SmartHawk

7.0

高危

该样本未表现出任何异常！

重新分析

下载样本

bd8868cb1bd0343570335de12034c90e20a8287132f4444ada491a00a6d0ed5b

3cd4fb608004a6e5faca54da88048d8e.exe

分析耗时

173s

最近分析

文件大小

397.0KB

静态报毒动态报毒

未检测暂无鹰眼引擎检测结果

未检测暂无反病毒引擎检测结果

Checks if process is being debugged by a debugger (50 out of 174 个事件)

Time & API	Arguments	Status	Return	Repeated
1619411012.863374 IsDebuggerPresent		failed	0	0
1619411012.863374 IsDebuggerPresent		failed	0	0
1619411015.723874 IsDebuggerPresent		failed	0	0
1619411015.738874 IsDebuggerPresent		failed	0	0
1619411017.270626 IsDebuggerPresent		failed	0	0
1619411017.270626 IsDebuggerPresent		failed	0	0
1619411017.551501 IsDebuggerPresent		failed	0	0
1619411017.551501 IsDebuggerPresent		failed	0	0
1619411018.067249 IsDebuggerPresent		failed	0	0
1619411018.067249 IsDebuggerPresent		failed	0	0
1619411018.348751 IsDebuggerPresent		failed	0	0
1619411018.348751 IsDebuggerPresent		failed	0	0
1619411018.864124 IsDebuggerPresent		failed	0	0
1619411018.864124 IsDebuggerPresent		failed	0	0
1619411019.113626 IsDebuggerPresent		failed	0	0
1619411019.113626 IsDebuggerPresent		failed	0	0
1619411019.629751 IsDebuggerPresent		failed	0	0
1619411019.629751 IsDebuggerPresent		failed	0	0
1619411029.223374 IsDebuggerPresent		failed	0	0
1619411029.223374 IsDebuggerPresent		failed	0	0
1619411031.207499 IsDebuggerPresent		failed	0	0
1619411031.223499 IsDebuggerPresent		failed	0	0
1619411032.020626 IsDebuggerPresent		failed	0	0
1619411032.020626 IsDebuggerPresent		failed	0	0
1619411032.848501 IsDebuggerPresent		failed	0	0
1619411032.848501 IsDebuggerPresent		failed	0	0
1619411039.191751 IsDebuggerPresent		failed	0	0
1619411039.191751 IsDebuggerPresent		failed	0	0
1619411039.739124 IsDebuggerPresent		failed	0	0
1619411039.739124 IsDebuggerPresent		failed	0	0
1619411040.021249 IsDebuggerPresent		failed	0	0
1619411040.021249 IsDebuggerPresent		failed	0	0
1619411041.457499 IsDebuggerPresent		failed	0	0
1619411041.457499 IsDebuggerPresent		failed	0	0
1619411041.785999 IsDebuggerPresent		failed	0	0
1619411041.785999 IsDebuggerPresent		failed	0	0
1619411042.676874 IsDebuggerPresent		failed	0	0
1619411042.676874 IsDebuggerPresent		failed	0	0
1619411043.383374 IsDebuggerPresent		failed	0	0
1619411043.383374 IsDebuggerPresent		failed	0	0
1619411052.675062 IsDebuggerPresent		failed	0	0
1619411052.675062 IsDebuggerPresent		failed	0	0
1619411053.299375 IsDebuggerPresent		failed	0	0
1619411053.299375 IsDebuggerPresent		failed	0	0
1619411055.632973 IsDebuggerPresent		failed	0	0
1619411055.632973 IsDebuggerPresent		failed	0	0
1619411056.623445 IsDebuggerPresent		failed	0	0
1619411056.623445 IsDebuggerPresent		failed	0	0
1619411057.721323 IsDebuggerPresent		failed	0	0
1619411057.721323 IsDebuggerPresent		failed	0	0

Command line console output was observed (50 out of 85 个事件)

