SmartHawk

2.5

中危

64 个模型检测该样本为恶意！

重新分析

下载样本

305ec9e51f69fe3bea12fc210601eb8b55efd32243957f60e1b189e2cb712f3e

305ec9e51f69fe3bea12fc210601eb8b55efd32243957f60e1b189e2cb712f3e.exe

分析耗时

15s

最近分析

394天前

文件大小

32.0KB

静态报毒动态报毒 CVE FAMILY METATYPE PLATFORM TYPE UNKNOWN WIN32 TROJAN DOWNLOADER RAZY

DACN 0.14

FACILE 1.00

IMCLNet 0.62

MFGraph 0.00

引擎	描述	特征	威胁分数	可能家族	检测耗时
DACN	基于动态分析和胶囊网络的可视化恶意软件检测	API调用、DLL以及注册表的修改情况	0.14	Unknown	0.04s
FACILE	利用改进的层次胶囊网络对二进制恶意软件图像进行识别分类	二进制图像映射为的灰度图像	1.00	Unknown	0.03s
IMCLNet	轻量化深度卷积网络模型实现恶意软件家族检测	原始二进制映射而成的可视化图像	0.62	Unknown	0.16s
MFGraph	利用静态特征构建图网络以检测恶意软件	原始二进制PE文件的静态特征节点	0.00	Unknown	0.00s

查杀引擎	查杀结果	查杀时间	查杀版本
Alibaba	None	20190527	0.3.0.5
Avast	Win32:DropperX-gen [Drp]	20200509	18.4.3895.0
Baidu	Win32.Trojan.Inject.bm	20190318	1.0.0.2
CrowdStrike	win/malicious_confidence_100% (D)	20190702	1.0
Kingsoft	None	20200509	2013.8.14.323
McAfee	Downloader-BIJ.a	20200509	6.0.6.653
Tencent	Malware.Win32.Gencirc.116735a6	20200509	1.0.0.1

观察到命令行控制台输出 (11 个事件)

Time & API	Arguments	Status	Return
1727110791.187375 WriteConsoleW	console_handle: 0x00000007 buffer: C:\Users\Administrator\AppData\Local\Temp>	success	1
1727110791.187375 WriteConsoleW	console_handle: 0x00000007 buffer: del	success	1
1727110791.187375 WriteConsoleW	console_handle: 0x00000007 buffer: "C:\Users\Administrator\AppData\Local\RemoteAccess.exe" /a	success	1
1727110791.187375 WriteConsoleW	console_handle: 0x00000007 buffer: C:\Users\Administrator\AppData\Local\Temp>	success	1
1727110791.187375 WriteConsoleW	console_handle: 0x00000007 buffer: move	success	1
1727110791.187375 WriteConsoleW	console_handle: 0x00000007 buffer: "C:\Users\Administrator\AppData\Local\RemoteAccess.exe.tmp1" "C:\Users\Administrator\AppData\Local\RemoteAccess.exe"	success	1
1727110791.202375 WriteConsoleW	console_handle: 0x00000007 buffer: 移动了 1 个文件。	success	1
1727110791.202375 WriteConsoleW	console_handle: 0x00000007 buffer: C:\Users\Administrator\AppData\Local\Temp>	success	1
1727110791.202375 WriteConsoleW	console_handle: 0x00000007 buffer: del	success	1
1727110791.202375 WriteConsoleW	console_handle: 0x00000007 buffer: a.bat	success	1
1727110791.202375 WriteConsoleW	console_handle: 0x0000000b buffer: 找不到批处理文件。	success	1

一个或多个进程崩溃 (3 个事件)

