SmartHawk

8.4

高危

该样本未表现出任何异常！

重新分析

下载样本

26c5098fbb4be4871383a901013288d16a6a2aad7d0952c28fd888e080aea394

30d8b124d51fdb2e5eaeffa3f3866a8a.exe

分析耗时

83s

最近分析

文件大小

397.5KB

静态报毒动态报毒

未检测暂无鹰眼引擎检测结果

未检测暂无反病毒引擎检测结果

Queries for the computername (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619380963.274375 GetComputerNameW	computer_name: OSKAR-PC	success	1	0

Checks if process is being debugged by a debugger (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619340498.233625 IsDebuggerPresent		failed	0	0
1619340498.233625 IsDebuggerPresent		failed	0	0

Command line console output was observed (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619380969.165375 WriteConsoleW	buffer: 成功: 成功创建计划任务 "Updates\epuVYVfu"。 console_handle: 0x00000007	success	1	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619340498.265625 GlobalMemoryStatusEx		success	1	0

Allocates read-write-execute memory (usually to unpack itself) (50 out of 62 个事件)

Time & API	Arguments	Status
1619340497.312625 NtAllocateVirtualMemory	process_identifier: 1804 region_size: 1703936 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x009f0000	success
1619340497.312625 NtAllocateVirtualMemory	process_identifier: 1804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00b50000	success
1619340497.952625 NtAllocateVirtualMemory	process_identifier: 1804 region_size: 851968 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00440000	success
1619340497.952625 NtAllocateVirtualMemory	process_identifier: 1804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004d0000	success
1619340497.968625 NtProtectVirtualMemory	process_identifier: 1804 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73b91000	success
1619340498.233625 NtAllocateVirtualMemory	process_identifier: 1804 region_size: 589824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x005e0000	success
1619340498.233625 NtAllocateVirtualMemory	process_identifier: 1804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00630000	success
1619340498.249625 NtAllocateVirtualMemory	process_identifier: 1804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0039a000	success
1619340498.249625 NtProtectVirtualMemory	process_identifier: 1804 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73b92000	success
1619340498.249625 NtAllocateVirtualMemory	process_identifier: 1804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00392000	success
1619340498.468625 NtAllocateVirtualMemory	process_identifier: 1804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003a2000	success
1619340498.562625 NtAllocateVirtualMemory	process_identifier: 1804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003c5000	success
1619340498.562625 NtAllocateVirtualMemory	process_identifier: 1804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003cb000	success
1619340498.562625 NtAllocateVirtualMemory	process_identifier: 1804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003c7000	success
1619340498.718625 NtAllocateVirtualMemory	process_identifier: 1804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003a3000	success
1619340498.733625 NtAllocateVirtualMemory	process_identifier: 1804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003ac000	success
1619340499.483625 NtAllocateVirtualMemory	process_identifier: 1804 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003a4000	success
1619340499.483625 NtAllocateVirtualMemory	process_identifier: 1804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003a6000	success
1619340499.640625 NtAllocateVirtualMemory	process_identifier: 1804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005f0000	success
1619340499.796625 NtAllocateVirtualMemory	process_identifier: 1804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003a7000	success
1619340499.937625 NtAllocateVirtualMemory	process_identifier: 1804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003b6000	success
1619340499.937625 NtAllocateVirtualMemory	process_identifier: 1804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003ba000	success
1619340499.937625 NtAllocateVirtualMemory	process_identifier: 1804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003b7000	success
1619340500.093625 NtAllocateVirtualMemory	process_identifier: 1804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003a8000	success
1619340504.796625 NtAllocateVirtualMemory	process_identifier: 1804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005f1000	success
1619340504.890625 NtAllocateVirtualMemory	process_identifier: 1804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00631000	success
1619340504.905625 NtAllocateVirtualMemory	process_identifier: 1804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00632000	success
1619340504.905625 NtAllocateVirtualMemory	process_identifier: 1804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00633000	success
1619340504.937625 NtAllocateVirtualMemory	process_identifier: 1804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003a9000	success
1619340504.952625 NtAllocateVirtualMemory	process_identifier: 1804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005f2000	success
1619340504.968625 NtAllocateVirtualMemory	process_identifier: 1804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00634000	success
1619340504.968625 NtAllocateVirtualMemory	process_identifier: 1804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00635000	success
1619340505.015625 NtAllocateVirtualMemory	process_identifier: 1804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005f3000	success
1619340505.015625 NtAllocateVirtualMemory	process_identifier: 1804 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00636000	success
1619340505.015625 NtAllocateVirtualMemory	process_identifier: 1804 region_size: 69632 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0063a000	success
1619340505.030625 NtAllocateVirtualMemory	process_identifier: 1804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003aa000	success
1619340505.452625 NtAllocateVirtualMemory	process_identifier: 1804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x008b0000	success
1619340505.452625 NtAllocateVirtualMemory	process_identifier: 1804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x008b1000	success
1619340505.796625 NtAllocateVirtualMemory	process_identifier: 1804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005f4000	success
1619340505.921625 NtAllocateVirtualMemory	process_identifier: 1804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x008b2000	success
1619340505.968625 NtAllocateVirtualMemory	process_identifier: 1804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x008b3000	success
1619340505.983625 NtAllocateVirtualMemory	process_identifier: 1804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003ad000	success
1619340505.999625 NtAllocateVirtualMemory	process_identifier: 1804 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005f5000	success
1619340506.015625 NtAllocateVirtualMemory	process_identifier: 1804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005f8000	success
1619340506.030625 NtAllocateVirtualMemory	process_identifier: 1804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004d1000	success
1619340506.280625 NtAllocateVirtualMemory	process_identifier: 1804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x008b4000	success
1619340506.280625 NtAllocateVirtualMemory	process_identifier: 1804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005f9000	success
1619340506.280625 NtAllocateVirtualMemory	process_identifier: 1804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0064b000	success
1619340506.280625 NtAllocateVirtualMemory	process_identifier: 1804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0064c000	success
1619340506.312625 NtAllocateVirtualMemory	process_identifier: 1804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0064d000	success

