SmartHawk

6.6

高危

该样本未表现出任何异常！

重新分析

下载样本

bfb489d80a74cd5b1763c8752f97c45b4856dd09ed6b1c2ec502a197ce137c83

44e1525cd15a1a4a1ccb38daa1b85fb7.exe

分析耗时

87s

最近分析

文件大小

32.0KB

静态报毒动态报毒

未检测暂无鹰眼引擎检测结果

未检测暂无反病毒引擎检测结果

Queries for the computername (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619388049.6915 GetComputerNameW	computer_name: OSKAR-PC	success	1	0

Checks if process is being debugged by a debugger (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619384484.124375 IsDebuggerPresent		failed	0	0
1619388032.8315 IsDebuggerPresent		failed	0	0

Command line console output was observed (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619388045.144125 WriteConsoleA	buffer: ÖØÒªÐÅÏ¢: ÒÑ³É¹¦Ö´ÐÐÃüÁî¡£ µ«²»ÔÞ³ÉÊ¹ÓÃ "netsh firewall"£» ¶øÓ¦¸ÃÊ¹ÓÃ "netsh advfirewall firewall"¡£ ÓÐ¹ØÊ¹ÓÃ "netsh advfirewall firewall" ÃüÁî ¶ø·Ç "netsh firewall" µÄÏêÏ¸ÐÅÏ¢£¬Çë²ÎÔÄ http://go.microsoft.com/fwlink/?linkid=121488 ÉÏµÄ KB ÎÄÕÂ 947709¡£ console_handle: 0x00000007	success	1	0
1619388045.144125 WriteConsoleA	buffer: È·¶¨¡£ console_handle: 0x00000007	success	1	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619384493.109375 GlobalMemoryStatusEx		success	1	0

One or more processes crashed (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619388044.3005 __exception__	stacktrace: 0x731b3d mscorlib+0x216e76 @ 0x720f6e76 mscorlib+0x2202ff @ 0x721002ff mscorlib+0x216df4 @ 0x720f6df4 CoUninitializeEE-0x29870 mscorwks+0x1b4c @ 0x73c51b4c CoUninitializeEE-0x125de mscorwks+0x18dde @ 0x73c68dde CoUninitializeEE-0x4990 mscorwks+0x26a2c @ 0x73c76a2c CoUninitializeEE-0x495d mscorwks+0x26a5f @ 0x73c76a5f CoUninitializeEE-0x493f mscorwks+0x26a7d @ 0x73c76a7d DllRegisterServerInternal+0x4cf2b GetPrivateContextsPerfCounters-0xa76e mscorwks+0xa3191 @ 0x73cf3191 CreateAssemblyNameObject+0xb7ec DllRegisterServerInternal-0x4937 mscorwks+0x5192f @ 0x73ca192f CreateAssemblyNameObject+0xb788 DllRegisterServerInternal-0x499b mscorwks+0x518cb @ 0x73ca18cb CreateAssemblyNameObject+0xb6ae DllRegisterServerInternal-0x4a75 mscorwks+0x517f1 @ 0x73ca17f1 CreateAssemblyNameObject+0xb83a DllRegisterServerInternal-0x48e9 mscorwks+0x5197d @ 0x73ca197d DllRegisterServerInternal+0x4ccfc GetPrivateContextsPerfCounters-0xa99d mscorwks+0xa2f62 @ 0x73cf2f62 DllRegisterServerInternal+0x4cdd6 GetPrivateContextsPerfCounters-0xa8c3 mscorwks+0xa303c @ 0x73cf303c GetMetaDataInternalInterface+0xcf27 _CorDllMain-0x9ae mscorwks+0x16805a @ 0x73db805a BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 77787312 registers.edi: 41149672 registers.eax: 41095576 registers.ebp: 77787352 registers.edx: 41149672 registers.ebx: 41156596 registers.esi: 0 registers.ecx: 0 exception.instruction_r: 39 09 e8 06 2b 93 71 8b c8 e8 bf 2f 5b 73 8b f0 exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x731d37	success	0	0

