SmartHawk

16.0

0-day

该样本未表现出任何异常！

重新分析

下载样本

de057b593516b8235125f2513f090ffc60359e6707207492f7bd56bc67d35cd8

448186a0f046cc5c3560a4c33c826d8b.exe

分析耗时

100s

最近分析

文件大小

582.5KB

静态报毒动态报毒

未检测暂无鹰眼引擎检测结果

未检测暂无反病毒引擎检测结果

Queries for the computername (8 个事件)

Time & API	Arguments	Status	Return
1619397837.906751 GetComputerNameW	computer_name: OSKAR-PC	success	1
1619397858.610876 GetComputerNameW	computer_name: OSKAR-PC	success	1
1619397864.688876 GetComputerNameW	computer_name: OSKAR-PC	success	1
1619397869.438876 GetComputerNameW	computer_name: OSKAR-PC	success	1
1619397874.141876 GetComputerNameW	computer_name: OSKAR-PC	success	1
1619397879.031876 GetComputerNameW	computer_name: OSKAR-PC	success	1
1619397883.688876 GetComputerNameW	computer_name: OSKAR-PC	success	1
1619397892.500876 GetComputerNameW	computer_name: OSKAR-PC	success	1

Checks if process is being debugged by a debugger (36 个事件)

Time & API	Arguments	Status	Return	Repeated
1619397826.391249 IsDebuggerPresent		failed	0	0
1619397826.391249 IsDebuggerPresent		failed	0	0
1619397836.563249 IsDebuggerPresent		failed	0	0
1619397837.031249 IsDebuggerPresent		failed	0	0
1619397837.578249 IsDebuggerPresent		failed	0	0
1619397838.031249 IsDebuggerPresent		failed	0	0
1619397838.578249 IsDebuggerPresent		failed	0	0
1619397839.031249 IsDebuggerPresent		failed	0	0
1619397839.578249 IsDebuggerPresent		failed	0	0
1619397840.031249 IsDebuggerPresent		failed	0	0
1619397840.578249 IsDebuggerPresent		failed	0	0
1619397841.031249 IsDebuggerPresent		failed	0	0
1619397841.578249 IsDebuggerPresent		failed	0	0
1619397842.031249 IsDebuggerPresent		failed	0	0
1619397842.578249 IsDebuggerPresent		failed	0	0
1619397843.031249 IsDebuggerPresent		failed	0	0
1619397843.578249 IsDebuggerPresent		failed	0	0
1619397844.031249 IsDebuggerPresent		failed	0	0
1619397844.578249 IsDebuggerPresent		failed	0	0
1619397845.031249 IsDebuggerPresent		failed	0	0
1619397845.578249 IsDebuggerPresent		failed	0	0
1619397846.031249 IsDebuggerPresent		failed	0	0
1619397846.578249 IsDebuggerPresent		failed	0	0
1619397847.031249 IsDebuggerPresent		failed	0	0
1619397847.578249 IsDebuggerPresent		failed	0	0
1619397848.031249 IsDebuggerPresent		failed	0	0
1619397848.578249 IsDebuggerPresent		failed	0	0
1619397849.031249 IsDebuggerPresent		failed	0	0
1619397849.578249 IsDebuggerPresent		failed	0	0
1619397850.031249 IsDebuggerPresent		failed	0	0
1619397850.578249 IsDebuggerPresent		failed	0	0
1619397851.031249 IsDebuggerPresent		failed	0	0
1619397851.578249 IsDebuggerPresent		failed	0	0
1619397852.031249 IsDebuggerPresent		failed	0	0
1619397852.188876 IsDebuggerPresent		failed	0	0
1619397852.188876 IsDebuggerPresent		failed	0	0

Command line console output was observed (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619397842.891751 WriteConsoleW	buffer: 成功: 成功创建计划任务 "Updates\PAZtwS"。 console_handle: 0x00000007	success	1	0

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 个事件)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619397826.438249 GlobalMemoryStatusEx		success	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 个事件)

suspicious_features

POST method with no referer header

suspicious_request

POST https://update.googleapis.com/service/update2?cup2key=10:94666359&cup2hreq=c9bc54df912c51e4f9749744c256f326482773674c3e556e77b81086c9c3ae9b