Creates a suspicious process (2 个事件)

cmdline	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\epuVYVfu" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmpB447.tmp"
cmdline	schtasks.exe /Create /TN "Updates\epuVYVfu" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmpB447.tmp"

A process created a hidden window (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619340509.702625 ShellExecuteExW	parameters: /Create /TN "Updates\epuVYVfu" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmpB447.tmp" filepath: schtasks.exe filepath_r: schtasks.exe show_type: 0	success	1	0

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

7.95094789344893

section

{'size_of_data': '0x00062c00', 'virtual_address': '0x00002000', 'entropy': 7.95094789344893, 'name': '.text', 'virtual_size': '0x00062bf8'}

description

A section with a high entropy has been found

entropy

0.9949622166246851

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619340520.952625 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1	0

Terminates another process (10 个事件)

Time & API	Arguments	Status
1619340521.046625 NtTerminateProcess	status_code: 0xffffffff process_identifier: 1664 process_handle: 0x000003a0	failed
1619340521.046625 NtTerminateProcess	status_code: 0xffffffff process_identifier: 1664 process_handle: 0x000003a0	success
1619340521.093625 NtTerminateProcess	status_code: 0xffffffff process_identifier: 2452 process_handle: 0x000003a8	failed
1619340521.093625 NtTerminateProcess	status_code: 0xffffffff process_identifier: 2452 process_handle: 0x000003a8	success
1619340521.124625 NtTerminateProcess	status_code: 0xffffffff process_identifier: 2080 process_handle: 0x000003b0	failed
1619340521.124625 NtTerminateProcess	status_code: 0xffffffff process_identifier: 2080 process_handle: 0x000003b0	success
1619340521.155625 NtTerminateProcess	status_code: 0xffffffff process_identifier: 2308 process_handle: 0x000003b8	failed
1619340521.155625 NtTerminateProcess	status_code: 0xffffffff process_identifier: 2308 process_handle: 0x000003b8	success
1619340521.218625 NtTerminateProcess	status_code: 0xffffffff process_identifier: 3128 process_handle: 0x000003c0	failed
1619340521.218625 NtTerminateProcess	status_code: 0xffffffff process_identifier: 3128 process_handle: 0x000003c0	success

Uses Windows utilities for basic Windows functionality (2 个事件)

cmdline	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\epuVYVfu" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmpB447.tmp"
cmdline	schtasks.exe /Create /TN "Updates\epuVYVfu" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmpB447.tmp"

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Allocates execute permission to another process indicative of possible code injection (5 个事件)

Time & API	Arguments	Status	Return
1619340520.921625 NtAllocateVirtualMemory	process_identifier: 1664 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x00000398 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496
1619340521.062625 NtAllocateVirtualMemory	process_identifier: 2452 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x0000039c allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496
1619340521.093625 NtAllocateVirtualMemory	process_identifier: 2080 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x000003a4 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496
1619340521.140625 NtAllocateVirtualMemory	process_identifier: 2308 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x000003ac allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496
1619340521.171625 NtAllocateVirtualMemory	process_identifier: 3128 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x000003b4 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496

Deletes executed files from disk (1 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmpB447.tmp

Manipulates memory of a non-child process indicative of process injection (10 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1804 manipulating memory of non-child process 1664
Process injection	Process 1804 manipulating memory of non-child process 2452
Process injection	Process 1804 manipulating memory of non-child process 2080
Process injection	Process 1804 manipulating memory of non-child process 2308
Process injection	Process 1804 manipulating memory of non-child process 3128
1619340520.921625 NtAllocateVirtualMemory	process_identifier: 1664 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x00000398 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496	0
1619340521.062625 NtAllocateVirtualMemory	process_identifier: 2452 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x0000039c allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496	0
1619340521.093625 NtAllocateVirtualMemory	process_identifier: 2080 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x000003a4 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496	0
1619340521.140625 NtAllocateVirtualMemory	process_identifier: 2308 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x000003ac allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496	0
1619340521.171625 NtAllocateVirtualMemory	process_identifier: 3128 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x000003b4 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496	0