Time & API	Arguments	Status	Return
1619411039.583249 WriteConsoleW	buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\3cd4fb608004a6e5faca54da88048d8e.exe console_handle: 0x00000007	success	1
1619411041.661249 WriteConsoleW	buffer: 另一个程序正在使用此文件，进程无法访问。 console_handle: 0x0000000b	success	1
1619411019.738751 WriteConsoleW	buffer: Y console_handle: 0x00000007	success	1
1619411039.582374 WriteConsoleW	buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\3cd4fb608004a6e5faca54da88048d8e.exe console_handle: 0x00000007	success	1
1619411041.645374 WriteConsoleW	buffer: 另一个程序正在使用此文件，进程无法访问。 console_handle: 0x0000000b	success	1
1619411020.863999 WriteConsoleW	buffer: Y console_handle: 0x00000007	success	1
1619411039.582626 WriteConsoleW	buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\3cd4fb608004a6e5faca54da88048d8e.exe console_handle: 0x00000007	success	1
1619411041.645626 WriteConsoleW	buffer: 另一个程序正在使用此文件，进程无法访问。 console_handle: 0x0000000b	success	1
1619411021.692124 WriteConsoleW	buffer: Y console_handle: 0x00000007	success	1
1619411039.582999 WriteConsoleW	buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\3cd4fb608004a6e5faca54da88048d8e.exe console_handle: 0x00000007	success	1
1619411041.645999 WriteConsoleW	buffer: 另一个程序正在使用此文件，进程无法访问。 console_handle: 0x0000000b	success	1
1619411022.457751 WriteConsoleW	buffer: Y console_handle: 0x00000007	success	1
1619411039.582501 WriteConsoleW	buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\3cd4fb608004a6e5faca54da88048d8e.exe console_handle: 0x00000007	success	1
1619411041.629501 WriteConsoleW	buffer: 另一个程序正在使用此文件，进程无法访问。 console_handle: 0x0000000b	success	1
1619411032.488374 WriteConsoleW	buffer: Y console_handle: 0x00000007	success	1
1619411039.583124 WriteConsoleW	buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\3cd4fb608004a6e5faca54da88048d8e.exe console_handle: 0x00000007	success	1
1619411041.646124 WriteConsoleW	buffer: 另一个程序正在使用此文件，进程无法访问。 console_handle: 0x0000000b	success	1
1619411035.223999 WriteConsoleW	buffer: Y console_handle: 0x00000007	success	1
1619411051.411124 WriteConsoleW	buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\3cd4fb608004a6e5faca54da88048d8e.exe console_handle: 0x00000007	success	1
1619411051.411124 WriteConsoleW	buffer: 拒绝访问。 console_handle: 0x0000000b	success	1
1619411042.582374 WriteConsoleW	buffer: Y console_handle: 0x00000007	success	1
1619411052.379374 WriteConsoleW	buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\3cd4fb608004a6e5faca54da88048d8e.exe console_handle: 0x00000007	success	1
1619411052.379374 WriteConsoleW	buffer: 拒绝访问。 console_handle: 0x0000000b	success	1
1619411052.613499 WriteConsoleW	buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\3cd4fb608004a6e5faca54da88048d8e.exe console_handle: 0x00000007	success	1
1619411052.613499 WriteConsoleW	buffer: 拒绝访问。 console_handle: 0x0000000b	success	1
1619411045.317124 WriteConsoleW	buffer: Y console_handle: 0x00000007	success	1
1619411045.488626 WriteConsoleW	buffer: Y console_handle: 0x00000007	success	1
1619411052.471564 WriteConsoleW	buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\3cd4fb608004a6e5faca54da88048d8e.exe console_handle: 0x00000007	success	1
1619411052.471564 WriteConsoleW	buffer: 拒绝访问。 console_handle: 0x0000000b	success	1
1619411046.82925 WriteConsoleW	buffer: Y console_handle: 0x00000007	success	1
1619411125.861438 WriteConsoleW	buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\3cd4fb608004a6e5faca54da88048d8e.exe console_handle: 0x00000007	success	1
1619411125.861438 WriteConsoleW	buffer: 拒绝访问。 console_handle: 0x0000000b	success	1
1619411058.694973 WriteConsoleW	buffer: Y console_handle: 0x00000007	success	1
1619411073.647073 WriteConsoleW	buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\3cd4fb608004a6e5faca54da88048d8e.exe console_handle: 0x00000007	success	1
1619411073.662073 WriteConsoleW	buffer: 拒绝访问。 console_handle: 0x0000000b	success	1
1619411060.489167 WriteConsoleW	buffer: Y console_handle: 0x00000007	success	1
1619411064.382014 WriteConsoleW	buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\3cd4fb608004a6e5faca54da88048d8e.exe console_handle: 0x00000007	success	1
1619411064.382014 WriteConsoleW	buffer: 拒绝访问。 console_handle: 0x0000000b	success	1
1619411062.222267 WriteConsoleW	buffer: Y console_handle: 0x00000007	success	1
1619411081.16884 WriteConsoleW	buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\3cd4fb608004a6e5faca54da88048d8e.exe console_handle: 0x00000007	success	1
1619411081.16884 WriteConsoleW	buffer: 拒绝访问。 console_handle: 0x0000000b	success	1
1619411066.305498 WriteConsoleW	buffer: Y console_handle: 0x00000007	success	1
1619411081.902953 WriteConsoleW	buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\3cd4fb608004a6e5faca54da88048d8e.exe console_handle: 0x00000007	success	1
1619411081.902953 WriteConsoleW	buffer: 拒绝访问。 console_handle: 0x0000000b	success	1
1619411067.652769 WriteConsoleW	buffer: Y console_handle: 0x00000007	success	1
1619411117.203643 WriteConsoleW	buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\3cd4fb608004a6e5faca54da88048d8e.exe console_handle: 0x00000007	success	1
1619411117.203643 WriteConsoleW	buffer: 拒绝访问。 console_handle: 0x0000000b	success	1
1619411070.175808 WriteConsoleW	buffer: Y console_handle: 0x00000007	success	1
1619411090.012153 WriteConsoleW	buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\3cd4fb608004a6e5faca54da88048d8e.exe console_handle: 0x00000007	success	1
1619411090.012153 WriteConsoleW	buffer: 拒绝访问。 console_handle: 0x0000000b	success	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619411012.879374 GlobalMemoryStatusEx		success	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (50 out of 2689 个事件)