Time & API	Arguments	Status
1727110789.781125 __exception__	exception.address: 0x402133 exception.instruction: xor byte ptr [ecx], al exception.instruction_r: 30 01 ff 45 fc 8b 45 fc 3b 45 10 7c ad 5f 5e 5b exception.symbol: szFile-0x210d 305ec9e51f69fe3bea12fc210601eb8b55efd32243957f60e1b189e2cb712f3e+0x2133 exception.exception_code: 0xc0000005 registers.eax: 82 registers.ecx: 4214964 registers.edx: 198 registers.ebx: 256 registers.esp: 1637600 registers.ebp: 1637624 registers.esi: 1637976 registers.edi: 256 stacktrace: szFile-0x2fc6 305ec9e51f69fe3bea12fc210601eb8b55efd32243957f60e1b189e2cb712f3e+0x127a @ 0x40127a BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76ee33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x775b9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x775b9ea5	success
1727110789.781125 __exception__	exception.address: 0x402133 exception.instruction: xor byte ptr [ecx], al exception.instruction_r: 30 01 ff 45 fc 8b 45 fc 3b 45 10 7c ad 5f 5e 5b exception.symbol: szFile-0x210d 305ec9e51f69fe3bea12fc210601eb8b55efd32243957f60e1b189e2cb712f3e+0x2133 exception.exception_code: 0xc0000005 registers.eax: 170 registers.ecx: 4218880 registers.edx: 105 registers.ebx: 256 registers.esp: 1637600 registers.ebp: 1637624 registers.esi: 1637976 registers.edi: 256 stacktrace: szFile-0x2fc6 305ec9e51f69fe3bea12fc210601eb8b55efd32243957f60e1b189e2cb712f3e+0x127a @ 0x40127a BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76ee33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x775b9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x775b9ea5	success
1727110789.781125 __exception__	exception.address: 0x402133 exception.instruction: xor byte ptr [ecx], al exception.instruction_r: 30 01 ff 45 fc 8b 45 fc 3b 45 10 7c ad 5f 5e 5b exception.symbol: szFile-0x210d 305ec9e51f69fe3bea12fc210601eb8b55efd32243957f60e1b189e2cb712f3e+0x2133 exception.exception_code: 0xc0000005 registers.eax: 67 registers.ecx: 4222976 registers.edx: 93 registers.ebx: 256 registers.esp: 1637600 registers.ebp: 1637624 registers.esi: 1637976 registers.edi: 256 stacktrace: szFile-0x2fc6 305ec9e51f69fe3bea12fc210601eb8b55efd32243957f60e1b189e2cb712f3e+0x127a @ 0x40127a BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76ee33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x775b9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x775b9ea5	success

分配可读-可写-可执行内存（通常用于自解压） (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1727110789.781125 NtProtectVirtualMemory	process_handle: 0xffffffff base_address: 0x00400000 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_identifier: 1612	success	0	0
1727110789.781125 NtProtectVirtualMemory	process_handle: 0xffffffff base_address: 0x72591000 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_identifier: 1612	success	0	0

在文件系统上创建可执行文件 (2 个事件)

file	C:\Users\Administrator\AppData\Local\Temp\a.bat
file	C:\Users\Administrator\AppData\Local\Temp\~dfds3.reg

将可执行文件投放到用户的 AppData 文件夹 (1 个事件)

file	C:\Users\Administrator\AppData\Local\RemoteAccess.exe

该二进制文件可能包含加密或压缩数据，表明使用了打包工具 (2 个事件)

section

{'name': '.rsrc', 'virtual_address': '0x00005000', 'virtual_size': '0x00002cc4', 'size_of_data': '0x00003000', 'entropy': 7.742650574729505}

entropy

7.742650574729505

description

发现高熵的节

entropy

0.42857142857142855

description

此PE文件的整体熵值较高

与未执行 DNS 查询的主机进行通信 (1 个事件)

host

114.114.114.114

枚举服务，可能用于反虚拟化 (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1727110789.781125 EnumServicesStatusA	service_handle: 0x003447a0 service_type: 48 service_status: 2	success	1	0

在 Windows 启动时自我安装以实现自动运行 (1 个事件)

reg_key

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\RemoteAccess

reg_value

C:\Users\Administrator\AppData\Local\RemoteAccess.exe

文件已被 VirusTotal 上 64 个反病毒引擎识别为恶意 (50 out of 64 个事件)

