff base_address: 0x000007fef17ae000	success
1620125984.338022 NtProtectVirtualMemory	process_identifier: 2440 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff base_address: 0x000007fef17af000	success
1620125984.353022 NtProtectVirtualMemory	process_identifier: 2440 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff base_address: 0x000007fef17af000	success
1620125984.353022 NtProtectVirtualMemory	process_identifier: 2440 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff base_address: 0x000007fef17af000	success
1620125984.353022 NtProtectVirtualMemory	process_identifier: 2440 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff base_address: 0x000007fef17af000	success
1620125984.369022 NtProtectVirtualMemory	process_identifier: 2440 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff base_address: 0x000007fef17af000	success
1620125984.369022 NtProtectVirtualMemory	process_identifier: 2440 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff base_address: 0x000007fef17af000	success
1620125984.369022 NtProtectVirtualMemory	process_identifier: 2440 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff base_address: 0x000007fef17af000	success
1620125984.369022 NtProtectVirtualMemory	process_identifier: 2440 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff base_address: 0x000007fef17af000	success
1620125984.369022 NtProtectVirtualMemory	process_identifier: 2440 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff base_address: 0x000007fef17b0000	success
1620125984.369022 NtProtectVirtualMemory	process_identifier: 2440 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff base_address: 0x000007fef17b0000	success
1620125984.384022 NtProtectVirtualMemory	process_identifier: 2440 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff base_address: 0x000007fef17b0000	success
1620125984.384022 NtProtectVirtualMemory	process_identifier: 2440 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff base_address: 0x000007fef17b0000	success
1620125984.384022 NtProtectVirtualMemory	process_identifier: 2440 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff base_address: 0x000007fef17b0000	success
1620125984.384022 NtProtectVirtualMemory	process_identifier: 2440 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff base_address: 0x000007fef17b1000	success
1620125984.384022 NtProtectVirtualMemory	process_identifier: 2440 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff base_address: 0x000007fef17b1000	success
1620125984.384022 NtProtectVirtualMemory	process_identifier: 2440 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff base_address: 0x000007fef17b1000	success
1620125984.400022 NtProtectVirtualMemory	process_identifier: 2440 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff base_address: 0x000007fef17b1000	success
1620125984.400022 NtProtectVirtualMemory	process_identifier: 2440 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff base_address: 0x000007fef17ae000	success
1620125985.181022 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x000007ff00022000	success
1620125985.478022 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 589824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) base_address: 0x000007fffff10000	success
1620125985.478022 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x000007fffff10000	success
1620125985.478022 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x000007fffff10000	success
1620125985.494022 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) base_address: 0x000007fffff00000	success
1620125985.494022 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x000007fffff00000	success
1620125985.494022 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x000007ff000da000	success
1620125985.525022 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x000007ff00012000	success
1620125985.900022 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x000007ff00023000	success
1620125985.900022 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x000007ff00024000	success
1620125986.056022 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x000007ff000ea000	success
1620125986.056022 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x000007ff00112000	success
1620125986.056022 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x000007ff000ed000	success
1620125986.431022 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x000007ff0002c000	success
1620125986.791022 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x000007ff00170000	success
1620125987.525022 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x000007ff00025000	success
1620125988.713022 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x000007ff00026000	success
1620125989.103022 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x000007ff00028000	success
1620125989.525022 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x000007ff00029000	success
1620125989.556022 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x000007ff001b0000	success
1620125990.259022 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x000007ff0003f000	success
1620125990.275022 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x000007ff00074000	success

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620126421.459876 GetDiskFreeSpaceExW	root_path: C:\Users\Administrator.Oskar-PC\AppData\Local\Microsoft\Windows\Explorer free_bytes_available: 19452923904 total_number_of_free_bytes: 0 total_number_of_bytes: 0	success	1	0

Creates executable files on the filesystem (6 个事件)

file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Auto ~PC -Speedup for OSKAR-PC\Auto ~PC -Speedup.lnk
file	C:\Users\Public\Desktop\Auto ~PC -Speedup.lnk
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\is-PHPBP.tmp\_isetup\_iscrypt.dll
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Auto ~PC -Speedup for OSKAR-PC\Uninstall Auto ~PC -Speedup.lnk
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\is-PHPBP.tmp\_isetup\_shfoldr.dll
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Auto ~PC -Speedup for OSKAR-PC\Buy Auto ~PC -Speedup.lnk