Executed a process and injected code into it, probably while unpacking (19 个事件)

Time & API	Arguments	Status	Return
1619340498.233625 NtResumeThread	thread_handle: 0x000000d8 suspend_count: 1 process_identifier: 1804	success	0
1619340498.249625 NtResumeThread	thread_handle: 0x00000124 suspend_count: 1 process_identifier: 1804	success	0
1619340498.265625 NtResumeThread	thread_handle: 0x0000016c suspend_count: 1 process_identifier: 1804	success	0
1619340509.702625 CreateProcessInternalW	thread_identifier: 2632 thread_handle: 0x00000344 process_identifier: 2620 current_directory: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp filepath: C:\Windows\System32\schtasks.exe track: 1 command_line: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\epuVYVfu" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmpB447.tmp" filepath_r: C:\Windows\System32\schtasks.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) process_handle: 0x00000380 inherit_handles: 0	success	1
1619340520.905625 CreateProcessInternalW	thread_identifier: 176 thread_handle: 0x00000338 process_identifier: 1664 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\30d8b124d51fdb2e5eaeffa3f3866a8a.exe track: 1 command_line: "{path}" filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\30d8b124d51fdb2e5eaeffa3f3866a8a.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x00000398 inherit_handles: 0	success	1
1619340520.921625 NtGetContextThread	thread_handle: 0x00000338	success	0
1619340520.921625 NtAllocateVirtualMemory	process_identifier: 1664 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x00000398 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496
1619340521.062625 CreateProcessInternalW	thread_identifier: 2144 thread_handle: 0x000003a0 process_identifier: 2452 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\30d8b124d51fdb2e5eaeffa3f3866a8a.exe track: 1 command_line: "{path}" filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\30d8b124d51fdb2e5eaeffa3f3866a8a.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x0000039c inherit_handles: 0	success	1
1619340521.062625 NtGetContextThread	thread_handle: 0x000003a0	success	0
1619340521.062625 NtAllocateVirtualMemory	process_identifier: 2452 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x0000039c allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496
1619340521.093625 CreateProcessInternalW	thread_identifier: 1880 thread_handle: 0x000003a8 process_identifier: 2080 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\30d8b124d51fdb2e5eaeffa3f3866a8a.exe track: 1 command_line: "{path}" filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\30d8b124d51fdb2e5eaeffa3f3866a8a.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x000003a4 inherit_handles: 0	success	1
1619340521.093625 NtGetContextThread	thread_handle: 0x000003a8	success	0
1619340521.093625 NtAllocateVirtualMemory	process_identifier: 2080 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x000003a4 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496
1619340521.140625 CreateProcessInternalW	thread_identifier: 2188 thread_handle: 0x000003b0 process_identifier: 2308 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\30d8b124d51fdb2e5eaeffa3f3866a8a.exe track: 1 command_line: "{path}" filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\30d8b124d51fdb2e5eaeffa3f3866a8a.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x000003ac inherit_handles: 0	success	1
1619340521.140625 NtGetContextThread	thread_handle: 0x000003b0	success	0
1619340521.140625 NtAllocateVirtualMemory	process_identifier: 2308 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x000003ac allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496
1619340521.171625 CreateProcessInternalW	thread_identifier: 3132 thread_handle: 0x000003b8 process_identifier: 3128 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\30d8b124d51fdb2e5eaeffa3f3866a8a.exe track: 1 command_line: "{path}" filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\30d8b124d51fdb2e5eaeffa3f3866a8a.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x000003b4 inherit_handles: 0	success	1
1619340521.171625 NtGetContextThread	thread_handle: 0x000003b8	success	0
1619340521.171625 NtAllocateVirtualMemory	process_identifier: 3128 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x000003b4 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (2 个事件)

dead_host	172.217.24.14:443
dead_host	216.58.200.238:443

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-06-01 12:30:01

Imports

Library mscoree.dll:

• 0x402000 _CorExeMain

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
clients2.google.com	CNAME clients.l.google.com A 216.58.200.238	172.217.24.14
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	51378	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	60123	114.114.114.114	53
192.168.56.101	63429	114.114.114.114	53
192.168.56.101	65004	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	49713	224.0.0.252	5355
192.168.56.101	50568	224.0.0.252	5355
192.168.56.101	53237	224.0.0.252	5355
192.168.56.101	53657	224.0.0.252	5355
192.168.56.101	55368	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	58367	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	62318	224.0.0.252	5355
192.168.56.101	62912	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.