SmartHawk

10.6

0-day

该样本未表现出任何异常！

重新分析

下载样本

2db130b6ad748672b5cbc14066640e1719f5736b54214194e94fc7e5abf97ac4

3dcdb3745f668b6b4ac0785cf4e869a2.exe

分析耗时

109s

最近分析

文件大小

426.5KB

静态报毒动态报毒

未检测暂无鹰眼引擎检测结果

未检测暂无反病毒引擎检测结果

Queries for the computername (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619405520.244125 GetComputerNameW	computer_name: OSKAR-PC	success	1	0

Checks if process is being debugged by a debugger (50 out of 88 个事件)

Time & API	Arguments	Status	Return	Repeated
1619405483.899625 IsDebuggerPresent		failed	0	0
1619405485.024625 IsDebuggerPresent		failed	0	0
1619405485.461625 IsDebuggerPresent		failed	0	0
1619405486.024625 IsDebuggerPresent		failed	0	0
1619405486.461625 IsDebuggerPresent		failed	0	0
1619405487.024625 IsDebuggerPresent		failed	0	0
1619405487.461625 IsDebuggerPresent		failed	0	0
1619405488.024625 IsDebuggerPresent		failed	0	0
1619405488.461625 IsDebuggerPresent		failed	0	0
1619405489.024625 IsDebuggerPresent		failed	0	0
1619405489.461625 IsDebuggerPresent		failed	0	0
1619405490.024625 IsDebuggerPresent		failed	0	0
1619405490.461625 IsDebuggerPresent		failed	0	0
1619405491.024625 IsDebuggerPresent		failed	0	0
1619405491.461625 IsDebuggerPresent		failed	0	0
1619405492.024625 IsDebuggerPresent		failed	0	0
1619405492.461625 IsDebuggerPresent		failed	0	0
1619405493.024625 IsDebuggerPresent		failed	0	0
1619405493.461625 IsDebuggerPresent		failed	0	0
1619405494.024625 IsDebuggerPresent		failed	0	0
1619405494.461625 IsDebuggerPresent		failed	0	0
1619405495.024625 IsDebuggerPresent		failed	0	0
1619405495.461625 IsDebuggerPresent		failed	0	0
1619405496.024625 IsDebuggerPresent		failed	0	0
1619405496.461625 IsDebuggerPresent		failed	0	0
1619405497.024625 IsDebuggerPresent		failed	0	0
1619405497.461625 IsDebuggerPresent		failed	0	0
1619405498.024625 IsDebuggerPresent		failed	0	0
1619405498.461625 IsDebuggerPresent		failed	0	0
1619405499.024625 IsDebuggerPresent		failed	0	0
1619405499.461625 IsDebuggerPresent		failed	0	0
1619405500.024625 IsDebuggerPresent		failed	0	0
1619405500.461625 IsDebuggerPresent		failed	0	0
1619405501.024625 IsDebuggerPresent		failed	0	0
1619405501.461625 IsDebuggerPresent		failed	0	0
1619405502.024625 IsDebuggerPresent		failed	0	0
1619405502.461625 IsDebuggerPresent		failed	0	0
1619405503.024625 IsDebuggerPresent		failed	0	0
1619405503.461625 IsDebuggerPresent		failed	0	0
1619405504.024625 IsDebuggerPresent		failed	0	0
1619405504.461625 IsDebuggerPresent		failed	0	0
1619405505.024625 IsDebuggerPresent		failed	0	0
1619405505.461625 IsDebuggerPresent		failed	0	0
1619405506.024625 IsDebuggerPresent		failed	0	0
1619405506.461625 IsDebuggerPresent		failed	0	0
1619405507.024625 IsDebuggerPresent		failed	0	0
1619405507.461625 IsDebuggerPresent		failed	0	0
1619405508.024625 IsDebuggerPresent		failed	0	0
1619405508.461625 IsDebuggerPresent		failed	0	0
1619405509.024625 IsDebuggerPresent		failed	0	0

Command line console output was observed (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619405525.869125 WriteConsoleW	buffer: 成功: 成功创建计划任务 "Updates\TNTnlLD"。 console_handle: 0x00000007	success	1	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619405518.524625 GlobalMemoryStatusEx		success	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (50 out of 73 个事件)

