SmartHawk

11.6

0-day

57 个模型检测该样本为恶意！

重新分析

下载样本

dec3cf3fb618a435846f123285aef58498af95552e12cb1f7285e5ba88a601f6

3f3df6de2e1f11e5ff1c7a575b4bf8e7.exe

分析耗时

78s

最近分析

文件大小

968.0KB

静态报毒动态报毒 AI SCORE=85 AIDETECT AOZV ATTRIBUTE AZORULT BANLOAD BARYS CLOUD CONFIDENCE CRYPTERX ENLK FCPU GDSDA GENCIRC GENKRYPTIK HGIASOGA HIGH CONFIDENCE HIGHCONFIDENCE HTPBDQ IGENERIC KRYPTIK LNHW2KGVBYI MALWARE2 MOKSSTEAL PIGSO PXFQ R349452 SAVE SCORE SIGGEN10 STATIC AI SUSGEN SUSPICIOUS PE TROJANPSW TSCOPE UNSAFE ZARD 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee	PWS-FCPU!3F3DF6DE2E1F	20210301	6.0.6.653
Alibaba	TrojanPSW:Win32/Azorult.1f49379b	20190527	0.3.0.5
CrowdStrike	win/malicious_confidence_90% (W)	20210203	1.0
Baidu		20190318	1.0.0.2
Avast	Win32:CrypterX-gen [Trj]	20210301	21.1.5827.0
Tencent	Malware.Win32.Gencirc.11ae2a7d	20210301	1.0.0.1
Kingsoft		20210301	2017.9.26.565

Queries for the computername (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1620736127.392125 GetComputerNameW	computer_name: OSKAR-PC	success	1	0
1620736127.392125 GetComputerNameW	computer_name: OSKAR-PC	success	1	0

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 个事件)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620736127.251125 GlobalMemoryStatusEx		success	1	0

One or more processes crashed (50 out of 14563 个事件)