Connects to a Dynamic DNS Domain (2 个事件)

domain	kenya6.duckdns.org
domain	kenya7.duckdns.org

Performs some HTTP requests (1 个事件)

request

POST https://update.googleapis.com/service/update2?cup2key=10:94666359&cup2hreq=c9bc54df912c51e4f9749744c256f326482773674c3e556e77b81086c9c3ae9b

Sends data using the HTTP POST Method (1 个事件)

request

POST https://update.googleapis.com/service/update2?cup2key=10:94666359&cup2hreq=c9bc54df912c51e4f9749744c256f326482773674c3e556e77b81086c9c3ae9b

Allocates read-write-execute memory (usually to unpack itself) (50 out of 163 个事件)

Time & API	Arguments	Status	Return
1619397825.688249 NtAllocateVirtualMemory	process_identifier: 2040 region_size: 1114112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x003f0000	success	0
1619397825.688249 NtAllocateVirtualMemory	process_identifier: 2040 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004c0000	success	0
1619397826.266249 NtAllocateVirtualMemory	process_identifier: 2040 region_size: 524288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x003f0000	success	0
1619397826.266249 NtAllocateVirtualMemory	process_identifier: 2040 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00430000	success	0
1619397826.313249 NtProtectVirtualMemory	process_identifier: 2040 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73b91000	success	0
1619397826.391249 NtAllocateVirtualMemory	process_identifier: 2040 region_size: 1638400 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00e20000	success	0
1619397826.391249 NtAllocateVirtualMemory	process_identifier: 2040 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00f70000	success	0
1619397826.391249 NtAllocateVirtualMemory	process_identifier: 2040 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0041a000	success	0
1619397826.391249 NtProtectVirtualMemory	process_identifier: 2040 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73b92000	success	0
1619397826.391249 NtAllocateVirtualMemory	process_identifier: 2040 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00412000	success	0
1619397826.625249 NtAllocateVirtualMemory	process_identifier: 2040 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00422000	success	0
1619397826.719249 NtAllocateVirtualMemory	process_identifier: 2040 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00495000	success	0
1619397826.735249 NtAllocateVirtualMemory	process_identifier: 2040 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0049b000	success	0
1619397826.735249 NtAllocateVirtualMemory	process_identifier: 2040 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00497000	success	0
1619397826.969249 NtAllocateVirtualMemory	process_identifier: 2040 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00423000	success	0
1619397827.000249 NtAllocateVirtualMemory	process_identifier: 2040 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0042c000	success	0
1619397827.031249 NtAllocateVirtualMemory	process_identifier: 2040 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00760000	success	0
1619397827.672249 NtAllocateVirtualMemory	process_identifier: 2040 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00424000	success	0
1619397827.688249 NtAllocateVirtualMemory	process_identifier: 2040 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00426000	success	0
1619397827.860249 NtAllocateVirtualMemory	process_identifier: 2040 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00427000	success	0
1619397828.156249 NtAllocateVirtualMemory	process_identifier: 2040 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0041c000	success	0
1619397828.156249 NtAllocateVirtualMemory	process_identifier: 2040 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00428000	success	0
1619397828.156249 NtAllocateVirtualMemory	process_identifier: 2040 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00429000	success	0
1619397828.188249 NtAllocateVirtualMemory	process_identifier: 2040 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0047a000	success	0
1619397828.188249 NtAllocateVirtualMemory	process_identifier: 2040 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00477000	success	0
1619397831.672249 NtAllocateVirtualMemory	process_identifier: 2040 region_size: 32768 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00761000	success	0
1619397833.110249 NtAllocateVirtualMemory	process_identifier: 2040 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00476000	success	0
1619397833.485249 NtAllocateVirtualMemory	process_identifier: 2040 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0042a000	success	0
1619397833.641249 NtAllocateVirtualMemory	process_identifier: 2040 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00431000	success	0
1619397833.735249 NtAllocateVirtualMemory	process_identifier: 2040 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00413000	success	0
1619397834.375249 NtAllocateVirtualMemory	process_identifier: 2040 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00940000	success	0
1619397834.375249 NtAllocateVirtualMemory	process_identifier: 2040 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00941000	success	0
1619397834.406249 NtAllocateVirtualMemory	process_identifier: 2040 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00769000	success	0
1619397834.610249 NtAllocateVirtualMemory	process_identifier: 2040 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00942000	success	0
1619397834.625249 NtAllocateVirtualMemory	process_identifier: 2040 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0076a000	success	0
1619397834.625249 NtAllocateVirtualMemory	process_identifier: 2040 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00943000	success	0
1619397834.625249 NtAllocateVirtualMemory	process_identifier: 2040 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0076b000	success	0
1619397834.625249 NtAllocateVirtualMemory	process_identifier: 2040 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0076c000	success	0
1619397834.625249 NtAllocateVirtualMemory	process_identifier: 2040 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0076d000	success	0
1619397834.641249 NtAllocateVirtualMemory	process_identifier: 2040 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0076e000	success	0
1619397834.719249 NtAllocateVirtualMemory	process_identifier: 2040 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0076f000	success	0
1619397834.735249 NtAllocateVirtualMemory	process_identifier: 2040 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x006d0000	success	0
1619397834.735249 NtAllocateVirtualMemory	process_identifier: 2040 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x006d1000	success	0
1619397834.844249 NtProtectVirtualMemory	process_identifier: 2040 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x02560178	failed	3221225550
1619397834.844249 NtProtectVirtualMemory	process_identifier: 2040 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x025601a0	failed	3221225550
1619397834.844249 NtProtectVirtualMemory	process_identifier: 2040 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x025601c8	failed	3221225550
1619397834.844249 NtProtectVirtualMemory	process_identifier: 2040 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 11 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x025a928e	failed	3221225550
1619397834.844249 NtProtectVirtualMemory	process_identifier: 2040 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 11 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x025a9282	failed	3221225550
1619397834.844249 NtProtectVirtualMemory	process_identifier: 2040 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 72 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x02560208	failed	3221225550
1619397834.844249 NtProtectVirtualMemory	process_identifier: 2040 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x0259a038	failed	3221225550

