SmartHawk

9.4

极危

该样本未表现出任何异常！

重新分析

下载样本

ea17f66ea1428d971e73160197d768fd962328761e683b29a222b76c3fcf7649

3c10442bfa6cabf569fd98d51962dd33.exe

分析耗时

110s

最近分析

文件大小

128.0KB

静态报毒动态报毒

未检测暂无鹰眼引擎检测结果

未检测暂无反病毒引擎检测结果

Queries for the computername (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619392422.601249 GetComputerNameA	computer_name: OSKAR-PC	success	1	0

Uses Windows APIs to generate a cryptographic key (5 个事件)

Time & API	Arguments	Status	Return
1619392414.288249 CryptGenKey	crypto_handle: 0x0029a638 algorithm_identifier: 0x0000660e () provider_handle: 0x0029a230 flags: 1 key: f²êü-;äMßqWVÕ	success	1
1619392422.647249 CryptExportKey	crypto_handle: 0x0029a638 crypto_export_handle: 0x0029a5f8 buffer: f¤ÉûÕäIb¤5#N~N×[õQ+ªæÎ(+Q¯ehôöEbË¦¢Ö~à»hà°m¼b¼/É³0=jÒV=hU ò¥ºðô+RÊeÝÓÌ blob_type: 1 flags: 64	success	1
1619392453.788249 CryptExportKey	crypto_handle: 0x0029a638 crypto_export_handle: 0x0029a5f8 buffer: f¤å'@égû÷ AJQ¯ä7ì1ãÃîk\XñDý´xLÏÅ¬x6ëð$Ó !³én¦¦Ç÷t7KlB]2_êÄ¿·ò@ª&ï>æÓ HÄ¼m blob_type: 1 flags: 64	success	1
1619392459.272249 CryptExportKey	crypto_handle: 0x0029a638 crypto_export_handle: 0x0029a5f8 buffer: f¤ÂnÓ'Î'm¹wV6O ËjüF>(Gcºâ_ñ¸êâTmÞx â>ÌsÁèP:¹+heñ³AB³H¥IC0ÜPÉo~Yj(-V»=#9â«(èËÔ blob_type: 1 flags: 64	success	1
1619392482.851249 CryptExportKey	crypto_handle: 0x0029a638 crypto_export_handle: 0x0029a5f8 buffer: f¤¨kZz¬J ?7løÙ8?Ãþ5ÂOb Ù8ú¸n¶p2 ¸É¦{þGÁ:µ iÿÝu´ù´nú¸(«mâórc;ü#ÈRaÝ0 ]&eùË¼ blob_type: 1 flags: 64	success	1

The executable uses a known packer (1 个事件)

packer

Armadillo v1.71

The file contains an unknown PE resource name possibly indicative of a packer (1 个事件)

resource name

None

Allocates read-write-execute memory (usually to unpack itself) (5 个事件)

Time & API	Arguments	Status
1619392409.365751 NtAllocateVirtualMemory	process_identifier: 1916 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00840000	success
1619392409.428751 NtAllocateVirtualMemory	process_identifier: 1916 region_size: 36864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x021c0000	success
1619392032.791145 NtAllocateVirtualMemory	process_identifier: 1424 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0000000004050000	success
1619392413.991249 NtAllocateVirtualMemory	process_identifier: 2956 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x01cf0000	success
1619392413.991249 NtAllocateVirtualMemory	process_identifier: 2956 region_size: 36864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x01d00000	success

Checks whether any human activity is being performed by constantly checking whether the foreground window changed

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619392482.851249 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x000003a0 process_identifier: 3608	success	1	0

Moves the original executable to a new location (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619392411.459751 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\3c10442bfa6cabf569fd98d51962dd33.exe newfilepath: C:\Windows\SysWOW64\tasklist\eappcfg.exe newfilepath_r: C:\Windows\SysWOW64\tasklist\eappcfg.exe flags: 3 oldfilepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\3c10442bfa6cabf569fd98d51962dd33.exe	success	1	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619392426.882249 GetAdaptersAddresses	flags: 0 family: 0	failed	111	0

Expresses interest in specific running processes (1 个事件)

process

eappcfg.exe

Reads the systems User Agent and subsequently performs requests (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619392423.522249 InternetOpenW	proxy_bypass: access_type: 0 proxy_name: flags: 0 user_agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)	success	13369348	0