Creates a shortcut to an executable file (6 个事件)

file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Auto ~PC -Speedup for OSKAR-PC\Auto ~PC -Speedup.lnk
file	C:\Users\Public\Desktop\Auto ~PC -Speedup.lnk
file	C:\Program Files\Auto ~PC -Speedup for OSKAR-PC\Buy Auto ~PC -Speedup.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Auto ~PC -Speedup for OSKAR-PC\Uninstall Auto ~PC -Speedup.lnk
file	C:\Users\Public\Desktop\Google Chrome.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Auto ~PC -Speedup for OSKAR-PC\Buy Auto ~PC -Speedup.lnk

Executes one or more WMI queries (1 个事件)

wmi	SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "iytr.exe")

A process created a hidden window (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620126397.177126 ShellExecuteExW	parameters: /f /im "iytr.exe" filepath: taskkill.exe filepath_r: taskkill.exe show_type: 0	success	1	0

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1620126397.709751 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1	0
1620126042.400022 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1	0

Queries for potentially installed applications (10 个事件)

Time & API	Arguments	Status	Return
1620126400.412126 RegOpenKeyExW	access: 0x00000101 base_handle: 0x80000001 key_handle: 0x00000000 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\{DE9FABA7-532E-4BF3-A570-195E17113065}_is1 regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\{DE9FABA7-532E-4BF3-A570-195E17113065}_is1 options: 0	failed	2
1620126400.412126 RegOpenKeyExW	access: 0x00000101 base_handle: 0x80000002 key_handle: 0x00000000 regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{DE9FABA7-532E-4BF3-A570-195E17113065}_is1 regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\{DE9FABA7-532E-4BF3-A570-195E17113065}_is1 options: 0	failed	2
1620126400.443126 RegOpenKeyExW	access: 0x00000101 base_handle: 0x80000002 key_handle: 0x00000000 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Avast regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Avast options: 0	failed	2
1620126400.443126 RegOpenKeyExW	access: 0x00000101 base_handle: 0x80000002 key_handle: 0x00000000 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Avast Antivirus regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Avast Antivirus options: 0	failed	2
1620126400.443126 RegOpenKeyExW	access: 0x00000101 base_handle: 0x80000002 key_handle: 0x00000000 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4CB91122-AA85-4431-953C-BEFAEC86DA97}_is1 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4CB91122-AA85-4431-953C-BEFAEC86DA97}_is1 options: 0	failed	2
1620126400.443126 RegOpenKeyExW	access: 0x00000101 base_handle: 0x80000002 key_handle: 0x00000000 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Avast Antivirus regkey_r: SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Avast Antivirus options: 0	failed	2
1620126400.443126 RegOpenKeyExW	access: 0x00000101 base_handle: 0x80000002 key_handle: 0x00000000 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Avast regkey_r: SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Avast options: 0	failed	2
1620126400.443126 RegOpenKeyExW	access: 0x00000101 base_handle: 0x80000002 key_handle: 0x00000000 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AVG Antivirus regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AVG Antivirus options: 0	failed	2
1620126409.599126 RegOpenKeyExW	access: 0x00000108 base_handle: 0x80000001 key_handle: 0x00000000 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\{DE9FABA7-532E-4BF3-A570-195E17113065}_is1 regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\{DE9FABA7-532E-4BF3-A570-195E17113065}_is1 options: 0	failed	2
1620126409.599126 RegOpenKeyExW	access: 0x00000108 base_handle: 0x80000002 key_handle: 0x00000000 regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{DE9FABA7-532E-4BF3-A570-195E17113065}_is1 regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\{DE9FABA7-532E-4BF3-A570-195E17113065}_is1 options: 0	failed	2

Uses Windows utilities for basic Windows functionality (2 个事件)

cmdline	taskkill.exe /f /im "iytr.exe"
cmdline	"C:\Windows\System32\taskkill.exe" /f /im "iytr.exe"

Communicates with host for which no DNS query was performed (4 个事件)

host	151.139.128.14
host	172.217.24.14
host	203.208.40.98
host	222.216.123.6

Attempts to identify installed AV products by registry key (6 个事件)

registry	HKEY_LOCAL_MACHINE\SOFTWARE\AVG\Antivirus
registry	HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\AVG\Antivirus
registry	HKEY_LOCAL_MACHINE\SOFTWARE\AVG\AV\Dir
registry	HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\AVG\AV\Dir
registry	HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast\Version
registry	HKEY_LOCAL_MACHINE\SOFTWARE\AVAST Software\Avast