Time & API

Arguments

Status

Return

Repeated

1619388044.3005
__exception__

stacktrace:

0x731b3d
mscorlib+0x216e76 @ 0x720f6e76
mscorlib+0x2202ff @ 0x721002ff
mscorlib+0x216df4 @ 0x720f6df4
CoUninitializeEE-0x29870 mscorwks+0x1b4c @ 0x73c51b4c
CoUninitializeEE-0x125de mscorwks+0x18dde @ 0x73c68dde
CoUninitializeEE-0x4990 mscorwks+0x26a2c @ 0x73c76a2c
CoUninitializeEE-0x495d mscorwks+0x26a5f @ 0x73c76a5f
CoUninitializeEE-0x493f mscorwks+0x26a7d @ 0x73c76a7d
DllRegisterServerInternal+0x4cf2b GetPrivateContextsPerfCounters-0xa76e mscorwks+0xa3191 @ 0x73cf3191
CreateAssemblyNameObject+0xb7ec DllRegisterServerInternal-0x4937 mscorwks+0x5192f @ 0x73ca192f
CreateAssemblyNameObject+0xb788 DllRegisterServerInternal-0x499b mscorwks+0x518cb @ 0x73ca18cb
CreateAssemblyNameObject+0xb6ae DllRegisterServerInternal-0x4a75 mscorwks+0x517f1 @ 0x73ca17f1
CreateAssemblyNameObject+0xb83a DllRegisterServerInternal-0x48e9 mscorwks+0x5197d @ 0x73ca197d
DllRegisterServerInternal+0x4ccfc GetPrivateContextsPerfCounters-0xa99d mscorwks+0xa2f62 @ 0x73cf2f62
DllRegisterServerInternal+0x4cdd6 GetPrivateContextsPerfCounters-0xa8c3 mscorwks+0xa303c @ 0x73cf303c
GetMetaDataInternalInterface+0xcf27 _CorDllMain-0x9ae mscorwks+0x16805a @ 0x73db805a
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 77787312
registers.edi: 41149672
registers.eax: 41095576
registers.ebp: 77787352
registers.edx: 41149672
registers.ebx: 41156596
registers.esi: 0
registers.ecx: 0
exception.instruction_r: 39 09 e8 06 2b 93 71 8b c8 e8 bf 2f 5b 73 8b f0
exception.instruction: cmp dword ptr [ecx], ecx
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x731d37

success

Connects to a Dynamic DNS Domain (1 个事件)

domain

yj233.in.3322.org

Allocates read-write-execute memory (usually to unpack itself) (46 个事件)