Time & API	Arguments	Status
1620726219.57685 __exception__	stacktrace: registers.esp: 1637140 registers.edi: 0 registers.eax: 51212215 registers.ebp: 51193415 registers.edx: 47 registers.ebx: 0 registers.esi: 51187573 registers.ecx: 51183616 exception.instruction_r: 6c 89 43 7a 0d 40 ac 93 ad c0 f0 1b 76 36 66 2b exception.instruction: insb byte ptr es:[edi], dx exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x30d0e79	success
1620726219.57685 __exception__	stacktrace: registers.esp: 1637140 registers.edi: 532437829 registers.eax: 51212215 registers.ebp: 51193419 registers.edx: 47 registers.ebx: 0 registers.esi: 51187573 registers.ecx: 51183616 exception.instruction_r: 6c 89 43 7a 0d 40 ac 93 ad c0 f0 1b 76 36 66 2b exception.instruction: insb byte ptr es:[edi], dx exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x30d0e79	success
1620726219.57685 __exception__	stacktrace: registers.esp: 1637140 registers.edi: 1196201794 registers.eax: 51212215 registers.ebp: 51193423 registers.edx: 47 registers.ebx: 0 registers.esi: 51187573 registers.ecx: 51183616 exception.instruction_r: 6c 89 43 7a 0d 40 ac 93 ad c0 f0 1b 76 36 66 2b exception.instruction: insb byte ptr es:[edi], dx exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x30d0e79	success
1620726219.57685 __exception__	stacktrace: registers.esp: 1637140 registers.edi: 2870954807 registers.eax: 51212215 registers.ebp: 51193427 registers.edx: 47 registers.ebx: 0 registers.esi: 51187573 registers.ecx: 51183616 exception.instruction_r: 6c 89 43 7a 0d 40 ac 93 ad c0 f0 1b 76 36 66 2b exception.instruction: insb byte ptr es:[edi], dx exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x30d0e79	success
1620726219.57685 __exception__	stacktrace: registers.esp: 1637140 registers.edi: 4225059940 registers.eax: 51212215 registers.ebp: 51193431 registers.edx: 47 registers.ebx: 0 registers.esi: 51187573 registers.ecx: 51183616 exception.instruction_r: 6c 89 43 7a 0d 40 ac 93 ad c0 f0 1b 76 36 66 2b exception.instruction: insb byte ptr es:[edi], dx exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x30d0e79	success
1620726219.57685 __exception__	stacktrace: registers.esp: 1637140 registers.edi: 2427256329 registers.eax: 51212215 registers.ebp: 51193435 registers.edx: 47 registers.ebx: 0 registers.esi: 51187573 registers.ecx: 51183616 exception.instruction_r: 6c 89 43 7a 0d 40 ac 93 ad c0 f0 1b 76 36 66 2b exception.instruction: insb byte ptr es:[edi], dx exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x30d0e79	success
1620726219.57685 __exception__	stacktrace: registers.esp: 1637140 registers.edi: 3118539110 registers.eax: 51212215 registers.ebp: 51193439 registers.edx: 47 registers.ebx: 0 registers.esi: 51187573 registers.ecx: 51183616 exception.instruction_r: 6c 89 43 7a 0d 40 ac 93 ad c0 f0 1b 76 36 66 2b exception.instruction: insb byte ptr es:[edi], dx exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x30d0e79	success
1620726219.57685 __exception__	stacktrace: registers.esp: 1637140 registers.edi: 1412375995 registers.eax: 51212215 registers.ebp: 51193443 registers.edx: 47 registers.ebx: 0 registers.esi: 51187573 registers.ecx: 51183616 exception.instruction_r: 6c 89 43 7a 0d 40 ac 93 ad c0 f0 1b 76 36 66 2b exception.instruction: insb byte ptr es:[edi], dx exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x30d0e79	success
1620726219.57685 __exception__	stacktrace: registers.esp: 1637140 registers.edi: 77133896 registers.eax: 51212215 registers.ebp: 51193447 registers.edx: 47 registers.ebx: 0 registers.esi: 51187573 registers.ecx: 51183616 exception.instruction_r: 6c 89 43 7a 0d 40 ac 93 ad c0 f0 1b 76 36 66 2b exception.instruction: insb byte ptr es:[edi], dx exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x30d0e79	success
1620726219.57685 __exception__	stacktrace: registers.esp: 1637140 registers.edi: 4132852813 registers.eax: 51212215 registers.ebp: 51193451 registers.edx: 47 registers.ebx: 0 registers.esi: 51187573 registers.ecx: 51183616 exception.instruction_r: 6c 89 43 7a 0d 40 ac 93 ad c0 f0 1b 76 36 66 2b exception.instruction: insb byte ptr es:[edi], dx exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x30d0e79	success
1620726219.57685 __exception__	stacktrace: registers.esp: 1637140 registers.edi: 1154061066 registers.eax: 51212215 registers.ebp: 51193455 registers.edx: 47 registers.ebx: 0 registers.esi: 51187573 registers.ecx: 51183616 exception.instruction_r: 6c 89 43 7a 0d 40 ac 93 ad c0 f0 1b 76 36 66 2b exception.instruction: insb byte ptr es:[edi], dx exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x30d0e79	success
1620726219.57685 __exception__	stacktrace: registers.esp: 1637140 registers.edi: 1613495231 registers.eax: 51212215 registers.ebp: 51193459 registers.edx: 47 registers.ebx: 0 registers.esi: 51187573 registers.ecx: 51183616 exception.instruction_r: 6c 89 43 7a 0d 40 ac 93 ad c0 f0 1b 76 36 66 2b exception.instruction: insb byte ptr es:[edi], dx exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x30d0e79	success
1620726219.57685 __exception__	stacktrace: registers.esp: 1637140 registers.edi: 3984954284 registers.eax: 51212215 registers.ebp: 51193463 registers.edx: 47 registers.ebx: 0 registers.esi: 51187573 registers.ecx: 51183616 exception.instruction_r: 6c 89 43 7a 0d 40 ac 93 ad c0 f0 1b 76 36 66 2b exception.instruction: insb byte ptr es:[edi], dx exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x30d0e79	success
1620726219.57685 __exception__	stacktrace: registers.esp: 1637140 registers.edi: 1499754001 registers.eax: 51212215 registers.ebp: 51193467 registers.edx: 47 registers.ebx: 0 registers.esi: 51187573 registers.ecx: 51183616 exception.instruction_r: 6c 89 43 7a 0d 40 ac 93 ad c0 f0 1b 76 36 66 2b exception.instruction: insb byte ptr es:[edi], dx exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x30d0e79	success
1620726219.57685 __exception__	stacktrace: registers.esp: 1637140 registers.edi: 1218935854 registers.eax: 51212215 registers.ebp: 51193471 registers.edx: 47 registers.ebx: 0 registers.esi: 51187573 registers.ecx: 51183616 exception.instruction_r: 6c 89 43 7a 0d 40 ac 93 ad c0 f0 1b 76 36 66 2b exception.instruction: insb byte ptr es:[edi], dx exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x30d0e79	success
1620726219.59185 __exception__	stacktrace: registers.esp: 1637140 registers.edi: 999349571 registers.eax: 51212215 registers.ebp: 51193475 registers.edx: 47 registers.ebx: 0 registers.esi: 51187573 registers.ecx: 51183616 exception.instruction_r: 6c 89 43 7a 0d 40 ac 93 ad c0 f0 1b 76 36 66 2b exception.instruction: insb byte ptr es:[edi], dx exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x30d0e79	success
1620726219.59185 __exception__	stacktrace: registers.esp: 1637140 registers.edi: 1295232656 registers.eax: 51212215 registers.ebp: 51193479 registers.edx: 47 registers.ebx: 0 registers.esi: 51187573 registers.ecx: 51183616 exception.instruction_r: 6c 89 43 7a 0d 40 ac 93 ad c0 f0 1b 76 36 66 2b exception.instruction: insb byte ptr es:[edi], dx exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x30d0e79	success