ALYac	Trojan.Injector
APEX	Malicious
AVG	Win32:DropperX-gen [Drp]
Acronis	suspicious
Ad-Aware	Gen:Variant.Razy.448218
AhnLab-V3	Backdoor/Win32.CSon.R885
Antiy-AVL	Trojan[Downloader]/Win32.Rubinurd.b
Arcabit	Trojan.Razy.D6D6DA
Avast	Win32:DropperX-gen [Drp]
Avira	TR/Dropper.Gen
Baidu	Win32.Trojan.Inject.bm
BitDefender	Gen:Variant.Razy.448218
BitDefenderTheta	AI:Packer.54A3CF691F
Bkav	W32.AIDetectVM.malware
CAT-QuickHeal	Trojan.Mauvaise.SL1
CMC	Trojan-Downloader.Win32.Rubinurd!O
ClamAV	Win.Trojan.Rubinurd-67
Comodo	TrojWare.Win32.Toga.B@6vx8t0
CrowdStrike	win/malicious_confidence_100% (D)
Cybereason	malicious.0162f6
Cylance	Unsafe
Cyren	W32/A-1a76837c!Eldorado
DrWeb	Win32.HLLW.Autoruner.27746
ESET-NOD32	Win32/TrojanDownloader.Agent.PTT
Emsisoft	Gen:Variant.Razy.448218 (B)
Endgame	malicious (high confidence)
F-Prot	W32/A-1a76837c!Eldorado
F-Secure	Trojan.TR/Dropper.Gen
FireEye	Generic.mg.407e23c0162f66fd
Fortinet	W32/Injector.BFSU!tr
GData	Win32.Trojan.Agent.ASM
Ikarus	Trojan-Downloader.SuspectCRC
Invincea	heuristic
Jiangmin	TrojanDownloader.Small.akba
K7AntiVirus	Trojan-Downloader ( 0040f54b1 )
K7GW	Trojan-Downloader ( 000918cf1 )
Kaspersky	HEUR:Trojan.Win32.Miancha.gen
MAX	malware (ai score=80)
Malwarebytes	Backdoor.Simbot
MaxSecure	Trojan.Downloader.Rubinurd.bf
McAfee	Downloader-BIJ.a
McAfee-GW-Edition	BehavesLike.Win32.Backdoor.nm
MicroWorld-eScan	Gen:Variant.Razy.448218
Microsoft	VirTool:Win32/CeeInject.gen!DU
NANO-Antivirus	Trojan.Win32.Autoruner.bbwavd
Panda	Trj/Genetic.gen
Qihoo-360	Win32/Dropper.Dapato.A
Rising	Dropper.Generic!8.35E (TFE:dGZlOgUzB9g24BWYcQ)
SUPERAntiSpyware	Backdoor.Bot/Variant
Sangfor	Malware

288x288

224x224

192x192

160x160

128x128

96x96

64x64

32x32

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2010-09-07 10:27:10

PE Imphash

f54bab47f74e370cf85ce98d899e8149

Sections

Name	Virtual Address	Virtual Size	Size of Raw Data	Entropy
.text	0x00001000	0x00001755	0x00002000	5.84360056821301
.rdata	0x00003000	0x000005a5	0x00001000	2.233959569513802
.data	0x00004000	0x00000593	0x00001000	1.146323008621765
.rsrc	0x00005000	0x00002cc4	0x00003000	7.742650574729505

Resources

Name	Offset	Size	Language	Sub-language	File type
RT_RCDATA	0x000050b4	0x00002800	LANG_ENGLISH	SUBLANG_ENGLISH_US	None
RT_VERSION	0x000078b4	0x00000410	LANG_ENGLISH	SUBLANG_ENGLISH_US	None

Imports

Library KERNEL32.dll:

• 0x40301c ExitProcess

• 0x403020 ReadFile

• 0x403024 HeapAlloc

• 0x403028 GetProcessHeap

• 0x40302c GetFileSize

• 0x403030 CopyFileA

• 0x403034 GetModuleFileNameA

• 0x403038 LeaveCriticalSection

• 0x40303c GetProcAddress

• 0x403040 EnterCriticalSection

• 0x403044 VirtualProtect

• 0x403048 InitializeCriticalSection

• 0x40304c GetModuleHandleA

• 0x403050 LockResource

• 0x403054 LoadResource

• 0x403058 SetFilePointer

• 0x40305c FindResourceA

• 0x403060 GetLastError

• 0x403064 MoveFileA

• 0x403068 DeleteFileA

• 0x40306c lstrcmpiA

• 0x403070 GetLongPathNameA

• 0x403074 ExpandEnvironmentStringsA

• 0x403078 GetTickCount

• 0x40307c OutputDebugStringA

• 0x403080 lstrlenA

• 0x403084 TerminateProcess

• 0x403088 VirtualAllocEx

• 0x40308c HeapFree

• 0x403090 VirtualAlloc

• 0x403094 Sleep

• 0x403098 lstrcpyA

• 0x40309c lstrcatA

• 0x4030a0 CreateFileA

• 0x4030a4 WriteFile

• 0x4030a8 CloseHandle

• 0x4030ac SizeofResource

• 0x4030b0 WinExec

Library USER32.dll:

• 0x4030c4 wsprintfA

• 0x4030c8 MessageBoxA

Library ADVAPI32.dll:

• 0x403000 CloseServiceHandle

• 0x403004 CryptGenRandom

• 0x403008 CryptReleaseContext

• 0x40300c EnumServicesStatusA

• 0x403010 OpenSCManagerA

• 0x403014 CryptAcquireContextA

Library SHLWAPI.dll:

• 0x4030b8 PathRemoveFileSpecA

• 0x4030bc StrChrA

Exports

Ordinal	Address	Name
1	0x404240	szFile

L!This program cannot be run in DOS mode.
.rdata
@.data
3fj@3Yu
tESPh
SVWj@3Y3j?fY3f^
EPEPhL@@
MSQEuPV
YYPV5X0@
ESPuW=0@
ESPuh$
ESPuh/
ESPuhl
;t$uuh
jfhL@@
_^3[UQQe
H<EHC@
X^UQQV5
WEWP}}
;t'EPEPEPh
3?;3j u
A(;r3_^[
P[KT4T
Onfj>ION^N0E1
L"Y4J]Gm
h37-*i`
ywL[y>
.F5D{2\GwKbxM{
1#Io0u
+'EzDX9
|F7VO8?
fZN1Dq;
n,d7k
TTf$5pD
O36*3.! V
:HYn="']+KY^no{
@RyAE{z7
2(:tBrA
}ZUSVu
|_^[]UE
B`@@'D$)
t(*mP:
\IZ`%,bs1
W?HZt4h??pl
X@Mw%W)
'"=q=er`6
=9@iucYC
y@hBl3`"=2
tPDhJJ
lt[Vy<
S-Lae"9P%v0
!kbo0c
[U{!b$o2
S"i#Mo
EE~cSVu
3fj@3Yj@fY3fj@3Yu
]f]@~)M
GEQ@9E|
3tESPPPPu
uRFGHt
t+t'NW8u
;uH_^Q=
r)$h%@
DDDDDDDDDDDDDD
WinExec
CloseHandle
WriteFile
CreateFileA
lstrcatA
lstrcpyA
SetFilePointer
ExitProcess
ReadFile
HeapAlloc
GetProcessHeap
GetFileSize
CopyFileA
GetModuleFileNameA
LeaveCriticalSection
GetProcAddress
EnterCriticalSection
VirtualProtect
InitializeCriticalSection
GetModuleHandleA
LockResource
LoadResource
SizeofResource
FindResourceA
GetLastError
MoveFileA
DeleteFileA
lstrcmpiA
GetLongPathNameA
ExpandEnvironmentStringsA
GetTickCount
OutputDebugStringA
lstrlenA
TerminateProcess
VirtualAllocEx
HeapFree
VirtualAlloc
KERNEL32.dll
wsprintfA
MessageBoxA
USER32.dll
CryptReleaseContext
CryptGenRandom
CryptAcquireContextA
CloseServiceHandle
EnumServicesStatusA
OpenSCManagerA
ADVAPI32.dll
StrChrA
PathRemoveFileSpecA
SHLWAPI.dll
roudanx.exe
szFile
na.bat
del "%s" /a
move "%s" "%s"
del %%0
rwbinru/dyd
RT_RCDATA
EndUpdateResourceA
UpdateResourceA
BeginUpdateResourceA
kernel32
szFile
ResumeThread
SetThreadContext
WriteProcessMemory
VirtualProtectEx
VirtualQueryEx
ReadProcessMemory
GetThreadContext
CreateProcessA
ZwUnmapViewOfSection
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
WinHttp
Are you sure?
regedit.exe /s 
~dfds3.reg
%tmp%\
Windows Registry Editor Version 5.00
"%s"="%s"
<e.Q505[r
a;D?,8
XbNM6v
sTmLi$
8\,&Sk
[jZ(lC
P:Vy=_vym3n
tZ#aYxYoG$;0M
CIGo[s
!9USgS
!E:TGB
`y07Zh
@Q@$v*i4H2|:
k")s{)g
}r@i9$f
%T(cYF*_
L^]PpN%1C6n)
*c/U4${
eLi9]8!i+PPF
{n7m5JFQw
\)cL^Y\HE9:
[F@,*7|{
[TL0f~%C5C5
f#4vUS
t*PX*au
[scXtzuE0M3^?
S}6_VM
9cJA !wg
[.P^g/=?irSc
-z0koZWNZO#
QN-xWr
;)vxzp
?QC4 8+#nx
>16\d[Jd:
p#3J7e
Yr087.. u
T%^ECd
wB*eN9@
9(3{pVfI-
NAUL9Hq
LK}%m$@D=2
,d4Mtr1U>aAK
uUwl?;aLlGy
n)lyAOu
GTWeHr
/q{V!S
vCL9UQHD
Wg~Y) W
-i35^3P5^x
jx[,`Ap
j6&>]!
<B#mBg
`BcF.)
E;rU~y
.dSz>xn
TaeeUX
kSw4?~:J<
Re<dOMQseSz
{GV{|U
uqjW!E
tL$EN6|
h9bA=G
w(@z7F/
RU8t7DLx<
 Gy/Maz
vxa%6:0z;c
@N51NSIuHVHW55-
w"u9Yyt\`(4aXF~
~"9v"6F
b](i]%
o]#)x0
#obX8!f
Fp8n&AIQ;h+C
^\"$TE
m]Q{!`=
b [EW?yp:
ho 2Sg
p~hLk+
8m@d7[U
nbKNGV@3hO
HQvFm3y6
7qlLS5^YHw
wd3uP1
{JW[!Vz
0+o/XJ
,]D8Zr|
:A\]Wn0+Ua!
4lm\XzK
MopTbQO
}'Z0>lXW
}8_L^%sx-r
!dS:/mqrZ24x[
h?fp>2F
]mC`*IZ
0(69/}9
54 XZ#
!CVMVT
YL2#gG:
Z\~I=A{
Gh<y.?8
CZEI]+
Q1qig^UP
 x>@~n
a3LD;smbo~
Sqe\**
<<p"/Q
TT`#SrC
HdeeV@
*x<5G<`\L3eX1[}:
>k;s*R]Q]Q
0?]H~a'D-0
z^'w4(n{:oEC
&Dhze9
H$Kc)r7
&Q|KC,/AZd|g]
C7/?'S/m
G-BmZ9
v~c~Cj
!(Y-VsnL
\`<(8gui
004PHx
RZ<kyw
b00#\v;C
]=}t] 
v&%*VO
e@g6'z=r
i<rH~pHp;Y;`1}r{
<DFRTDi
@%yav=vJf@rfmo(C
n_T!wiUP&G\zg
GOa_4Cm~+M
u5QQ\LDGXH
pCWZ1b
]j`qxQK
4s`JZEKN(b
G#;RKt^p),
+U!*K`s
5E8*JX
4[ff7-$"(n
;V PUb
3j+zJJ}
8O b_gAf
&J9_s$
`Enj5Bq1~
(JQ~o?/I
UI$iIz
a(v!pS+V
M~#<{g
Xyyz1-
Im"6|%5
MT<quKFM|]_IJE$
/C-~mC
[0O~@CA*
b[d/IMu7
qsCE-1 0NAH
,9{Cz
| ")[7
9C1N$uL'yp-
8YCyHP
/pW\JX~&aa
cwXt'lpV
{y~\(h*]=3iD
*3B~iBL
)6XO|BRjr1kR\$
@v5n{'7
1]fSWo58^;-
`D^cVf
R#dtK7
fsaikf
ewCej [
s] YK(
A0|o;c5)
7JW%#%A
[.V3e5
)x/]k$:z
G3u]o+N8%x}
|hrHRNWQ?
d_MVDKpb?^_H&y6
mM'~(#Jw8
iQ@~aFig<H
PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPAD
RT_RCDATA
VS_VERSION_INFO
StringFileInfo
040904b0
CompanyName
Adobe Systems, Inc.
FileDescription
Adobe? Flash? Player Installer/Uninstaller 10.1 r53
FileVersion
10,1,53,64
InternalName
Adobe? Flash? Player Installer/Uninstaller 10.1
LegalCopyright
Copyright ? 1996-2010 Adobe, Inc.
LegalTrademarks
Adobe? Flash? Player
OriginalFilename
FlashUtil.exe
ProductName
Flash? Player Installer/Uninstaller
ProductVersion
10,1,53,64
VarFileInfo
Translation