Time & API	Arguments	Status
1619384481.749375 NtAllocateVirtualMemory	process_identifier: 3000 region_size: 2097152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00890000	success
1619384481.749375 NtAllocateVirtualMemory	process_identifier: 3000 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00a50000	success
1619384483.718375 NtProtectVirtualMemory	process_identifier: 3000 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73c51000	success
1619384484.124375 NtAllocateVirtualMemory	process_identifier: 3000 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0055a000	success
1619384484.124375 NtProtectVirtualMemory	process_identifier: 3000 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73c52000	success
1619384484.124375 NtAllocateVirtualMemory	process_identifier: 3000 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00552000	success
1619384484.453375 NtAllocateVirtualMemory	process_identifier: 3000 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00562000	success
1619384484.531375 NtAllocateVirtualMemory	process_identifier: 3000 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00563000	success
1619384484.546375 NtAllocateVirtualMemory	process_identifier: 3000 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0059b000	success
1619384484.546375 NtAllocateVirtualMemory	process_identifier: 3000 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00597000	success
1619384484.578375 NtAllocateVirtualMemory	process_identifier: 3000 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0056c000	success
1619384484.640375 NtAllocateVirtualMemory	process_identifier: 3000 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00840000	success
1619384484.906375 NtAllocateVirtualMemory	process_identifier: 3000 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00564000	success
1619384485.249375 NtAllocateVirtualMemory	process_identifier: 3000 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00565000	success
1619384485.312375 NtAllocateVirtualMemory	process_identifier: 3000 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0058a000	success
1619384485.406375 NtAllocateVirtualMemory	process_identifier: 3000 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00582000	success
1619384491.734375 NtAllocateVirtualMemory	process_identifier: 3000 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00841000	success
1619384492.890375 NtAllocateVirtualMemory	process_identifier: 3000 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0056a000	success
1619384493.453375 NtAllocateVirtualMemory	process_identifier: 3000 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0055b000	success
1619388032.8005 NtAllocateVirtualMemory	process_identifier: 1688 region_size: 1179648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x006d0000	success
1619388032.8005 NtAllocateVirtualMemory	process_identifier: 1688 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x007b0000	success
1619388032.8315 NtProtectVirtualMemory	process_identifier: 1688 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73c51000	success
1619388032.8315 NtAllocateVirtualMemory	process_identifier: 1688 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0053a000	success
1619388032.8315 NtProtectVirtualMemory	process_identifier: 1688 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73c52000	success
1619388032.8315 NtAllocateVirtualMemory	process_identifier: 1688 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00532000	success
1619388032.8475 NtAllocateVirtualMemory	process_identifier: 1688 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00542000	success
1619388032.8475 NtAllocateVirtualMemory	process_identifier: 1688 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00543000	success
1619388032.8475 NtAllocateVirtualMemory	process_identifier: 1688 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0057b000	success
1619388032.8475 NtAllocateVirtualMemory	process_identifier: 1688 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00577000	success
1619388032.8475 NtAllocateVirtualMemory	process_identifier: 1688 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0054c000	success
1619388032.8475 NtAllocateVirtualMemory	process_identifier: 1688 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00730000	success
1619388032.8635 NtAllocateVirtualMemory	process_identifier: 1688 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00544000	success
1619388032.8635 NtAllocateVirtualMemory	process_identifier: 1688 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00545000	success
1619388032.8635 NtAllocateVirtualMemory	process_identifier: 1688 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0056a000	success
1619388032.8785 NtAllocateVirtualMemory	process_identifier: 1688 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00562000	success
1619388037.8785 NtAllocateVirtualMemory	process_identifier: 1688 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00731000	success
1619388038.9885 NtAllocateVirtualMemory	process_identifier: 1688 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0054a000	success
1619388044.2535 NtAllocateVirtualMemory	process_identifier: 1688 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0053b000	success
1619388044.2535 NtAllocateVirtualMemory	process_identifier: 1688 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0055a000	success
1619388044.2535 NtAllocateVirtualMemory	process_identifier: 1688 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00557000	success
1619388044.5665 NtAllocateVirtualMemory	process_identifier: 1688 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00556000	success
1619388045.2065 NtAllocateVirtualMemory	process_identifier: 1688 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00732000	success
1619388045.2065 NtAllocateVirtualMemory	process_identifier: 1688 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x047c0000	success
1619388049.6915 NtAllocateVirtualMemory	process_identifier: 1688 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x047c1000	success
1619388049.8165 NtAllocateVirtualMemory	process_identifier: 1688 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00533000	success
1619388071.9565 NtAllocateVirtualMemory	process_identifier: 1688 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x047c2000	success

Creates executable files on the filesystem (1 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\System32.exe

Drops a binary and executes it (1 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\System32.exe

Drops an executable to the user AppData folder (1 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\System32.exe

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619388044.5665 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1	0

Uses Windows utilities for basic Windows functionality (1 个事件)

cmdline

netsh firewall add allowedprogram "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\System32.exe" "System32.exe" ENABLE