A process performed obfuscation on information about the computer or sent it to a remote location indicative of CnC Traffic/Preperations. (20 个事件)

Time & API	Arguments	Status	Return
1620125993.494022 CryptHashData	buffer: ÿÿÿÿ@FILE:///C:/PROGRAM FILES/AUTO ~PC -SPEEDUP FOR OSKAR-PC/IYTR.EXE flags: 0 hash_handle: 0x000000001b2dc290	success	1
1620125993.494022 CryptHashData	buffer: ÿÿÿÿ@FILE:///C:/PROGRAM FILES/AUTO ~PC -SPEEDUP FOR OSKAR-PC/IYTR.EXE flags: 0 hash_handle: 0x000000001b2dc290	success	1
1620125993.494022 CryptHashData	buffer: ÿÿÿÿ@FILE:///C:/PROGRAM FILES/AUTO ~PC -SPEEDUP FOR OSKAR-PC/IYTR.EXE flags: 0 hash_handle: 0x000000001b2dc290	success	1
1620125993.494022 CryptHashData	buffer: ÿÿÿÿ@FILE:///C:/PROGRAM FILES/AUTO ~PC -SPEEDUP FOR OSKAR-PC/IYTR.EXE flags: 0 hash_handle: 0x000000001b2dc290	success	1
1620125993.494022 CryptHashData	buffer: ÿÿÿÿ@FILE:///C:/PROGRAM FILES/AUTO ~PC -SPEEDUP FOR OSKAR-PC/IYTR.EXE flags: 0 hash_handle: 0x000000001b2dc290	success	1
1620125993.494022 CryptHashData	buffer: ÿÿÿÿ@FILE:///C:/PROGRAM FILES/AUTO ~PC -SPEEDUP FOR OSKAR-PC/IYTR.EXE flags: 0 hash_handle: 0x000000001b2dc290	success	1
1620125993.494022 CryptHashData	buffer: ÿÿÿÿ@FILE:///C:/PROGRAM FILES/AUTO ~PC -SPEEDUP FOR OSKAR-PC/IYTR.EXE flags: 0 hash_handle: 0x000000001b2dc290	success	1
1620125993.494022 CryptHashData	buffer: ÿÿÿÿ@FILE:///C:/PROGRAM FILES/AUTO ~PC -SPEEDUP FOR OSKAR-PC/IYTR.EXE flags: 0 hash_handle: 0x000000001b2dc290	success	1
1620125993.494022 CryptHashData	buffer: ÿÿÿÿ@FILE:///C:/PROGRAM FILES/AUTO ~PC -SPEEDUP FOR OSKAR-PC/IYTR.EXE flags: 0 hash_handle: 0x000000001b2dc290	success	1
1620125993.494022 CryptHashData	buffer: ÿÿÿÿ@FILE:///C:/PROGRAM FILES/AUTO ~PC -SPEEDUP FOR OSKAR-PC/IYTR.EXE flags: 0 hash_handle: 0x000000001b2dc290	success	1
1620125993.494022 CryptHashData	buffer: ÿÿÿÿ@FILE:///C:/PROGRAM FILES/AUTO ~PC -SPEEDUP FOR OSKAR-PC/IYTR.EXE flags: 0 hash_handle: 0x000000001b2dc290	success	1
1620125993.494022 CryptHashData	buffer: ÿÿÿÿ@FILE:///C:/PROGRAM FILES/AUTO ~PC -SPEEDUP FOR OSKAR-PC/IYTR.EXE flags: 0 hash_handle: 0x000000001b2dc290	success	1
1620125993.494022 CryptHashData	buffer: ÿÿÿÿ@FILE:///C:/PROGRAM FILES/AUTO ~PC -SPEEDUP FOR OSKAR-PC/IYTR.EXE flags: 0 hash_handle: 0x000000001b2dc290	success	1
1620125993.494022 CryptHashData	buffer: ÿÿÿÿ@FILE:///C:/PROGRAM FILES/AUTO ~PC -SPEEDUP FOR OSKAR-PC/IYTR.EXE flags: 0 hash_handle: 0x000000001b2dc290	success	1
1620125993.494022 CryptHashData	buffer: ÿÿÿÿ@FILE:///C:/PROGRAM FILES/AUTO ~PC -SPEEDUP FOR OSKAR-PC/IYTR.EXE flags: 0 hash_handle: 0x000000001b2dc290	success	1
1620125993.494022 CryptHashData	buffer: ÿÿÿÿ@FILE:///C:/PROGRAM FILES/AUTO ~PC -SPEEDUP FOR OSKAR-PC/IYTR.EXE flags: 0 hash_handle: 0x000000001b2dc290	success	1
1620125993.494022 CryptHashData	buffer: ÿÿÿÿ@FILE:///C:/PROGRAM FILES/AUTO ~PC -SPEEDUP FOR OSKAR-PC/IYTR.EXE flags: 0 hash_handle: 0x000000001b2dc290	success	1
1620125993.494022 CryptHashData	buffer: ÿÿÿÿ@FILE:///C:/PROGRAM FILES/AUTO ~PC -SPEEDUP FOR OSKAR-PC/IYTR.EXE flags: 0 hash_handle: 0x000000001b2dc290	success	1
1620125993.494022 CryptHashData	buffer: ÿÿÿÿ@FILE:///C:/PROGRAM FILES/AUTO ~PC -SPEEDUP FOR OSKAR-PC/IYTR.EXE flags: 0 hash_handle: 0x000000001b2dc290	success	1
1620125993.494022 CryptHashData	buffer: ÿÿÿÿ@FILE:///C:/PROGRAM FILES/AUTO ~PC -SPEEDUP FOR OSKAR-PC/IYTR.EXE flags: 0 hash_handle: 0x000000001b2dc290	success	1