Time & API	Arguments	Status
1619405483.243625 NtAllocateVirtualMemory	process_identifier: 2456 region_size: 393216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00510000	success
1619405483.243625 NtAllocateVirtualMemory	process_identifier: 2456 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00530000	success
1619405483.868625 NtProtectVirtualMemory	process_identifier: 2456 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73c51000	success
1619405483.899625 NtAllocateVirtualMemory	process_identifier: 2456 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x008fa000	success
1619405483.899625 NtProtectVirtualMemory	process_identifier: 2456 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73c52000	success
1619405483.899625 NtAllocateVirtualMemory	process_identifier: 2456 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x008f2000	success
1619405484.118625 NtAllocateVirtualMemory	process_identifier: 2456 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00902000	success
1619405484.149625 NtAllocateVirtualMemory	process_identifier: 2456 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00903000	success
1619405484.165625 NtAllocateVirtualMemory	process_identifier: 2456 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0093b000	success
1619405484.165625 NtAllocateVirtualMemory	process_identifier: 2456 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00937000	success
1619405484.180625 NtAllocateVirtualMemory	process_identifier: 2456 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0090c000	success
1619405484.211625 NtAllocateVirtualMemory	process_identifier: 2456 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01f60000	success
1619405484.274625 NtAllocateVirtualMemory	process_identifier: 2456 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00904000	success
1619405484.305625 NtAllocateVirtualMemory	process_identifier: 2456 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0090a000	success
1619405484.336625 NtAllocateVirtualMemory	process_identifier: 2456 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0092a000	success
1619405484.430625 NtAllocateVirtualMemory	process_identifier: 2456 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00922000	success
1619405484.508625 NtAllocateVirtualMemory	process_identifier: 2456 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00935000	success
1619405484.790625 NtAllocateVirtualMemory	process_identifier: 2456 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01f61000	success
1619405485.024625 NtAllocateVirtualMemory	process_identifier: 2456 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01f62000	success
1619405485.086625 NtAllocateVirtualMemory	process_identifier: 2456 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0091a000	success
1619405485.086625 NtAllocateVirtualMemory	process_identifier: 2456 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00917000	success
1619405485.133625 NtAllocateVirtualMemory	process_identifier: 2456 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00905000	success
1619405518.243625 NtAllocateVirtualMemory	process_identifier: 2456 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x008fb000	success
1619405518.540625 NtAllocateVirtualMemory	process_identifier: 2456 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01f63000	success
1619405518.555625 NtAllocateVirtualMemory	process_identifier: 2456 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00906000	success
1619405518.571625 NtAllocateVirtualMemory	process_identifier: 2456 region_size: 1572864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x05720000	success
1619405518.571625 NtAllocateVirtualMemory	process_identifier: 2456 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x05860000	success
1619405518.571625 NtAllocateVirtualMemory	process_identifier: 2456 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x05861000	success
1619405518.602625 NtAllocateVirtualMemory	process_identifier: 2456 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x05862000	success
1619405518.602625 NtAllocateVirtualMemory	process_identifier: 2456 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x05863000	success
1619405518.618625 NtAllocateVirtualMemory	process_identifier: 2456 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x05864000	success
1619405518.633625 NtAllocateVirtualMemory	process_identifier: 2456 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x05865000	success
1619405518.633625 NtAllocateVirtualMemory	process_identifier: 2456 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x05866000	success
1619405518.633625 NtAllocateVirtualMemory	process_identifier: 2456 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x05867000	success
1619405518.649625 NtAllocateVirtualMemory	process_identifier: 2456 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00916000	success
1619405518.665625 NtAllocateVirtualMemory	process_identifier: 2456 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01f64000	success
1619405518.680625 NtAllocateVirtualMemory	process_identifier: 2456 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x05869000	success
1619405518.680625 NtAllocateVirtualMemory	process_identifier: 2456 region_size: 69632 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0586d000	success
1619405518.680625 NtAllocateVirtualMemory	process_identifier: 2456 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0587e000	success
1619405518.680625 NtAllocateVirtualMemory	process_identifier: 2456 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0587f000	success
1619405518.711625 NtAllocateVirtualMemory	process_identifier: 2456 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01f65000	success
1619405519.008625 NtAllocateVirtualMemory	process_identifier: 2456 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00907000	success
1619405519.243625 NtAllocateVirtualMemory	process_identifier: 2456 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x049e0000	success
1619405519.305625 NtAllocateVirtualMemory	process_identifier: 2456 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x008f3000	success
1619405527.790625 NtAllocateVirtualMemory	process_identifier: 2456 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01f66000	success
1619405527.805625 NtAllocateVirtualMemory	process_identifier: 2456 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x049e1000	success
1619405527.993375 NtAllocateVirtualMemory	process_identifier: 2960 region_size: 262144 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00510000	success
1619405527.993375 NtAllocateVirtualMemory	process_identifier: 2960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00510000	success
1619405528.008375 NtProtectVirtualMemory	process_identifier: 2960 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73c51000	success
1619405528.008375 NtAllocateVirtualMemory	process_identifier: 2960 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005da000	success