Time & API	Arguments	Status
1619411012.254374 NtAllocateVirtualMemory	process_identifier: 2668 region_size: 1179648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00740000	success
1619411012.254374 NtAllocateVirtualMemory	process_identifier: 2668 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00820000	success
1619411012.754374 NtAllocateVirtualMemory	process_identifier: 2668 region_size: 2293760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00b80000	success
1619411012.754374 NtAllocateVirtualMemory	process_identifier: 2668 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00d70000	success
1619411012.785374 NtProtectVirtualMemory	process_identifier: 2668 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73b91000	success
1619411012.863374 NtAllocateVirtualMemory	process_identifier: 2668 region_size: 458752 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00630000	success
1619411012.863374 NtAllocateVirtualMemory	process_identifier: 2668 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00660000	success
1619411012.879374 NtAllocateVirtualMemory	process_identifier: 2668 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003aa000	success
1619411012.879374 NtProtectVirtualMemory	process_identifier: 2668 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73b92000	success
1619411012.879374 NtAllocateVirtualMemory	process_identifier: 2668 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003a2000	success
1619411013.113374 NtAllocateVirtualMemory	process_identifier: 2668 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003b2000	success
1619411013.160374 NtAllocateVirtualMemory	process_identifier: 2668 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00455000	success
1619411013.160374 NtAllocateVirtualMemory	process_identifier: 2668 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0045b000	success
1619411013.160374 NtAllocateVirtualMemory	process_identifier: 2668 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00457000	success
1619411013.332374 NtAllocateVirtualMemory	process_identifier: 2668 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003b3000	success
1619411013.363374 NtAllocateVirtualMemory	process_identifier: 2668 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003bc000	success
1619411013.410374 NtAllocateVirtualMemory	process_identifier: 2668 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00650000	success
1619411013.426374 NtAllocateVirtualMemory	process_identifier: 2668 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00446000	success
1619411013.441374 NtAllocateVirtualMemory	process_identifier: 2668 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0044a000	success
1619411013.441374 NtAllocateVirtualMemory	process_identifier: 2668 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00447000	success
1619411013.676374 NtAllocateVirtualMemory	process_identifier: 2668 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003b4000	success
1619411014.082374 NtAllocateVirtualMemory	process_identifier: 2668 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003b5000	success
1619411014.191374 NtAllocateVirtualMemory	process_identifier: 2668 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00651000	success
1619411014.332374 NtAllocateVirtualMemory	process_identifier: 2668 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00bb0000	success
1619411016.457374 NtAllocateVirtualMemory	process_identifier: 2668 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003b6000	success
1619411016.473374 NtAllocateVirtualMemory	process_identifier: 2668 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00652000	success
1619411015.691874 NtProtectVirtualMemory	process_identifier: 1940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x74521000	success
1619411015.691874 NtAllocateVirtualMemory	process_identifier: 1940 region_size: 589824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00450000	success
1619411015.691874 NtAllocateVirtualMemory	process_identifier: 1940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004a0000	success
1619411015.723874 NtProtectVirtualMemory	process_identifier: 1940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73b91000	success
1619411015.723874 NtProtectVirtualMemory	process_identifier: 1940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73ad1000	success
1619411015.723874 NtAllocateVirtualMemory	process_identifier: 1940 region_size: 1179648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00aa0000	success
1619411015.723874 NtAllocateVirtualMemory	process_identifier: 1940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00b80000	success
1619411015.723874 NtProtectVirtualMemory	process_identifier: 1940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73b91000	success
1619411015.723874 NtAllocateVirtualMemory	process_identifier: 1940 region_size: 1572864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00c80000	success
1619411015.723874 NtAllocateVirtualMemory	process_identifier: 1940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00dc0000	success
1619411015.738874 NtAllocateVirtualMemory	process_identifier: 1940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003ea000	success
1619411015.738874 NtProtectVirtualMemory	process_identifier: 1940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73b92000	success
1619411015.738874 NtAllocateVirtualMemory	process_identifier: 1940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003e2000	success
1619411015.738874 NtAllocateVirtualMemory	process_identifier: 1940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00452000	success
1619411015.738874 NtAllocateVirtualMemory	process_identifier: 1940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00475000	success
1619411015.738874 NtAllocateVirtualMemory	process_identifier: 1940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0047b000	success
1619411015.738874 NtAllocateVirtualMemory	process_identifier: 1940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00477000	success
1619411015.738874 NtProtectVirtualMemory	process_identifier: 1940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x74511000	success
1619411015.754874 NtAllocateVirtualMemory	process_identifier: 1940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00453000	success
1619411015.754874 NtProtectVirtualMemory	process_identifier: 1940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x75061000	success
1619411015.754874 NtAllocateVirtualMemory	process_identifier: 1940 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00454000	success
1619411015.754874 NtAllocateVirtualMemory	process_identifier: 1940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0045c000	success
1619411015.770874 NtAllocateVirtualMemory	process_identifier: 1940 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x024b0000	success
1619411015.770874 NtAllocateVirtualMemory	process_identifier: 1940 region_size: 61440 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x024b1000	success