Uses Windows utilities for basic Windows functionality (1 个事件)

cmdline

C:\Windows\SysWOW64\tasklist\eappcfg.exe

Communicates with host for which no DNS query was performed (7 个事件)

host	113.108.239.226
host	172.217.24.14
host	209.236.123.42
host	216.10.40.16
host	77.55.211.77
host	91.121.54.71
host	203.208.41.98

Installs itself for autorun at Windows startup (1 个事件)

service_name

eappcfg

service_path

C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\"C:\Windows\SysWOW64\tasklist\eappcfg.exe"

Created a service where a service was also not started (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619392413.240751 CreateServiceW	service_start_name: start_type: 2 service_handle: 0x02d46e68 display_name: eappcfg error_control: 0 service_name: eappcfg filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\"C:\Windows\SysWOW64\tasklist\eappcfg.exe" filepath_r: "C:\Windows\SysWOW64\tasklist\eappcfg.exe" service_manager_handle: 0x02d46c10 desired_access: 2 service_type: 16 password:	success	47476328	0

Sets or modifies WPAD proxy autoconfiguration file for traffic interception (8 个事件)

Time & API	Arguments	Status
1619392429.710249 RegSetValueExA	key_handle: 0x000003a0 value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason	success
1619392429.710249 RegSetValueExA	key_handle: 0x000003a0 value: Ðsã[ö9× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime	success
1619392429.710249 RegSetValueExA	key_handle: 0x000003a0 value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision	success
1619392429.710249 RegSetValueExW	key_handle: 0x000003a0 value: 网络 2 regkey_r: WpadNetworkName reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName	success
1619392429.710249 RegSetValueExA	key_handle: 0x000003b8 value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason	success
1619392429.710249 RegSetValueExA	key_handle: 0x000003b8 value: Ðsã[ö9× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime	success
1619392429.710249 RegSetValueExA	key_handle: 0x000003b8 value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision	success
1619392429.726249 RegSetValueExW	key_handle: 0x0000039c value: {40112ABE-63B3-43C3-BE93-1440EE3AF106} regkey_r: WpadLastNetwork reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadLastNetwork	success

Attempts to remove evidence of file being downloaded from the Internet (1 个事件)

file	C:\Windows\SysWOW64\tasklist\eappcfg.exe:Zone.Identifier

Generates some ICMP traffic

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (12 个事件)

dead_host	77.55.211.77:8080
dead_host	192.168.56.101:49190
dead_host	172.217.24.14:443
dead_host	192.168.56.101:49179
dead_host	209.236.123.42:8080
dead_host	91.121.54.71:8080
dead_host	192.168.56.101:49187
dead_host	192.168.56.101:49186
dead_host	192.168.56.101:49183
dead_host	192.168.56.101:49185
dead_host	192.168.56.101:49182
dead_host	216.10.40.16:80

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-09-01 01:27:51

Imports

Library MFC42.DLL:

• 0x40303c

• 0x403040

• 0x403044

• 0x403048

• 0x40304c

• 0x403050

• 0x403054

• 0x403058

• 0x40305c

• 0x403060

• 0x403064

• 0x403068

• 0x40306c

• 0x403070

• 0x403074

• 0x403078

• 0x40307c

• 0x403080

• 0x403084

• 0x403088

• 0x40308c

• 0x403090

• 0x403094

• 0x403098

• 0x40309c

• 0x4030a0

• 0x4030a4

• 0x4030a8

• 0x4030ac

• 0x4030b0

• 0x4030b4

• 0x4030b8

• 0x4030bc

• 0x4030c0

• 0x4030c4

• 0x4030c8

• 0x4030cc

• 0x4030d0

• 0x4030d4

• 0x4030d8

• 0x4030dc

• 0x4030e0

• 0x4030e4

• 0x4030e8

• 0x4030ec

• 0x4030f0

• 0x4030f4

• 0x4030f8

• 0x4030fc

• 0x403100

• 0x403104

• 0x403108

• 0x40310c

• 0x403110

• 0x403114

• 0x403118

• 0x40311c

• 0x403120

• 0x403124

• 0x403128

• 0x40312c

• 0x403130

• 0x403134

• 0x403138

• 0x40313c

• 0x403140

• 0x403144

• 0x403148

• 0x40314c

• 0x403150

• 0x403154

• 0x403158

• 0x40315c

• 0x403160

• 0x403164

• 0x403168

• 0x40316c

• 0x403170

• 0x403174

• 0x403178

• 0x40317c

• 0x403180

• 0x403184

• 0x403188

• 0x40318c

• 0x403190

• 0x403194

• 0x403198

• 0x40319c

• 0x4031a0

• 0x4031a4

• 0x4031a8

• 0x4031ac

• 0x4031b0

• 0x4031b4

• 0x4031b8

• 0x4031bc

• 0x4031c0

• 0x4031c4

• 0x4031c8

• 0x4031cc

• 0x4031d0

• 0x4031d4

• 0x4031d8

• 0x4031dc

• 0x4031e0

• 0x4031e4

• 0x4031e8

• 0x4031ec

• 0x4031f0

• 0x4031f4

• 0x4031f8

• 0x4031fc

• 0x403200

Library MSVCRT.dll:

• 0x403228 __getmainargs

• 0x40322c _acmdln

• 0x403230 exit

• 0x403234 _XcptFilter

• 0x403238 _exit

• 0x40323c _onexit

• 0x403240 __dllonexit

• 0x403244 _initterm

• 0x403248 time

• 0x40324c srand

• 0x403250 rand

• 0x403254 malloc

• 0x403258 __CxxFrameHandler

• 0x40325c _setmbcp

• 0x403260 __setusermatherr

• 0x403264 __p__commode

• 0x403268 _adjust_fdiv

• 0x40326c _controlfp

• 0x403270 _except_handler3

• 0x403274 __set_app_type

• 0x403278 __p__fmode

• 0x40327c _splitpath

Library KERNEL32.dll:

• 0x403000 GetCurrentDirectoryA

• 0x403004 GetLastError

• 0x403008 GetProcAddress

• 0x40300c GetModuleHandleW

• 0x403010 VirtualAlloc

• 0x403014 CloseHandle

• 0x403018 WriteFile

• 0x40301c SetEndOfFile

• 0x403020 SetFilePointer

• 0x403024 CreateFileA

• 0x403028 LocalFree

• 0x40302c FormatMessageA

• 0x403030 GetModuleHandleA

• 0x403034 GetStartupInfoA

Library USER32.dll:

• 0x403294 IsIconic

• 0x403298 GetSystemMetrics

• 0x40329c GetClientRect

• 0x4032a0 DrawIcon

• 0x4032a4 GetSystemMenu

• 0x4032a8 AppendMenuA

• 0x4032ac LoadIconA

• 0x4032b0 SendMessageA

• 0x4032b4 EnableWindow

Library SHELL32.dll:

• 0x403284 SHGetPathFromIDListA

• 0x403288 SHBrowseForFolderA

• 0x40328c SHGetMalloc

Library MSVCP60.dll:

• 0x403208 ??1Init@ios_base@std@@QAE@XZ

• 0x40320c ??0_Winit@std@@QAE@XZ

• 0x403210 ??1_Winit@std@@QAE@XZ

• 0x403214 ?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z

• 0x403218 ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z

• 0x40321c ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A

• 0x403220 ??0Init@ios_base@std@@QAE@XZ

Library ole32.dll:

• 0x4032bc OleInitialize

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
clients2.google.com	CNAME clients.l.google.com A 172.217.161.174	216.58.200.46
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

Source	Source Port	Destination	Destination Port
192.168.56.101	49179	172.217.161.174 clients2.google.com	443
192.168.56.101	49182	172.217.161.174 clients2.google.com	443
192.168.56.101	49183	172.217.161.174 clients2.google.com	443
192.168.56.101	49184	172.217.161.174 clients2.google.com	443
192.168.56.101	49185	172.217.161.174 clients2.google.com	443
192.168.56.101	49187	172.217.161.174 clients2.google.com	443
192.168.56.101	49189	172.217.161.174 clients2.google.com	443
192.168.56.101	49190	172.217.161.174 clients2.google.com	443
192.168.56.101	49191	172.217.161.174 clients2.google.com	443
203.208.41.98	443	192.168.56.101	49197

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	51808	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	60123	114.114.114.114	53
192.168.56.101	63429	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	49713	224.0.0.252	5355
192.168.56.101	51378	224.0.0.252	5355
192.168.56.101	53237	224.0.0.252	5355
192.168.56.101	53380	224.0.0.252	5355
192.168.56.101	55368	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	58367	224.0.0.252	5355
192.168.56.101	61680	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	62318	224.0.0.252	5355
192.168.56.101	65004	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	51379	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.