Creates a suspicious process (2 个事件)

cmdline	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TNTnlLD" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp3AF.tmp"
cmdline	schtasks.exe /Create /TN "Updates\TNTnlLD" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp3AF.tmp"

A process created a hidden window (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619405519.993625 ShellExecuteExW	parameters: /Create /TN "Updates\TNTnlLD" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp3AF.tmp" filepath: schtasks.exe filepath_r: schtasks.exe show_type: 0	success	1	0

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

7.905936768554936

section

{'size_of_data': '0x0006a000', 'virtual_address': '0x00002000', 'entropy': 7.905936768554936, 'name': '.text', 'virtual_size': '0x00069ee4'}

description

A section with a high entropy has been found

entropy

0.9953051643192489

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619405484.321625 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1	0
1619405530.040375 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1	0

Terminates another process (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619405564.211375 NtTerminateProcess	status_code: 0xffffffff process_identifier: 2456 process_handle: 0x00000220	failed	0	0
1619405564.211375 NtTerminateProcess	status_code: 0xffffffff process_identifier: 2456 process_handle: 0x00000220	failed	3221225738	0

Uses Windows utilities for basic Windows functionality (2 个事件)

cmdline	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TNTnlLD" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp3AF.tmp"
cmdline	schtasks.exe /Create /TN "Updates\TNTnlLD" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp3AF.tmp"

Communicates with host for which no DNS query was performed (3 个事件)

host	113.108.239.196
host	172.217.24.14
host	203.208.41.65

Allocates execute permission to another process indicative of possible code injection (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619405527.805625 NtAllocateVirtualMemory	process_identifier: 2960 region_size: 335872 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x000003a8 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	success	0	0

Deletes executed files from disk (1 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp3AF.tmp

Potential code injection by writing to the memory of another process (4 个事件)

Time & API	Arguments	Status	Return
1619405527.805625 WriteProcessMemory	process_identifier: 2960 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELÿxÊ^à¬ÎË à@ @ËKà H.textÔ« ¬ `.rsrcà®@@.reloc²@B process_handle: 0x000003a8 base_address: 0x00400000	success	1
1619405527.821625 WriteProcessMemory	process_identifier: 2960 buffer: 0HXà¬¬4VS_VERSION_INFO½ïþ?DVarFileInfo$Translation°StringFileInfoè000004b0,FileDescription 0FileVersion0.0.0.0l%InternalNameMyOklzwozquVyxhQNKVYuIrKoyWDtVEo.exe(LegalCopyright t%OriginalFilenameMyOklzwozquVyxhQNKVYuIrKoyWDtVEo.exe4ProductVersion0.0.0.08Assembly Version0.0.0.0 process_handle: 0x000003a8 base_address: 0x0044e000	success	1
1619405527.821625 WriteProcessMemory	process_identifier: 2960 buffer: ÀÐ; process_handle: 0x000003a8 base_address: 0x00450000	success	1
1619405527.821625 WriteProcessMemory	process_identifier: 2960 buffer: @ process_handle: 0x000003a8 base_address: 0x7efde008	success	1

Code injection by writing an executable or DLL to the memory of another process (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619405527.805625 WriteProcessMemory	process_identifier: 2960 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELÿxÊ^à¬ÎË à@ @ËKà H.textÔ« ¬ `.rsrcà®@@.reloc²@B process_handle: 0x000003a8 base_address: 0x00400000	success	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2456 called NtSetContextThread to modify thread in remote process 2960
1619405527.821625 NtSetContextThread	thread_handle: 0x000002cc registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4508622 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 2960	success	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2456 resumed a thread in remote process 2960
1619405527.852625 NtResumeThread	thread_handle: 0x000002cc suspend_count: 1 process_identifier: 2960	success	0	0

Executed a process and injected code into it, probably while unpacking (19 个事件)