A process attempted to delay the analysis task. (1 个事件)

description

RegAsm.exe tried to sleep 467 seconds, actually delayed analysis time by 467 seconds

Creates a suspicious process (2 个事件)

cmdline	cmd.exe /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\3cd4fb608004a6e5faca54da88048d8e.exe"
cmdline	"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\3cd4fb608004a6e5faca54da88048d8e.exe"

Drops a binary and executes it (1 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\3cd4fb608004a6e5faca54da88048d8e.exe

Drops an executable to the user AppData folder (1 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\3cd4fb608004a6e5faca54da88048d8e.exe

A process created a hidden window (43 个事件)

Time & API	Arguments	Status	Return
1619411016.145374 ShellExecuteExW	parameters: /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\3cd4fb608004a6e5faca54da88048d8e.exe" filepath: cmd.exe filepath_r: cmd.exe show_type: 0	success	1
1619411017.441626 ShellExecuteExW	parameters: /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\3cd4fb608004a6e5faca54da88048d8e.exe" filepath: cmd.exe filepath_r: cmd.exe show_type: 0	success	1
1619411018.224249 ShellExecuteExW	parameters: /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\3cd4fb608004a6e5faca54da88048d8e.exe" filepath: cmd.exe filepath_r: cmd.exe show_type: 0	success	1
1619411019.052124 ShellExecuteExW	parameters: /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\3cd4fb608004a6e5faca54da88048d8e.exe" filepath: cmd.exe filepath_r: cmd.exe show_type: 0	success	1
1619411029.113751 ShellExecuteExW	parameters: /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\3cd4fb608004a6e5faca54da88048d8e.exe" filepath: cmd.exe filepath_r: cmd.exe show_type: 0	success	1
1619411031.895499 ShellExecuteExW	parameters: /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\3cd4fb608004a6e5faca54da88048d8e.exe" filepath: cmd.exe filepath_r: cmd.exe show_type: 0	success	1
1619411039.129501 ShellExecuteExW	parameters: /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\3cd4fb608004a6e5faca54da88048d8e.exe" filepath: cmd.exe filepath_r: cmd.exe show_type: 0	success	1
1619411039.911124 ShellExecuteExW	parameters: /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\3cd4fb608004a6e5faca54da88048d8e.exe" filepath: cmd.exe filepath_r: cmd.exe show_type: 0	success	1
1619411041.629499 ShellExecuteExW	parameters: /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\3cd4fb608004a6e5faca54da88048d8e.exe" filepath: cmd.exe filepath_r: cmd.exe show_type: 0	success	1
1619411043.301874 ShellExecuteExW	parameters: /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\3cd4fb608004a6e5faca54da88048d8e.exe" filepath: cmd.exe filepath_r: cmd.exe show_type: 0	success	1
1619411054.316062 ShellExecuteExW	parameters: /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\3cd4fb608004a6e5faca54da88048d8e.exe" filepath: cmd.exe filepath_r: cmd.exe show_type: 0	success	1
1619411057.163973 ShellExecuteExW	parameters: /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\3cd4fb608004a6e5faca54da88048d8e.exe" filepath: cmd.exe filepath_r: cmd.exe show_type: 0	success	1
1619411058.643323 ShellExecuteExW	parameters: /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\3cd4fb608004a6e5faca54da88048d8e.exe" filepath: cmd.exe filepath_r: cmd.exe show_type: 0	success	1
1619411062.737267 ShellExecuteExW	parameters: /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\3cd4fb608004a6e5faca54da88048d8e.exe" filepath: cmd.exe filepath_r: cmd.exe show_type: 0	success	1
1619411064.13403 ShellExecuteExW	parameters: /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\3cd4fb608004a6e5faca54da88048d8e.exe" filepath: cmd.exe filepath_r: cmd.exe show_type: 0	success	1
1619411066.244402 ShellExecuteExW	parameters: /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\3cd4fb608004a6e5faca54da88048d8e.exe" filepath: cmd.exe filepath_r: cmd.exe show_type: 0	success	1
1619411070.932119 ShellExecuteExW	parameters: /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\3cd4fb608004a6e5faca54da88048d8e.exe" filepath: cmd.exe filepath_r: cmd.exe show_type: 0	success	1
1619411071.938501 ShellExecuteExW	parameters: /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\3cd4fb608004a6e5faca54da88048d8e.exe" filepath: cmd.exe filepath_r: cmd.exe show_type: 0	success	1
1619411073.581778 ShellExecuteExW	parameters: /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\3cd4fb608004a6e5faca54da88048d8e.exe" filepath: cmd.exe filepath_r: cmd.exe show_type: 0	success	1
1619411075.465792 ShellExecuteExW	parameters: /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\3cd4fb608004a6e5faca54da88048d8e.exe" filepath: cmd.exe filepath_r: cmd.exe show_type: 0	success	1