1620726219.59185 __exception__	stacktrace: registers.esp: 1637140 registers.edi: 1949391701 registers.eax: 51212215 registers.ebp: 51193483 registers.edx: 47 registers.ebx: 0 registers.esi: 51187573 registers.ecx: 51183616 exception.instruction_r: 6c 89 43 7a 0d 40 ac 93 ad c0 f0 1b 76 36 66 2b exception.instruction: insb byte ptr es:[edi], dx exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x30d0e79	success
1620726219.59185 __exception__	stacktrace: registers.esp: 1637140 registers.edi: 3248123090 registers.eax: 51212215 registers.ebp: 51193487 registers.edx: 47 registers.ebx: 0 registers.esi: 51187573 registers.ecx: 51183616 exception.instruction_r: 6c 89 43 7a 0d 40 ac 93 ad c0 f0 1b 76 36 66 2b exception.instruction: insb byte ptr es:[edi], dx exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x30d0e79	success
1620726219.59185 __exception__	stacktrace: registers.esp: 1637140 registers.edi: 3349600839 registers.eax: 51212215 registers.ebp: 51193491 registers.edx: 47 registers.ebx: 0 registers.esi: 51187573 registers.ecx: 51183616 exception.instruction_r: 6c 89 43 7a 0d 40 ac 93 ad c0 f0 1b 76 36 66 2b exception.instruction: insb byte ptr es:[edi], dx exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x30d0e79	success
1620726219.59185 __exception__	stacktrace: registers.esp: 1637140 registers.edi: 3420051700 registers.eax: 51212215 registers.ebp: 51193495 registers.edx: 47 registers.ebx: 0 registers.esi: 51187573 registers.ecx: 51183616 exception.instruction_r: 6c 89 43 7a 0d 40 ac 93 ad c0 f0 1b 76 36 66 2b exception.instruction: insb byte ptr es:[edi], dx exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x30d0e79	success
1620726219.59185 __exception__	stacktrace: registers.esp: 1637140 registers.edi: 654650393 registers.eax: 51212215 registers.ebp: 51193499 registers.edx: 47 registers.ebx: 0 registers.esi: 51187573 registers.ecx: 51183616 exception.instruction_r: 6c 89 43 7a 0d 40 ac 93 ad c0 f0 1b 76 36 66 2b exception.instruction: insb byte ptr es:[edi], dx exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x30d0e79	success
1620726219.59185 __exception__	stacktrace: registers.esp: 1637140 registers.edi: 4051694838 registers.eax: 51212215 registers.ebp: 51193503 registers.edx: 47 registers.ebx: 0 registers.esi: 51187573 registers.ecx: 51183616 exception.instruction_r: 6c 89 43 7a 0d 40 ac 93 ad c0 f0 1b 76 36 66 2b exception.instruction: insb byte ptr es:[edi], dx exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x30d0e79	success
1620726219.59185 __exception__	stacktrace: registers.esp: 1637140 registers.edi: 3401908939 registers.eax: 51212215 registers.ebp: 51193507 registers.edx: 47 registers.ebx: 0 registers.esi: 51187573 registers.ecx: 51183616 exception.instruction_r: 6c 89 43 7a 0d 40 ac 93 ad c0 f0 1b 76 36 66 2b exception.instruction: insb byte ptr es:[edi], dx exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x30d0e79	success
1620726219.59185 __exception__	stacktrace: registers.esp: 1637140 registers.edi: 1770824408 registers.eax: 51212215 registers.ebp: 51193511 registers.edx: 47 registers.ebx: 0 registers.esi: 51187573 registers.ecx: 51183616 exception.instruction_r: 6c 89 43 7a 0d 40 ac 93 ad c0 f0 1b 76 36 66 2b exception.instruction: insb byte ptr es:[edi], dx exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x30d0e79	success
1620726219.59185 __exception__	stacktrace: registers.esp: 1637140 registers.edi: 609611869 registers.eax: 51212215 registers.ebp: 51193515 registers.edx: 47 registers.ebx: 0 registers.esi: 51187573 registers.ecx: 51183616 exception.instruction_r: 6c 89 43 7a 0d 40 ac 93 ad c0 f0 1b 76 36 66 2b exception.instruction: insb byte ptr es:[edi], dx exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x30d0e79	success
1620726219.59185 __exception__	stacktrace: registers.esp: 1637140 registers.edi: 2184422554 registers.eax: 51212215 registers.ebp: 51193519 registers.edx: 47 registers.ebx: 0 registers.esi: 51187573 registers.ecx: 51183616 exception.instruction_r: 6c 89 43 7a 0d 40 ac 93 ad c0 f0 1b 76 36 66 2b exception.instruction: insb byte ptr es:[edi], dx exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x30d0e79	success
1620726219.59185 __exception__	stacktrace: registers.esp: 1637140 registers.edi: 412116687 registers.eax: 51212215 registers.ebp: 51193523 registers.edx: 47 registers.ebx: 0 registers.esi: 51187573 registers.ecx: 51183616 exception.instruction_r: 6c 89 43 7a 0d 40 ac 93 ad c0 f0 1b 76 36 66 2b exception.instruction: insb byte ptr es:[edi], dx exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x30d0e79	success
1620726219.59185 __exception__	stacktrace: registers.esp: 1637140 registers.edi: 3162414140 registers.eax: 51212215 registers.ebp: 51193527 registers.edx: 47 registers.ebx: 0 registers.esi: 51187573 registers.ecx: 51183616 exception.instruction_r: 6c 89 43 7a 0d 40 ac 93 ad c0 f0 1b 76 36 66 2b exception.instruction: insb byte ptr es:[edi], dx exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x30d0e79	success
1620726219.59185 __exception__	stacktrace: registers.esp: 1637140 registers.edi: 3574052897 registers.eax: 51212215 registers.ebp: 51193531 registers.edx: 47 registers.ebx: 0 registers.esi: 51187573 registers.ecx: 51183616 exception.instruction_r: 6c 89 43 7a 0d 40 ac 93 ad c0 f0 1b 76 36 66 2b exception.instruction: insb byte ptr es:[edi], dx exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x30d0e79	success
1620726219.59185 __exception__	stacktrace: registers.esp: 1637140 registers.edi: 533662654 registers.eax: 51212215 registers.ebp: 51193535 registers.edx: 47 registers.ebx: 0 registers.esi: 51187573 registers.ecx: 51183616 exception.instruction_r: 6c 89 43 7a 0d 40 ac 93 ad c0 f0 1b 76 36 66 2b exception.instruction: insb byte ptr es:[edi], dx exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x30d0e79	success
1620726219.59185 __exception__	stacktrace: registers.esp: 1637140 registers.edi: 1916540499 registers.eax: 51212215 registers.ebp: 51193539 registers.edx: 47 registers.ebx: 0 registers.esi: 51187573 registers.ecx: 51183616 exception.instruction_r: 6c 89 43 7a 0d 40 ac 93 ad c0 f0 1b 76 36 66 2b exception.instruction: insb byte ptr es:[edi], dx exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x30d0e79	success
1620726219.59185 __exception__	stacktrace: registers.esp: 1637140 registers.edi: 658527520 registers.eax: 51212215 registers.ebp: 51193543 registers.edx: 47 registers.ebx: 0 registers.esi: 51187573 registers.ecx: 51183616 exception.instruction_r: 6c 89 43 7a 0d 40 ac 93 ad c0 f0 1b 76 36 66 2b exception.instruction: insb byte ptr es:[edi], dx exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x30d0e79	success