Time & API	Arguments	Status	Return
1619405483.899625 NtResumeThread	thread_handle: 0x000000d0 suspend_count: 1 process_identifier: 2456	success	0
1619405483.930625 NtResumeThread	thread_handle: 0x0000015c suspend_count: 1 process_identifier: 2456	success	0
1619405484.790625 NtResumeThread	thread_handle: 0x00000218 suspend_count: 1 process_identifier: 2456	success	0
1619405484.868625 NtResumeThread	thread_handle: 0x0000022c suspend_count: 1 process_identifier: 2456	success	0
1619405519.399625 NtResumeThread	thread_handle: 0x000002c8 suspend_count: 1 process_identifier: 2456	success	0
1619405519.993625 CreateProcessInternalW	thread_identifier: 1712 thread_handle: 0x00000390 process_identifier: 2448 current_directory: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp filepath: C:\Windows\System32\schtasks.exe track: 1 command_line: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TNTnlLD" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp3AF.tmp" filepath_r: C:\Windows\System32\schtasks.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) process_handle: 0x000003d0 inherit_handles: 0	success	1
1619405527.805625 CreateProcessInternalW	thread_identifier: 2964 thread_handle: 0x000002cc process_identifier: 2960 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\3dcdb3745f668b6b4ac0785cf4e869a2.exe track: 1 command_line: "{path}" filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\3dcdb3745f668b6b4ac0785cf4e869a2.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x000003a8 inherit_handles: 0	success	1
1619405527.805625 NtGetContextThread	thread_handle: 0x000002cc	success	0
1619405527.805625 NtAllocateVirtualMemory	process_identifier: 2960 region_size: 335872 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x000003a8 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	success	0
1619405527.805625 WriteProcessMemory	process_identifier: 2960 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELÿxÊ^à¬ÎË à@ @ËKà H.textÔ« ¬ `.rsrcà®@@.reloc²@B process_handle: 0x000003a8 base_address: 0x00400000	success	1
1619405527.805625 WriteProcessMemory	process_identifier: 2960 buffer: process_handle: 0x000003a8 base_address: 0x00402000	success	1
1619405527.821625 WriteProcessMemory	process_identifier: 2960 buffer: 0HXà¬¬4VS_VERSION_INFO½ïþ?DVarFileInfo$Translation°StringFileInfoè000004b0,FileDescription 0FileVersion0.0.0.0l%InternalNameMyOklzwozquVyxhQNKVYuIrKoyWDtVEo.exe(LegalCopyright t%OriginalFilenameMyOklzwozquVyxhQNKVYuIrKoyWDtVEo.exe4ProductVersion0.0.0.08Assembly Version0.0.0.0 process_handle: 0x000003a8 base_address: 0x0044e000	success	1
1619405527.821625 WriteProcessMemory	process_identifier: 2960 buffer: ÀÐ; process_handle: 0x000003a8 base_address: 0x00450000	success	1
1619405527.821625 WriteProcessMemory	process_identifier: 2960 buffer: @ process_handle: 0x000003a8 base_address: 0x7efde008	success	1
1619405527.821625 NtSetContextThread	thread_handle: 0x000002cc registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4508622 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 2960	success	0
1619405527.852625 NtResumeThread	thread_handle: 0x000002cc suspend_count: 1 process_identifier: 2960	success	0
1619405527.852625 NtResumeThread	thread_handle: 0x00000388 suspend_count: 1 process_identifier: 2456	success	0
1619405528.008375 NtResumeThread	thread_handle: 0x000000d0 suspend_count: 1 process_identifier: 2960	success	0
1619405528.024375 NtResumeThread	thread_handle: 0x0000015c suspend_count: 1 process_identifier: 2960	success	0

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (2 个事件)

dead_host	172.217.24.14:443
dead_host	172.217.160.78:443

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2086-04-16 14:39:34

Imports

Library mscoree.dll:

• 0x402000 _CorExeMain

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
clients2.google.com	A 172.217.160.78 CNAME clients.l.google.com	172.217.160.78
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	51808	114.114.114.114	53
192.168.56.101	51963	114.114.114.114	53
192.168.56.101	55368	114.114.114.114	53
192.168.56.101	60215	114.114.114.114	53
192.168.56.101	60384	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	49713	224.0.0.252	5355
192.168.56.101	51378	224.0.0.252	5355
192.168.56.101	53237	224.0.0.252	5355
192.168.56.101	56539	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	58367	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355
192.168.56.101	61680	224.0.0.252	5355
192.168.56.101	62318	224.0.0.252	5355
192.168.56.101	65004	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	51379	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.