Detects VirtualBox through the presence of a file (1 个事件)

file	c:\Windows\System32\VBoxTray.exe

Generates some ICMP traffic

File has been identified by 30 AntiVirus engines on VirusTotal as malicious (30 个事件)

Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Application.Deceptor.Slv.1
FireEye	Generic.mg.2cba1661b8baa713
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
K7AntiVirus	Adware ( 005494271 )
K7GW	Adware ( 005494271 )
Cybereason	malicious.1b8baa
Symantec	PUA.AdvancedPCCare
ESET-NOD32	a variant of Win32/GT32SupportGeeks.U potentially unwanted
Alibaba	RiskWare:Win32/PCFixer.06ae2d9f
NANO-Antivirus	Riskware.Win32.PCFixer.fngcpk
ViRobot	Adware.Pcfixer.7777992
Ad-Aware	Gen:Variant.Application.Deceptor.Slv.1
Sophos	Generic PUA DC (PUA)
DrWeb	Program.Unwanted.3692
McAfee-GW-Edition	Artemis
Emsisoft	Application.PCFixer (A)
Gridinsoft	PUP.SystemOptimizer.vl!c
Arcabit	Trojan.Application.Deceptor.Slv.1
AegisLab	Hacktool.Win32.DeceptPCClean.3!c
ZoneAlarm	Hoax.Win32.DeceptPCClean.fvl
ALYac	Gen:Variant.Application.Deceptor.Slv.1
Malwarebytes	PUP.Optional.PCVARK
Panda	PUP/PCCleaner
Tencent	Win32.Trojan-psw.Deceptpcclean.Huqc
Fortinet	Riskware/PCFixer
Webroot	W32.Adware.Gen
AVG	Win32:DUOffer-A [Dcp]
CrowdStrike	win/malicious_confidence_100% (D)

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (2 个事件)

dead_host	203.208.40.98:443
dead_host	192.168.56.101:49211

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2016-01-15 16:22:50

Imports

Library oleaut32.dll:

• 0x4192fc SysFreeString

• 0x419300 SysReAllocStringLen

• 0x419304 SysAllocStringLen

Library advapi32.dll:

• 0x41930c RegQueryValueExW

• 0x419310 RegOpenKeyExW

• 0x419314 RegCloseKey

Library user32.dll:

• 0x41931c GetKeyboardType

• 0x419320 LoadStringW

• 0x419324 MessageBoxA

• 0x419328 CharNextW

Library kernel32.dll:

• 0x419330 GetACP

• 0x419334 Sleep

• 0x419338 VirtualFree

• 0x41933c VirtualAlloc

• 0x419340 GetSystemInfo

• 0x419344 GetTickCount

• 0x419348 QueryPerformanceCounter

• 0x41934c GetVersion

• 0x419350 GetCurrentThreadId

• 0x419354 VirtualQuery

• 0x419358 WideCharToMultiByte

• 0x41935c MultiByteToWideChar

• 0x419360 lstrlenW

• 0x419364 lstrcpynW

• 0x419368 LoadLibraryExW

• 0x41936c GetThreadLocale

• 0x419370 GetStartupInfoA

• 0x419374 GetProcAddress

• 0x419378 GetModuleHandleW

• 0x41937c GetModuleFileNameW

• 0x419380 GetLocaleInfoW

• 0x419384 GetCommandLineW

• 0x419388 FreeLibrary

• 0x41938c FindFirstFileW

• 0x419390 FindClose

• 0x419394 ExitProcess

• 0x419398 WriteFile

• 0x41939c UnhandledExceptionFilter

• 0x4193a0 RtlUnwind

• 0x4193a4 RaiseException

• 0x4193a8 GetStdHandle

• 0x4193ac CloseHandle

Library kernel32.dll:

• 0x4193b4 TlsSetValue

• 0x4193b8 TlsGetValue

• 0x4193bc LocalAlloc

• 0x4193c0 GetModuleHandleW

Library user32.dll:

• 0x4193c8 CreateWindowExW

• 0x4193cc TranslateMessage

• 0x4193d0 SetWindowLongW

• 0x4193d4 PeekMessageW

• 0x4193d8 MsgWaitForMultipleObjects

• 0x4193dc MessageBoxW

• 0x4193e0 LoadStringW

• 0x4193e4 GetSystemMetrics

• 0x4193e8 ExitWindowsEx

• 0x4193ec DispatchMessageW

• 0x4193f0 DestroyWindow

• 0x4193f4 CharUpperBuffW

• 0x4193f8 CallWindowProcW

Library kernel32.dll:

• 0x419400 WriteFile

• 0x419404 WideCharToMultiByte

• 0x419408 WaitForSingleObject

• 0x41940c VirtualQuery

• 0x419410 VirtualProtect

• 0x419414 VirtualFree

• 0x419418 VirtualAlloc

• 0x41941c SizeofResource

• 0x419420 SignalObjectAndWait

• 0x419424 SetLastError

• 0x419428 SetFilePointer

• 0x41942c SetEvent

• 0x419430 SetErrorMode

• 0x419434 SetEndOfFile

• 0x419438 ResetEvent

• 0x41943c RemoveDirectoryW

• 0x419440 ReadFile

• 0x419444 MultiByteToWideChar

• 0x419448 LockResource

• 0x41944c LoadResource

• 0x419450 LoadLibraryW

• 0x419454 GetWindowsDirectoryW

• 0x419458 GetVersionExW

• 0x41945c GetUserDefaultLangID

• 0x419460 GetThreadLocale

• 0x419464 GetSystemInfo

• 0x419468 GetStdHandle

• 0x41946c GetProcAddress

• 0x419470 GetModuleHandleW

• 0x419474 GetModuleFileNameW

• 0x419478 GetLocaleInfoW

• 0x41947c GetLastError

• 0x419480 GetFullPathNameW

• 0x419484 GetFileSize

• 0x419488 GetFileAttributesW

• 0x41948c GetExitCodeProcess

• 0x419490 GetEnvironmentVariableW

• 0x419494 GetDiskFreeSpaceW

• 0x419498 GetCurrentProcess

• 0x41949c GetCommandLineW

• 0x4194a0 GetCPInfo

• 0x4194a4 InterlockedExchange

• 0x4194a8 InterlockedCompareExchange

• 0x4194ac FreeLibrary

• 0x4194b0 FormatMessageW

• 0x4194b4 FindResourceW

• 0x4194b8 EnumCalendarInfoW

• 0x4194bc DeleteFileW

• 0x4194c0 CreateProcessW

• 0x4194c4 CreateFileW

• 0x4194c8 CreateEventW

• 0x4194cc CreateDirectoryW

• 0x4194d0 CloseHandle

Library advapi32.dll:

• 0x4194d8 RegQueryValueExW

• 0x4194dc RegOpenKeyExW

• 0x4194e0 RegCloseKey

• 0x4194e4 OpenProcessToken

• 0x4194e8 LookupPrivilegeValueW

Library comctl32.dll:

• 0x4194f0 InitCommonControls

Library kernel32.dll:

• 0x4194f8 Sleep

Library advapi32.dll:

• 0x419500 AdjustTokenPrivileges

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	50534	114.114.114.114	53
192.168.56.101	51808	114.114.114.114	53
192.168.56.101	55368	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	58367	114.114.114.114	53
192.168.56.101	63429	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	51963	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	65004	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	51809	239.255.255.250	3702
192.168.56.101	51811	239.255.255.250	3702
192.168.56.101	56540	239.255.255.250	3702
192.168.56.101	56807	239.255.255.250	1900
192.168.56.101	58707	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.