1620726219.59185 __exception__	stacktrace: registers.esp: 1637140 registers.edi: 1957466981 registers.eax: 51212215 registers.ebp: 51193547 registers.edx: 47 registers.ebx: 0 registers.esi: 51187573 registers.ecx: 51183616 exception.instruction_r: 6c 89 43 7a 0d 40 ac 93 ad c0 f0 1b 76 36 66 2b exception.instruction: insb byte ptr es:[edi], dx exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x30d0e79	success
1620726219.59185 __exception__	stacktrace: registers.esp: 1637140 registers.edi: 2330573410 registers.eax: 51212215 registers.ebp: 51193551 registers.edx: 47 registers.ebx: 0 registers.esi: 51187573 registers.ecx: 51183616 exception.instruction_r: 6c 89 43 7a 0d 40 ac 93 ad c0 f0 1b 76 36 66 2b exception.instruction: insb byte ptr es:[edi], dx exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x30d0e79	success
1620726219.59185 __exception__	stacktrace: registers.esp: 1637140 registers.edi: 516497751 registers.eax: 51212215 registers.ebp: 51193555 registers.edx: 47 registers.ebx: 0 registers.esi: 51187573 registers.ecx: 51183616 exception.instruction_r: 6c 89 43 7a 0d 40 ac 93 ad c0 f0 1b 76 36 66 2b exception.instruction: insb byte ptr es:[edi], dx exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x30d0e79	success
1620726219.59185 __exception__	stacktrace: registers.esp: 1637140 registers.edi: 117464452 registers.eax: 51212215 registers.ebp: 51193559 registers.edx: 47 registers.ebx: 0 registers.esi: 51187573 registers.ecx: 51183616 exception.instruction_r: 6c 89 43 7a 0d 40 ac 93 ad c0 f0 1b 76 36 66 2b exception.instruction: insb byte ptr es:[edi], dx exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x30d0e79	success
1620726219.59185 __exception__	stacktrace: registers.esp: 1637140 registers.edi: 1707381289 registers.eax: 51212215 registers.ebp: 51193563 registers.edx: 47 registers.ebx: 0 registers.esi: 51187573 registers.ecx: 51183616 exception.instruction_r: 6c 89 43 7a 0d 40 ac 93 ad c0 f0 1b 76 36 66 2b exception.instruction: insb byte ptr es:[edi], dx exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x30d0e79	success
1620726219.59185 __exception__	stacktrace: registers.esp: 1637140 registers.edi: 584663174 registers.eax: 51212215 registers.ebp: 51193567 registers.edx: 47 registers.ebx: 0 registers.esi: 51187573 registers.ecx: 51183616 exception.instruction_r: 6c 89 43 7a 0d 40 ac 93 ad c0 f0 1b 76 36 66 2b exception.instruction: insb byte ptr es:[edi], dx exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x30d0e79	success
1620726219.59185 __exception__	stacktrace: registers.esp: 1637140 registers.edi: 994482139 registers.eax: 51212215 registers.ebp: 51193571 registers.edx: 47 registers.ebx: 0 registers.esi: 51187573 registers.ecx: 51183616 exception.instruction_r: 6c 89 43 7a 0d 40 ac 93 ad c0 f0 1b 76 36 66 2b exception.instruction: insb byte ptr es:[edi], dx exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x30d0e79	success
1620726219.59185 __exception__	stacktrace: registers.esp: 1637140 registers.edi: 3653977448 registers.eax: 51212215 registers.ebp: 51193575 registers.edx: 47 registers.ebx: 0 registers.esi: 51187573 registers.ecx: 51183616 exception.instruction_r: 6c 89 43 7a 0d 40 ac 93 ad c0 f0 1b 76 36 66 2b exception.instruction: insb byte ptr es:[edi], dx exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x30d0e79	success
1620726219.59185 __exception__	stacktrace: registers.esp: 1637140 registers.edi: 3187524717 registers.eax: 51212215 registers.ebp: 51193579 registers.edx: 47 registers.ebx: 0 registers.esi: 51187573 registers.ecx: 51183616 exception.instruction_r: 6c 89 43 7a 0d 40 ac 93 ad c0 f0 1b 76 36 66 2b exception.instruction: insb byte ptr es:[edi], dx exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x30d0e79	success
1620726219.59185 __exception__	stacktrace: registers.esp: 1637140 registers.edi: 3891342890 registers.eax: 51212215 registers.ebp: 51193583 registers.edx: 47 registers.ebx: 0 registers.esi: 51187573 registers.ecx: 51183616 exception.instruction_r: 6c 89 43 7a 0d 40 ac 93 ad c0 f0 1b 76 36 66 2b exception.instruction: insb byte ptr es:[edi], dx exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x30d0e79	success
1620726219.59185 __exception__	stacktrace: registers.esp: 1637140 registers.edi: 3272706527 registers.eax: 51212215 registers.ebp: 51193587 registers.edx: 47 registers.ebx: 0 registers.esi: 51187573 registers.ecx: 51183616 exception.instruction_r: 6c 89 43 7a 0d 40 ac 93 ad c0 f0 1b 76 36 66 2b exception.instruction: insb byte ptr es:[edi], dx exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x30d0e79	success
1620726219.59185 __exception__	stacktrace: registers.esp: 1637140 registers.edi: 1556847820 registers.eax: 51212215 registers.ebp: 51193591 registers.edx: 47 registers.ebx: 0 registers.esi: 51187573 registers.ecx: 51183616 exception.instruction_r: 6c 89 43 7a 0d 40 ac 93 ad c0 f0 1b 76 36 66 2b exception.instruction: insb byte ptr es:[edi], dx exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x30d0e79	success
1620726219.59185 __exception__	stacktrace: registers.esp: 1637140 registers.edi: 175389233 registers.eax: 51212215 registers.ebp: 51193595 registers.edx: 47 registers.ebx: 0 registers.esi: 51187573 registers.ecx: 51183616 exception.instruction_r: 6c 89 43 7a 0d 40 ac 93 ad c0 f0 1b 76 36 66 2b exception.instruction: insb byte ptr es:[edi], dx exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x30d0e79	success
1620726219.60785 __exception__	stacktrace: registers.esp: 1637140 registers.edi: 4123202382 registers.eax: 51212215 registers.ebp: 51193599 registers.edx: 47 registers.ebx: 0 registers.esi: 51187573 registers.ecx: 51183616 exception.instruction_r: 6c 89 43 7a 0d 40 ac 93 ad c0 f0 1b 76 36 66 2b exception.instruction: insb byte ptr es:[edi], dx exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x30d0e79	success
1620726219.60785 __exception__	stacktrace: registers.esp: 1637140 registers.edi: 1343555427 registers.eax: 51212215 registers.ebp: 51193603 registers.edx: 47 registers.ebx: 0 registers.esi: 51187573 registers.ecx: 51183616 exception.instruction_r: 6c 89 43 7a 0d 40 ac 93 ad c0 f0 1b 76 36 66 2b exception.instruction: insb byte ptr es:[edi], dx exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x30d0e79	success
1620726219.60785 __exception__	stacktrace: registers.esp: 1637140 registers.edi: 2726949808 registers.eax: 51212215 registers.ebp: 51193607 registers.edx: 47 registers.ebx: 0 registers.esi: 51187573 registers.ecx: 51183616 exception.instruction_r: 6c 89 43 7a 0d 40 ac 93 ad c0 f0 1b 76 36 66 2b exception.instruction: insb byte ptr es:[edi], dx exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x30d0e79	success
1620726219.60785 __exception__	stacktrace: registers.esp: 1637140 registers.edi: 1274151797 registers.eax: 51212215 registers.ebp: 51193611 registers.edx: 47 registers.ebx: 0 registers.esi: 51187573 registers.ecx: 51183616 exception.instruction_r: 6c 89 43 7a 0d 40 ac 93 ad c0 f0 1b 76 36 66 2b exception.instruction: insb byte ptr es:[edi], dx exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x30d0e79	success