Checks whether any human activity is being performed by constantly checking whether the foreground window changed

Creates a suspicious process (2 个事件)

cmdline	schtasks.exe /Create /TN "Updates\PAZtwS" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmpB60C.tmp"
cmdline	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\PAZtwS" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmpB60C.tmp"

A process created a hidden window (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619397837.516249 ShellExecuteExW	parameters: /Create /TN "Updates\PAZtwS" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmpB60C.tmp" filepath: schtasks.exe filepath_r: schtasks.exe show_type: 0	success	1	0

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

7.55677030165311

section

{'size_of_data': '0x00090e00', 'virtual_address': '0x00002000', 'entropy': 7.55677030165311, 'name': '.text', 'virtual_size': '0x00090d14'}

description

A section with a high entropy has been found

entropy

0.9957044673539519

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619397836.391249 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1	0
1619397853.422876 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1	0

Terminates another process (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619397851.860249 NtTerminateProcess	status_code: 0xffffffff process_identifier: 1476 process_handle: 0x000003c0	failed	0	0
1619397851.860249 NtTerminateProcess	status_code: 0xffffffff process_identifier: 1476 process_handle: 0x000003c0	success	0	0

Uses Windows utilities for basic Windows functionality (2 个事件)

cmdline	schtasks.exe /Create /TN "Updates\PAZtwS" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmpB60C.tmp"
cmdline	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\PAZtwS" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmpB60C.tmp"

One or more of the buffers contains an embedded PE file (2 个事件)

buffer	Buffer with sha1: 874b7c3c97cc5b13b9dd172fec5a54bc1f258005
buffer	Buffer with sha1: 874f3caf663265f7dd18fb565d91b7d915031251

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Allocates execute permission to another process indicative of possible code injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619397851.813249 NtAllocateVirtualMemory	process_identifier: 1476 region_size: 229376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x000003b8 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496	0
1619397851.875249 NtAllocateVirtualMemory	process_identifier: 624 region_size: 229376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x000003bc allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	success	0	0