1619411077.66001 ShellExecuteExW	parameters: /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\3cd4fb608004a6e5faca54da88048d8e.exe" filepath: cmd.exe filepath_r: cmd.exe show_type: 0	success	1
1619411078.926139 ShellExecuteExW	parameters: /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\3cd4fb608004a6e5faca54da88048d8e.exe" filepath: cmd.exe filepath_r: cmd.exe show_type: 0	success	1
1619411080.75779 ShellExecuteExW	parameters: /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\3cd4fb608004a6e5faca54da88048d8e.exe" filepath: cmd.exe filepath_r: cmd.exe show_type: 0	success	1
1619411085.19743 ShellExecuteExW	parameters: /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\3cd4fb608004a6e5faca54da88048d8e.exe" filepath: cmd.exe filepath_r: cmd.exe show_type: 0	success	1
1619411087.507519 ShellExecuteExW	parameters: /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\3cd4fb608004a6e5faca54da88048d8e.exe" filepath: cmd.exe filepath_r: cmd.exe show_type: 0	success	1
1619411089.513013 ShellExecuteExW	parameters: /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\3cd4fb608004a6e5faca54da88048d8e.exe" filepath: cmd.exe filepath_r: cmd.exe show_type: 0	success	1
1619411092.980404 ShellExecuteExW	parameters: /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\3cd4fb608004a6e5faca54da88048d8e.exe" filepath: cmd.exe filepath_r: cmd.exe show_type: 0	success	1
1619411097.212795 ShellExecuteExW	parameters: /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\3cd4fb608004a6e5faca54da88048d8e.exe" filepath: cmd.exe filepath_r: cmd.exe show_type: 0	success	1
1619411099.463172 ShellExecuteExW	parameters: /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\3cd4fb608004a6e5faca54da88048d8e.exe" filepath: cmd.exe filepath_r: cmd.exe show_type: 0	success	1
1619411101.463297 ShellExecuteExW	parameters: /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\3cd4fb608004a6e5faca54da88048d8e.exe" filepath: cmd.exe filepath_r: cmd.exe show_type: 0	success	1
1619411103.85342 ShellExecuteExW	parameters: /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\3cd4fb608004a6e5faca54da88048d8e.exe" filepath: cmd.exe filepath_r: cmd.exe show_type: 0	success	1
1619411105.620297 ShellExecuteExW	parameters: /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\3cd4fb608004a6e5faca54da88048d8e.exe" filepath: cmd.exe filepath_r: cmd.exe show_type: 0	success	1
1619411118.057047 ShellExecuteExW	parameters: /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\3cd4fb608004a6e5faca54da88048d8e.exe" filepath: cmd.exe filepath_r: cmd.exe show_type: 0	success	1
1619411119.86942 ShellExecuteExW	parameters: /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\3cd4fb608004a6e5faca54da88048d8e.exe" filepath: cmd.exe filepath_r: cmd.exe show_type: 0	success	1
1619411121.50967 ShellExecuteExW	parameters: /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\3cd4fb608004a6e5faca54da88048d8e.exe" filepath: cmd.exe filepath_r: cmd.exe show_type: 0	success	1
1619411123.448297 ShellExecuteExW	parameters: /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\3cd4fb608004a6e5faca54da88048d8e.exe" filepath: cmd.exe filepath_r: cmd.exe show_type: 0	success	1
1619411125.291545 ShellExecuteExW	parameters: /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\3cd4fb608004a6e5faca54da88048d8e.exe" filepath: cmd.exe filepath_r: cmd.exe show_type: 0	success	1
1619411127.634795 ShellExecuteExW	parameters: /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\3cd4fb608004a6e5faca54da88048d8e.exe" filepath: cmd.exe filepath_r: cmd.exe show_type: 0	success	1
1619411133.712545 ShellExecuteExW	parameters: /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\3cd4fb608004a6e5faca54da88048d8e.exe" filepath: cmd.exe filepath_r: cmd.exe show_type: 0	success	1
1619411139.134545 ShellExecuteExW	parameters: /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\3cd4fb608004a6e5faca54da88048d8e.exe" filepath: cmd.exe filepath_r: cmd.exe show_type: 0	success	1
1619411142.432172 ShellExecuteExW	parameters: /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\3cd4fb608004a6e5faca54da88048d8e.exe" filepath: cmd.exe filepath_r: cmd.exe show_type: 0	success	1
1619411146.260297 ShellExecuteExW	parameters: /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\3cd4fb608004a6e5faca54da88048d8e.exe" filepath: cmd.exe filepath_r: cmd.exe show_type: 0	success	1
1619411155.96292 ShellExecuteExW	parameters: /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\3cd4fb608004a6e5faca54da88048d8e.exe" filepath: cmd.exe filepath_r: cmd.exe show_type: 0	success	1