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (15 个事件)

Time & API	Arguments	Status
1620726218.23285 NtAllocateVirtualMemory	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00690000	success
1620726218.23285 NtProtectVirtualMemory	process_identifier: 2200 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x77d4f000	success
1620726219.57685 NtAllocateVirtualMemory	process_identifier: 2200 region_size: 28672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x030d0000	success
1620736123.6575 NtAllocateVirtualMemory	process_identifier: 2520 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x003f0000	success
1620736123.6575 NtProtectVirtualMemory	process_identifier: 2520 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x77d4f000	success
1620736123.8145 NtAllocateVirtualMemory	process_identifier: 2520 region_size: 28672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00440000	success
1620736124.267625 NtAllocateVirtualMemory	process_identifier: 2424 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00380000	success
1620736124.267625 NtProtectVirtualMemory	process_identifier: 2424 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x77d4f000	success
1620736124.454625 NtAllocateVirtualMemory	process_identifier: 2424 region_size: 28672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00390000	success
1620736127.157125 NtAllocateVirtualMemory	process_identifier: 2864 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x003b0000	success
1620736127.157125 NtProtectVirtualMemory	process_identifier: 2864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x77d4f000	success
1620736127.251875 NtAllocateVirtualMemory	process_identifier: 1060 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00780000	success
1620736127.251875 NtProtectVirtualMemory	process_identifier: 1060 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x77d4f000	success
1620736127.486375 NtAllocateVirtualMemory	process_identifier: 2988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00330000	success
1620736127.486375 NtProtectVirtualMemory	process_identifier: 2988 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x77d4f000	success