Looks for the Windows Idle Time to determine the uptime (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619397853.781876 NtQuerySystemInformation	information_class: 8 (SystemProcessorPerformanceInformation)	success	0	0

A process attempted to delay the analysis task. (1 个事件)

description

448186a0f046cc5c3560a4c33c826d8b.exe tried to sleep 5456504 seconds, actually delayed analysis time by 5456504 seconds

Deletes executed files from disk (1 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmpB60C.tmp

Manipulates memory of a non-child process indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2040 manipulating memory of non-child process 1476
1619397851.813249 NtAllocateVirtualMemory	process_identifier: 1476 region_size: 229376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x000003b8 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496	0

Potential code injection by writing to the memory of another process (3 个事件)

Time & API	Arguments	Status	Return
1619397851.875249 WriteProcessMemory	process_identifier: 624 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL¡'éTàÈ`ç @ 8çW ] H.textÇ È `.relocÊ@B.rsrc] ^Ì@@ process_handle: 0x000003bc base_address: 0x00400000	success	1
1619397851.875249 WriteProcessMemory	process_identifier: 624 buffer: à7 process_handle: 0x000003bc base_address: 0x00420000	success	1
1619397851.875249 WriteProcessMemory	process_identifier: 624 buffer: @ process_handle: 0x000003bc base_address: 0x7efde008	success	1

Code injection by writing an executable or DLL to the memory of another process (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619397851.875249 WriteProcessMemory	process_identifier: 624 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL¡'éTàÈ`ç @ 8çW ] H.textÇ È `.relocÊ@B.rsrc] ^Ì@@ process_handle: 0x000003bc base_address: 0x00400000	success	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2040 called NtSetContextThread to modify thread in remote process 624
1619397851.875249 NtSetContextThread	thread_handle: 0x000003c0 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4319122 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 624	success	0	0

Attempts to remove evidence of file being downloaded from the Internet (1 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\448186a0f046cc5c3560a4c33c826d8b.exe:Zone.Identifier

Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2040 resumed a thread in remote process 624
1619397851.969249 NtResumeThread	thread_handle: 0x000003c0 suspend_count: 1 process_identifier: 624	success	0	0

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-04-10 06:46:50

Imports

Library mscoree.dll:

• 0x402000 _CorExeMain

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
kenya7.duckdns.org	A 192.169.69.25	192.169.69.25
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
kenya6.duckdns.org	A 192.169.69.25	192.169.69.25
clients2.google.com	CNAME clients.l.google.com A 216.58.200.238 A 172.217.160.110	172.217.160.78
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
update.googleapis.com	A 203.208.41.98	203.208.50.34
teredo.ipv6.microsoft.com		127.0.0.1

TCP

Source	Source Port	Destination	Destination Port
192.168.56.101	49187	192.169.69.25 kenya6.duckdns.org	2404
192.168.56.101	49190	192.169.69.25 kenya6.duckdns.org	2404
192.168.56.101	49191	192.169.69.25 kenya6.duckdns.org	2404
192.168.56.101	49192	192.169.69.25 kenya6.duckdns.org	2404
192.168.56.101	49194	192.169.69.25 kenya6.duckdns.org	2404
192.168.56.101	49197	192.169.69.25 kenya6.duckdns.org	2404
192.168.56.101	49202	192.169.69.25 kenya6.duckdns.org	2404
192.168.56.101	49203	203.208.41.98 update.googleapis.com	443

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	51808	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	60088	114.114.114.114	53
192.168.56.101	60123	114.114.114.114	53
192.168.56.101	60911	114.114.114.114	53
192.168.56.101	63429	114.114.114.114	53
192.168.56.101	65004	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	49713	224.0.0.252	5355
192.168.56.101	50568	224.0.0.252	5355
192.168.56.101	51378	224.0.0.252	5355
192.168.56.101	53237	224.0.0.252	5355
192.168.56.101	53500	224.0.0.252	5355
192.168.56.101	55368	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	58367	224.0.0.252	5355
192.168.56.101	58970	224.0.0.252	5355

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.