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

6.974476771582791

section

{'size_of_data': '0x00062e00', 'virtual_address': '0x00002000', 'entropy': 6.974476771582791, 'name': '.text', 'virtual_size': '0x00062d94'}

description

A section with a high entropy has been found

entropy

0.9974779319041615

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (50 out of 85 个事件)

Time & API	Arguments	Status	Return
1619411016.379374 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1
1619411028.113874 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1
1619411017.441626 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1
1619411028.645501 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1
1619411018.224249 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1
1619411029.520751 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1
1619411019.052124 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1
1619411030.191626 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1
1619411029.129751 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1
1619411040.895374 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1
1619411031.910499 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1
1619411043.520626 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1
1619411039.129501 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1
1619411050.348751 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1
1619411039.911124 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1
1619411052.271249 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1
1619411041.629499 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1
1619411053.348999 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1
1619411043.301874 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1
1619411054.570374 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1
1619411054.331062 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1
1619411064.533375 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1
1619411057.163973 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1
1619411067.685445 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1
1619411058.658323 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1
1619411069.525294 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1
1619411062.737267 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1
1619411070.656111 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1
1619411064.13403 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1
1619411074.894031 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1
1619411066.244402 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1
1619411077.347878 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1
1619411070.932119 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1
1619411081.90345 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1
1619411071.938501 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1
1619411083.044054 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1
1619411073.597778 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1
1619411084.778453 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1
1619411075.465792 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1
1619411086.075561 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1
1619411077.66001 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1
1619411087.761121 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1
1619411078.926139 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1
1619411090.118136 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1
1619411080.75779 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1
1619411091.975071 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1
1619411085.19743 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1
1619411096.189053 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1
1619411087.507519 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1
1619411099.438431 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1

Terminates another process (50 out of 84 个事件)