Creates executable files on the filesystem (2 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\jhgfdbvzKJHgfgh.exe
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\iytuKGHJBfghs.exe

Drops a binary and executes it (2 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\jhgfdbvzKJHgfgh.exe
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\iytuKGHJBfghs.exe

Drops an executable to the user AppData folder (2 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\jhgfdbvzKJHgfgh.exe
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\iytuKGHJBfghs.exe

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620726217.98285 NtProtectVirtualMemory	process_identifier: 2200 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 24576 protection: 32 (PAGE_EXECUTE_READ) process_handle: 0xffffffff base_address: 0x00350000	success	0	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620736129.704125 GetAdaptersAddresses	flags: 0 family: 0	failed	111	0

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

7.8588137824017155

section

{'size_of_data': '0x000ef000', 'virtual_address': '0x00001000', 'entropy': 7.8588137824017155, 'name': '.text', 'virtual_size': '0x000ee764'}

description

A section with a high entropy has been found

entropy

0.991701244813278

description

Overall entropy of this PE file is high

One or more of the buffers contains an embedded PE file (3 个事件)

buffer	Buffer with sha1: 200571efcf8e6f01aa7b605e6e7c19ebfe14a3eb
buffer	Buffer with sha1: 304155afb0db2964a5b562d97fa3471b04be6663
buffer	Buffer with sha1: b08e06fd0c41c09141c6b885b74990ad59ab1550

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Sets or modifies WPAD proxy autoconfiguration file for traffic interception (12 个事件)

Time & API	Arguments	Status
1620736132.329125 RegSetValueExA	key_handle: 0x00000360 value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason	success
1620736132.345125 RegSetValueExA	key_handle: 0x00000360 value: Õhh^F× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime	success
1620736132.345125 RegSetValueExA	key_handle: 0x00000360 value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision	success
1620736132.345125 RegSetValueExW	key_handle: 0x00000360 value: 网络 2 regkey_r: WpadNetworkName reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName	success
1620736132.361125 RegSetValueExA	key_handle: 0x00000378 value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason	success
1620736132.376125 RegSetValueExA	key_handle: 0x00000378 value: Õhh^F× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime	success
1620736132.376125 RegSetValueExA	key_handle: 0x00000378 value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision	success
1620736132.470125 RegSetValueExW	key_handle: 0x0000035c value: {40112ABE-63B3-43C3-BE93-1440EE3AF106} regkey_r: WpadLastNetwork reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadLastNetwork	success
1620736132.329375 RegSetValueExA	key_handle: 0x00000344 value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason	success
1620736132.345375 RegSetValueExA	key_handle: 0x00000344 value: Õhh^F× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime	success
1620736132.345375 RegSetValueExA	key_handle: 0x00000344 value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision	success
1620736132.361375 RegSetValueExW	key_handle: 0x00000344 value: 网络 2 regkey_r: WpadNetworkName reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName	success

Network activity contains more than one unique useragent (2 个事件)

process	jhgfdbvzKJHgfgh.exe				useragent	Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1)
process	iytuKGHJBfghs.exe				useragent

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (6 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2200 called NtSetContextThread to modify thread in remote process 1060
Process injection	Process 2520 called NtSetContextThread to modify thread in remote process 2864
Process injection	Process 2424 called NtSetContextThread to modify thread in remote process 2988
1620726222.26385 NtSetContextThread	thread_handle: 0x000001d4 registers.eip: 4796416 registers.esp: 1638384 registers.edi: 0 registers.eax: 4455059 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 2010382788 process_identifier: 1060	success	0	0
1620736126.2675 NtSetContextThread	thread_handle: 0x00000114 registers.eip: 4325376 registers.esp: 1638384 registers.edi: 0 registers.eax: 4302468 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 2010382788 process_identifier: 2864	success	0	0
1620736126.423625 NtSetContextThread	thread_handle: 0x00000114 registers.eip: 4407296 registers.esp: 1638384 registers.edi: 0 registers.eax: 4291211 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 2010382788 process_identifier: 2988	success	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (6 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2200 resumed a thread in remote process 1060
Process injection	Process 2520 resumed a thread in remote process 2864
Process injection	Process 2424 resumed a thread in remote process 2988
1620726222.76385 NtResumeThread	thread_handle: 0x000001d4 suspend_count: 1 process_identifier: 1060	success	0	0
1620736126.6735 NtResumeThread	thread_handle: 0x00000114 suspend_count: 1 process_identifier: 2864	success	0	0
1620736127.048625 NtResumeThread	thread_handle: 0x00000114 suspend_count: 1 process_identifier: 2988	success	0	0

Generates some ICMP traffic

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 个事件)

dead_host

103.200.30.143:443

Executed a process and injected code into it, probably while unpacking (22 个事件)