Process Tree

305ec9e51f69fe3bea12fc210601eb8b55efd32243957f60e1b189e2cb712f3e.exe (1612) "C:\Users\Administrator\AppData\Local\Temp\305ec9e51f69fe3bea12fc210601eb8b55efd32243957f60e1b189e2cb712f3e.exe"
- cmd.exe (2656) cmd /c a.bat
- regedit.exe (2400) regedit.exe /s C:\Users\ADMINI~1\AppData\Local\Temp\~dfds3.reg

305ec9e51f69fe3bea12fc210601eb8b55efd32243957f60e1b189e2cb712f3e.exe, PID: 1612, Parent PID: 2244

default registry file network process services synchronisation iexplore office pdf

regedit.exe, PID: 2400, Parent PID: 1612

default registry file network process services synchronisation iexplore office pdf

cmd.exe, PID: 2656, Parent PID: 1612

default registry file network process services synchronisation iexplore office pdf

Hosts

IP
114.114.114.114

DNS

Name	Response	Post-Analysis Lookup
dns.msftncsi.com

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	53179	224.0.0.252	5355
192.168.56.101	49642	224.0.0.252	5355
192.168.56.101	137	192.168.56.255	137
192.168.56.101	61714	114.114.114.114	53

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Name	1d5d8ff8ef35c8e6_remoteaccess.exe
Filepath	c:\users\administrator\appdata\local\remoteaccess.exe
Size	32.0KB
Processes	1612 (305ec9e51f69fe3bea12fc210601eb8b55efd32243957f60e1b189e2cb712f3e.exe) 2656 (cmd.exe)
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`5c3c0f4bbbd00d96a49b12398ceb51cd`
SHA1	`b312328cf0693c8698bb7789a506cd86deaa22e9`
SHA256	`1d5d8ff8ef35c8e6405b3021920f88eb29fb327895fdb6571149a2faa5ff84d9`
CRC32	`96210798`
ssdeep	`None`
Yara	None matched
VirusTotal	Search for analysis

Name	687bc66cbf7e7e3d_a.bat
Filepath	C:\Users\Administrator\AppData\Local\Temp\a.bat
Size	1.0KB
Processes	1612 (305ec9e51f69fe3bea12fc210601eb8b55efd32243957f60e1b189e2cb712f3e.exe) 2656 (cmd.exe)
Type	data
MD5	`b5168593fe19bc7a7f83f8bafb9bd6cb`
SHA1	`566643ce88537eb4f8b0e0b330f96a9a8844240b`
SHA256	`687bc66cbf7e7e3d03511f413cec8e0516cdc0521f2ec973ddc126d0b3f77012`
CRC32	`B8229330`
ssdeep	`None`
Yara	None matched
VirusTotal	Search for analysis

Name	305ec9e51f69fe3b_RemoteAccess.exe
Filepath	C:\Users\Administrator\AppData\Local\RemoteAccess.exe
Size	32.0KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`407e23c0162f66fdeee6c08498de7920`
SHA1	`1c3a7e6b21b9ad64b8fdfb9e95e21264c471c951`
SHA256	`305ec9e51f69fe3bea12fc210601eb8b55efd32243957f60e1b189e2cb712f3e`
CRC32	`53099F44`
ssdeep	`None`
Yara	None matched
VirusTotal	Search for analysis

Sorry! No dropped buffers.