Time & API	Arguments	Status
1619411017.504626 NtTerminateProcess	status_code: 0x00000001 process_identifier: 0 process_handle: 0x000003a0	failed
1619411017.504626 NtTerminateProcess	status_code: 0x00000001 process_identifier: 0 process_handle: 0x000003a0	success
1619411018.302249 NtTerminateProcess	status_code: 0x00000001 process_identifier: 0 process_handle: 0x000003a4	failed
1619411018.302249 NtTerminateProcess	status_code: 0x00000001 process_identifier: 0 process_handle: 0x000003a4	success
1619411019.130124 NtTerminateProcess	status_code: 0x00000001 process_identifier: 0 process_handle: 0x000003a0	failed
1619411019.130124 NtTerminateProcess	status_code: 0x00000001 process_identifier: 0 process_handle: 0x000003a0	success
1619411029.191751 NtTerminateProcess	status_code: 0x00000001 process_identifier: 0 process_handle: 0x0000039c	failed
1619411029.191751 NtTerminateProcess	status_code: 0x00000001 process_identifier: 0 process_handle: 0x0000039c	success
1619411032.004499 NtTerminateProcess	status_code: 0x00000001 process_identifier: 0 process_handle: 0x0000039c	failed
1619411032.004499 NtTerminateProcess	status_code: 0x00000001 process_identifier: 0 process_handle: 0x0000039c	success
1619411039.223501 NtTerminateProcess	status_code: 0x00000001 process_identifier: 0 process_handle: 0x000003a0	failed
1619411039.223501 NtTerminateProcess	status_code: 0x00000001 process_identifier: 0 process_handle: 0x000003a0	success
1619411040.005124 NtTerminateProcess	status_code: 0x00000001 process_identifier: 0 process_handle: 0x000003a0	failed
1619411040.005124 NtTerminateProcess	status_code: 0x00000001 process_identifier: 0 process_handle: 0x000003a0	success
1619411041.785499 NtTerminateProcess	status_code: 0x00000001 process_identifier: 0 process_handle: 0x000003a0	failed
1619411041.785499 NtTerminateProcess	status_code: 0x00000001 process_identifier: 0 process_handle: 0x000003a0	success
1619411043.441874 NtTerminateProcess	status_code: 0x00000001 process_identifier: 0 process_handle: 0x000003a8	failed
1619411043.441874 NtTerminateProcess	status_code: 0x00000001 process_identifier: 0 process_handle: 0x000003a8	success
1619411054.425062 NtTerminateProcess	status_code: 0x00000001 process_identifier: 0 process_handle: 0x000003a4	failed
1619411054.425062 NtTerminateProcess	status_code: 0x00000001 process_identifier: 0 process_handle: 0x000003a4	success
1619411057.257973 NtTerminateProcess	status_code: 0x00000001 process_identifier: 0 process_handle: 0x000003a0	failed
1619411057.257973 NtTerminateProcess	status_code: 0x00000001 process_identifier: 0 process_handle: 0x000003a0	success
1619411058.799323 NtTerminateProcess	status_code: 0x00000001 process_identifier: 0 process_handle: 0x0000039c	failed
1619411058.799323 NtTerminateProcess	status_code: 0x00000001 process_identifier: 0 process_handle: 0x0000039c	success
1619411062.862267 NtTerminateProcess	status_code: 0x00000001 process_identifier: 0 process_handle: 0x000003a0	failed
1619411062.862267 NtTerminateProcess	status_code: 0x00000001 process_identifier: 0 process_handle: 0x000003a0	success
1619411064.25903 NtTerminateProcess	status_code: 0x00000001 process_identifier: 0 process_handle: 0x000003a0	failed
1619411064.25903 NtTerminateProcess	status_code: 0x00000001 process_identifier: 0 process_handle: 0x000003a0	success
1619411066.416402 NtTerminateProcess	status_code: 0x00000001 process_identifier: 0 process_handle: 0x000003a8	failed
1619411066.416402 NtTerminateProcess	status_code: 0x00000001 process_identifier: 0 process_handle: 0x000003a8	success
1619411071.119119 NtTerminateProcess	status_code: 0x00000001 process_identifier: 0 process_handle: 0x0000039c	failed
1619411071.119119 NtTerminateProcess	status_code: 0x00000001 process_identifier: 0 process_handle: 0x0000039c	success
1619411072.125501 NtTerminateProcess	status_code: 0x00000001 process_identifier: 0 process_handle: 0x0000039c	failed
1619411072.125501 NtTerminateProcess	status_code: 0x00000001 process_identifier: 0 process_handle: 0x0000039c	success
1619411073.706778 NtTerminateProcess	status_code: 0x00000001 process_identifier: 0 process_handle: 0x000003a0	failed
1619411073.706778 NtTerminateProcess	status_code: 0x00000001 process_identifier: 0 process_handle: 0x000003a0	success
1619411075.668792 NtTerminateProcess	status_code: 0x00000001 process_identifier: 0 process_handle: 0x0000039c	failed
1619411075.668792 NtTerminateProcess	status_code: 0x00000001 process_identifier: 0 process_handle: 0x0000039c	success
1619411077.84801 NtTerminateProcess	status_code: 0x00000001 process_identifier: 0 process_handle: 0x0000039c	failed
1619411077.84801 NtTerminateProcess	status_code: 0x00000001 process_identifier: 0 process_handle: 0x0000039c	success
1619411079.191139 NtTerminateProcess	status_code: 0x00000001 process_identifier: 0 process_handle: 0x000003a0	failed
1619411079.191139 NtTerminateProcess	status_code: 0x00000001 process_identifier: 0 process_handle: 0x000003a0	success
1619411080.99179 NtTerminateProcess	status_code: 0x00000001 process_identifier: 0 process_handle: 0x0000039c	failed
1619411080.99179 NtTerminateProcess	status_code: 0x00000001 process_identifier: 0 process_handle: 0x0000039c	success
1619411085.40043 NtTerminateProcess	status_code: 0x00000001 process_identifier: 0 process_handle: 0x000003a8	failed
1619411085.40043 NtTerminateProcess	status_code: 0x00000001 process_identifier: 0 process_handle: 0x000003a8	success
1619411087.741519 NtTerminateProcess	status_code: 0x00000001 process_identifier: 0 process_handle: 0x000003a0	failed
1619411087.741519 NtTerminateProcess	status_code: 0x00000001 process_identifier: 0 process_handle: 0x000003a0	success
1619411089.795013 NtTerminateProcess	status_code: 0x00000001 process_identifier: 0 process_handle: 0x000003a0	failed
1619411089.795013 NtTerminateProcess	status_code: 0x00000001 process_identifier: 0 process_handle: 0x000003a0	success

Uses Windows utilities for basic Windows functionality (2 个事件)

cmdline	cmd.exe /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\3cd4fb608004a6e5faca54da88048d8e.exe"
cmdline	"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\3cd4fb608004a6e5faca54da88048d8e.exe"