Time & API	Arguments	Status	Return
1620726219.41985 CreateProcessInternalW	thread_identifier: 3040 thread_handle: 0x000001dc process_identifier: 2520 current_directory: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\jhgfdbvzKJHgfgh.exe track: 1 command_line: "C:\Users\ADMINI~1.OSK\AppData\Local\Temp\jhgfdbvzKJHgfgh.exe" filepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\jhgfdbvzKJHgfgh.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) process_handle: 0x0000022c inherit_handles: 0	success	1
1620726219.56085 CreateProcessInternalW	thread_identifier: 1164 thread_handle: 0x000001dc process_identifier: 2424 current_directory: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\iytuKGHJBfghs.exe track: 1 command_line: "C:\Users\ADMINI~1.OSK\AppData\Local\Temp\iytuKGHJBfghs.exe" filepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\iytuKGHJBfghs.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) process_handle: 0x00000264 inherit_handles: 0	success	1
1620726222.23285 CreateProcessInternalW	thread_identifier: 784 thread_handle: 0x000001d4 process_identifier: 1060 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\3f3df6de2e1f11e5ff1c7a575b4bf8e7.exe track: 1 command_line: filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\3f3df6de2e1f11e5ff1c7a575b4bf8e7.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x000001cc inherit_handles: 0	success	1
1620726222.23285 NtGetContextThread	thread_handle: 0x000001d4	success	0
1620726222.23285 NtUnmapViewOfSection	process_identifier: 1060 region_size: 4096 process_handle: 0x000001cc base_address: 0x00400000	success	0
1620726222.23285 NtMapViewOfSection	section_handle: 0x000001c4 process_identifier: 1060 commit_size: 0 win32_protect: 64 (PAGE_EXECUTE_READWRITE) buffer: process_handle: 0x000001cc allocation_type: 0 () section_offset: 0 view_size: 622592 base_address: 0x00400000	success	0
1620726222.26385 NtSetContextThread	thread_handle: 0x000001d4 registers.eip: 4796416 registers.esp: 1638384 registers.edi: 0 registers.eax: 4455059 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 2010382788 process_identifier: 1060	success	0
1620726222.76385 NtResumeThread	thread_handle: 0x000001d4 suspend_count: 1 process_identifier: 1060	success	0
1620736126.2515 CreateProcessInternalW	thread_identifier: 2288 thread_handle: 0x00000114 process_identifier: 2864 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\jhgfdbvzKJHgfgh.exe track: 1 command_line: filepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\jhgfdbvzKJHgfgh.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x0000011c inherit_handles: 0	success	1
1620736126.2515 NtGetContextThread	thread_handle: 0x00000114	success	0
1620736126.2515 NtUnmapViewOfSection	process_identifier: 2864 region_size: 4096 process_handle: 0x0000011c base_address: 0x00400000	success	0
1620736126.2515 NtMapViewOfSection	section_handle: 0x000000e0 process_identifier: 2864 commit_size: 0 win32_protect: 64 (PAGE_EXECUTE_READWRITE) buffer: process_handle: 0x0000011c allocation_type: 0 () section_offset: 0 view_size: 151552 base_address: 0x00400000	success	0
1620736126.2675 NtSetContextThread	thread_handle: 0x00000114 registers.eip: 4325376 registers.esp: 1638384 registers.edi: 0 registers.eax: 4302468 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 2010382788 process_identifier: 2864	success	0
1620736126.6735 NtResumeThread	thread_handle: 0x00000114 suspend_count: 1 process_identifier: 2864	success	0
1620736126.407625 CreateProcessInternalW	thread_identifier: 2632 thread_handle: 0x00000114 process_identifier: 2988 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\iytuKGHJBfghs.exe track: 1 command_line: filepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\iytuKGHJBfghs.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x0000011c inherit_handles: 0	success	1
1620736126.407625 NtGetContextThread	thread_handle: 0x00000114	success	0
1620736126.407625 NtUnmapViewOfSection	process_identifier: 2988 region_size: 4096 process_handle: 0x0000011c base_address: 0x00400000	success	0
1620736126.407625 NtMapViewOfSection	section_handle: 0x000000e0 process_identifier: 2988 commit_size: 0 win32_protect: 64 (PAGE_EXECUTE_READWRITE) buffer: process_handle: 0x0000011c allocation_type: 0 () section_offset: 0 view_size: 233472 base_address: 0x00400000	success	0
1620736126.423625 NtSetContextThread	thread_handle: 0x00000114 registers.eip: 4407296 registers.esp: 1638384 registers.edi: 0 registers.eax: 4291211 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 2010382788 process_identifier: 2988	success	0
1620736127.048625 NtResumeThread	thread_handle: 0x00000114 suspend_count: 1 process_identifier: 2988	success	0
1620736127.329125 NtResumeThread	thread_handle: 0x000000f4 suspend_count: 1 process_identifier: 2864	success	0
1620736127.689875 NtResumeThread	thread_handle: 0x00000148 suspend_count: 1 process_identifier: 1060	success	0

File has been identified by 57 AntiVirus engines on VirusTotal as malicious (50 out of 57 个事件)