Manipulates memory of a non-child process indicative of process injection (30 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 4312 manipulating memory of non-child process 4404
Process injection	Process 4660 manipulating memory of non-child process 1976
Process injection	Process 5336 manipulating memory of non-child process 3680
Process injection	Process 6776 manipulating memory of non-child process 6848
Process injection	Process 6796 manipulating memory of non-child process 6852
Process injection	Process 6796 manipulating memory of non-child process 6160
Process injection	Process 8232 manipulating memory of non-child process 8348
Process injection	Process 8232 manipulating memory of non-child process 8408
Process injection	Process 9000 manipulating memory of non-child process 9096
Process injection	Process 8988 manipulating memory of non-child process 2364
1619411043.223874 NtAllocateVirtualMemory	process_identifier: 4404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 (PAGE_READWRITE) process_handle: 0x00000224 allocation_type: 4096 (MEM_COMMIT) base_address: 0x000a0000	success	0	0
1619411043.223874 NtAllocateVirtualMemory	process_identifier: 4404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 (PAGE_READWRITE) process_handle: 0x00000224 allocation_type: 4096 (MEM_COMMIT) base_address: 0x000b0000	success	0	0
1619411065.651402 NtAllocateVirtualMemory	process_identifier: 1976 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 (PAGE_READWRITE) process_handle: 0x00000224 allocation_type: 4096 (MEM_COMMIT) base_address: 0x000a0000	success	0	0
1619411065.666402 NtAllocateVirtualMemory	process_identifier: 1976 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 (PAGE_READWRITE) process_handle: 0x00000224 allocation_type: 4096 (MEM_COMMIT) base_address: 0x000b0000	success	0	0
1619411083.07243 NtAllocateVirtualMemory	process_identifier: 3680 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 (PAGE_READWRITE) process_handle: 0x00000220 allocation_type: 4096 (MEM_COMMIT) base_address: 0x000a0000	success	0	0
1619411083.07243 NtAllocateVirtualMemory	process_identifier: 3680 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 (PAGE_READWRITE) process_handle: 0x00000220 allocation_type: 4096 (MEM_COMMIT) base_address: 0x000b0000	success	0	0
1619411096.494795 NtAllocateVirtualMemory	process_identifier: 6848 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 (PAGE_READWRITE) process_handle: 0x00000224 allocation_type: 4096 (MEM_COMMIT) base_address: 0x000a0000	success	0	0
1619411096.494795 NtAllocateVirtualMemory	process_identifier: 6848 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 (PAGE_READWRITE) process_handle: 0x00000224 allocation_type: 4096 (MEM_COMMIT) base_address: 0x000b0000	success	0	0
1619411107.010047 NtAllocateVirtualMemory	process_identifier: 6852 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 (PAGE_READWRITE) process_handle: 0x00000224 allocation_type: 4096 (MEM_COMMIT) base_address: 0x000a0000	success	0	0
1619411107.010047 NtAllocateVirtualMemory	process_identifier: 6852 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 (PAGE_READWRITE) process_handle: 0x00000224 allocation_type: 4096 (MEM_COMMIT) base_address: 0x000b0000	success	0	0
1619411111.588047 NtAllocateVirtualMemory	process_identifier: 6160 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 (PAGE_READWRITE) process_handle: 0x00000238 allocation_type: 4096 (MEM_COMMIT) base_address: 0x000a0000	success	0	0
1619411111.588047 NtAllocateVirtualMemory	process_identifier: 6160 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 (PAGE_READWRITE) process_handle: 0x00000238 allocation_type: 4096 (MEM_COMMIT) base_address: 0x000b0000	success	0	0
1619411137.666545 NtAllocateVirtualMemory	process_identifier: 8348 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 (PAGE_READWRITE) process_handle: 0x00000224 allocation_type: 4096 (MEM_COMMIT) base_address: 0x000a0000	success	0	0
1619411137.666545 NtAllocateVirtualMemory	process_identifier: 8348 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 (PAGE_READWRITE) process_handle: 0x00000224 allocation_type: 4096 (MEM_COMMIT) base_address: 0x000b0000	success	0	0
1619411138.212545 NtAllocateVirtualMemory	process_identifier: 8408 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 (PAGE_READWRITE) process_handle: 0x00000238 allocation_type: 4096 (MEM_COMMIT) base_address: 0x000a0000	success	0	0
1619411138.212545 NtAllocateVirtualMemory	process_identifier: 8408 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 (PAGE_READWRITE) process_handle: 0x00000238 allocation_type: 4096 (MEM_COMMIT) base_address: 0x000b0000	success	0	0
1619411145.479297 NtAllocateVirtualMemory	process_identifier: 9096 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 (PAGE_READWRITE) process_handle: 0x00000228 allocation_type: 4096 (MEM_COMMIT) base_address: 0x000a0000	success	0	0
1619411145.479297 NtAllocateVirtualMemory	process_identifier: 9096 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 (PAGE_READWRITE) process_handle: 0x00000228 allocation_type: 4096 (MEM_COMMIT) base_address: 0x000b0000	success	0	0
1619411158.150545 NtAllocateVirtualMemory	process_identifier: 2364 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 (PAGE_READWRITE) process_handle: 0x00000224 allocation_type: 4096 (MEM_COMMIT) base_address: 0x000a0000	success	0	0
1619411158.150545 NtAllocateVirtualMemory	process_identifier: 2364 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 (PAGE_READWRITE) process_handle: 0x00000224 allocation_type: 4096 (MEM_COMMIT) base_address: 0x000b0000	success	0	0

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (2 个事件)

dead_host	172.217.24.14:443
dead_host	172.217.160.78:443

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-08-04 21:33:56

Imports

Library mscoree.dll:

• 0x402000 _CorExeMain

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
teredo.ipv6.microsoft.com		127.0.0.1
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
clients2.google.com	A 172.217.24.14 CNAME clients.l.google.com A 172.217.160.78	172.217.24.14

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	55368	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	57874	114.114.114.114	53
192.168.56.101	62912	114.114.114.114	53
192.168.56.101	63429	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	50002	224.0.0.252	5355
192.168.56.101	50534	224.0.0.252	5355
192.168.56.101	51378	224.0.0.252	5355
192.168.56.101	51808	224.0.0.252	5355
192.168.56.101	51963	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	57756	224.0.0.252	5355
192.168.56.101	60384	224.0.0.252	5355
192.168.56.101	61680	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.