Bkav	W32.AIDetect.malware2
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Barys.102299
FireEye	Generic.mg.3f3df6de2e1f11e5
CAT-QuickHeal	Trojan.IGENERIC
McAfee	PWS-FCPU!3F3DF6DE2E1F
Cylance	Unsafe
Zillya	Trojan.Azorult.Win32.4
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 0056d5a11 )
Alibaba	TrojanPSW:Win32/Azorult.1f49379b
K7GW	Trojan ( 0056d5a11 )
CrowdStrike	win/malicious_confidence_90% (W)
Arcabit	Trojan.Barys.D18F9B
Cyren	W32/Trojan.PXFQ-7971
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Avast	Win32:CrypterX-gen [Trj]
ClamAV	Win.Malware.Zard-9653261-0
Kaspersky	Trojan-PSW.Win32.Azorult.aozv
BitDefender	Gen:Variant.Barys.102299
NANO-Antivirus	Trojan.Win32.Azorult.htpbdq
Paloalto	generic.ml
Tencent	Malware.Win32.Gencirc.11ae2a7d
Ad-Aware	Gen:Variant.Barys.102299
Sophos	Mal/Generic-S
F-Secure	Trojan.TR/AD.MoksSteal.pigso
DrWeb	Trojan.Siggen10.9113
VIPRE	Trojan.Win32.Generic!BT
McAfee-GW-Edition	BehavesLike.Win32.Generic.dc
Emsisoft	Trojan.Agent (A)
SentinelOne	Static AI - Suspicious PE
Jiangmin	Trojan.PSW.Azorult.hgm
Webroot	W32.Trojan.TR.Dropper
Avira	TR/AD.MoksSteal.pigso
Antiy-AVL	Trojan/Win32.Injector
Gridinsoft	Trojan.Win32.Kryptik.oa
Microsoft	TrojanSpy:Win32/Banload.AAA!rfn
ZoneAlarm	Trojan-PSW.Win32.Azorult.aozv
GData	Gen:Variant.Barys.102299
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.Injector.R349452
VBA32	TScope.Trojan.VB
ALYac	Gen:Variant.Barys.102299
MAX	malware (ai score=85)
Malwarebytes	Trojan.MalPack
ESET-NOD32	a variant of Win32/Injector.ENLK
Rising	Stealer.Azorult!8.11176 (CLOUD)
Yandex	Trojan.GenKryptik!LnhW2KGVBYI
Ikarus	Trojan-Spy.Agent

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-09-01 01:06:35

Imports

Library ADVAPI32.DLL:

• 0x401000 CryptCreateHash

• 0x401004 CryptDecrypt

• 0x401008 RegQueryValueExW

Library KERNEL32.DLL:

• 0x401010 VirtualProtect

• 0x401014 RtlMoveMemory

• 0x401018 CloseHandle

• 0x40101c WriteFile

Library MSVBVM60.DLL:

• 0x401024 _CIcos

• 0x401028 _adj_fptan

• 0x40102c __vbaVarMove

• 0x401030 __vbaVarVargNofree

• 0x401034 __vbaFreeVar

• 0x401038 __vbaStrVarMove

• 0x40103c __vbaLenBstr

• 0x401040 __vbaFreeVarList

• 0x401044 _adj_fdiv_m64

• 0x401048

• 0x40104c _adj_fprem1

• 0x401050 __vbaStrCat

• 0x401054 __vbaRecDestruct

• 0x401058 __vbaHresultCheckObj

• 0x40105c _adj_fdiv_m32

• 0x401060 __vbaAryDestruct

• 0x401064 __vbaObjSet

• 0x401068

• 0x40106c __vbaStrLike

• 0x401070 _adj_fdiv_m16i

• 0x401074 __vbaObjSetAddref

• 0x401078 _adj_fdivr_m16i

• 0x40107c __vbaRefVarAry

• 0x401080 _CIsin

• 0x401084 __vbaErase

• 0x401088 __vbaVarZero

• 0x40108c

• 0x401090 __vbaChkstk

• 0x401094 EVENT_SINK_AddRef

• 0x401098

• 0x40109c __vbaStrCmp

• 0x4010a0 __vbaAryConstruct2

• 0x4010a4 __vbaRedimPreserve

• 0x4010a8 _adj_fpatan

• 0x4010ac __vbaRedim

• 0x4010b0 EVENT_SINK_Release

• 0x4010b4 _CIsqrt

• 0x4010b8 EVENT_SINK_QueryInterface

• 0x4010bc __vbaExceptHandler

• 0x4010c0 _adj_fprem

• 0x4010c4 _adj_fdivr_m64

• 0x4010c8

• 0x4010cc

• 0x4010d0 __vbaFPException

• 0x4010d4

• 0x4010d8 __vbaUbound

• 0x4010dc

• 0x4010e0 _CIlog

• 0x4010e4 _adj_fdiv_m32i

• 0x4010e8 _adj_fdivr_m32i

• 0x4010ec __vbaStrCopy

• 0x4010f0 __vbaI4Str

• 0x4010f4 __vbaFreeStrList

• 0x4010f8 _adj_fdivr_m32

• 0x4010fc _adj_fdiv_r

• 0x401100

• 0x401104 __vbaI4Var

• 0x401108 __vbaAryLock

• 0x40110c __vbaVarDup

• 0x401110

• 0x401114 _CIatan

• 0x401118 __vbaCastObj

• 0x40111c __vbaAryCopy

• 0x401120 __vbaStrMove

• 0x401124 _allmul

• 0x401128 _CItan

• 0x40112c __vbaAryUnlock

• 0x401130 _CIexp

• 0x401134 __vbaFreeStr

• 0x401138 __vbaFreeObj

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
pablito.ug
telete.in	A 103.200.30.143	74.86.118.24
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
pabloq.ug
teredo.ipv6.microsoft.com

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49713	114.114.114.114	53
192.168.56.101	50002	114.114.114.114	53
192.168.56.101	50568	114.114.114.114	53
192.168.56.101	51808	114.114.114.114	53
192.168.56.101	51963	114.114.114.114	53
192.168.56.101	53380	114.114.114.114	53
192.168.56.101	53657	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	58367	114.114.114.114	53
192.168.56.101	60384	114.114.114.114	53
192.168.56.101	61680	114.114.114.114	53
192.168.56.101	62318	114.114.114.114	53
192.168.56.101	62912	114.114.114.114	53
192.168.56.101	65004	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	49235	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	57756	224.0.0.252	5355
192.168.56.101	57874	224.0.0.252	5355

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.