Communicates with host for which no DNS query was performed (3 个事件)

host	113.108.239.196
host	203.208.41.34
host	203.208.41.65

Installs itself for autorun at Windows startup (50 out of 80 个事件)

reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\9771b3df97513d91038392839737bd1d	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\System32.exe" ..
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\9771b3df97513d91038392839737bd1d	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\System32.exe" ..
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\9771b3df97513d91038392839737bd1d	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\System32.exe" ..
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\9771b3df97513d91038392839737bd1d	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\System32.exe" ..
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\9771b3df97513d91038392839737bd1d	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\System32.exe" ..
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\9771b3df97513d91038392839737bd1d	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\System32.exe" ..
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\9771b3df97513d91038392839737bd1d	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\System32.exe" ..
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\9771b3df97513d91038392839737bd1d	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\System32.exe" ..
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\9771b3df97513d91038392839737bd1d	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\System32.exe" ..
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\9771b3df97513d91038392839737bd1d	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\System32.exe" ..
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\9771b3df97513d91038392839737bd1d	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\System32.exe" ..
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\9771b3df97513d91038392839737bd1d	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\System32.exe" ..
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\9771b3df97513d91038392839737bd1d	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\System32.exe" ..
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\9771b3df97513d91038392839737bd1d	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\System32.exe" ..
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\9771b3df97513d91038392839737bd1d	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\System32.exe" ..
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\9771b3df97513d91038392839737bd1d	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\System32.exe" ..
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\9771b3df97513d91038392839737bd1d	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\System32.exe" ..
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\9771b3df97513d91038392839737bd1d	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\System32.exe" ..
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\9771b3df97513d91038392839737bd1d	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\System32.exe" ..
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\9771b3df97513d91038392839737bd1d	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\System32.exe" ..
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\9771b3df97513d91038392839737bd1d	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\System32.exe" ..
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\9771b3df97513d91038392839737bd1d	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\System32.exe" ..
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\9771b3df97513d91038392839737bd1d	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\System32.exe" ..
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\9771b3df97513d91038392839737bd1d	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\System32.exe" ..
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\9771b3df97513d91038392839737bd1d	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\System32.exe" ..
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\9771b3df97513d91038392839737bd1d	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\System32.exe" ..
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\9771b3df97513d91038392839737bd1d	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\System32.exe" ..
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\9771b3df97513d91038392839737bd1d	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\System32.exe" ..
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\9771b3df97513d91038392839737bd1d	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\System32.exe" ..
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\9771b3df97513d91038392839737bd1d	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\System32.exe" ..
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\9771b3df97513d91038392839737bd1d	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\System32.exe" ..
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\9771b3df97513d91038392839737bd1d	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\System32.exe" ..
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\9771b3df97513d91038392839737bd1d	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\System32.exe" ..
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\9771b3df97513d91038392839737bd1d	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\System32.exe" ..
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\9771b3df97513d91038392839737bd1d	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\System32.exe" ..
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\9771b3df97513d91038392839737bd1d	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\System32.exe" ..
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\9771b3df97513d91038392839737bd1d	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\System32.exe" ..
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\9771b3df97513d91038392839737bd1d	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\System32.exe" ..
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\9771b3df97513d91038392839737bd1d	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\System32.exe" ..
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\9771b3df97513d91038392839737bd1d	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\System32.exe" ..
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\9771b3df97513d91038392839737bd1d	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\System32.exe" ..
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\9771b3df97513d91038392839737bd1d	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\System32.exe" ..
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\9771b3df97513d91038392839737bd1d	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\System32.exe" ..
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\9771b3df97513d91038392839737bd1d	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\System32.exe" ..
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\9771b3df97513d91038392839737bd1d	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\System32.exe" ..
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\9771b3df97513d91038392839737bd1d	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\System32.exe" ..
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\9771b3df97513d91038392839737bd1d	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\System32.exe" ..
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\9771b3df97513d91038392839737bd1d	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\System32.exe" ..
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\9771b3df97513d91038392839737bd1d	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\System32.exe" ..
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\9771b3df97513d91038392839737bd1d	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\System32.exe" ..

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (13 个事件)

dead_host	192.168.56.101:49194
dead_host	192.168.56.101:49191
dead_host	192.168.56.101:49193
dead_host	192.168.56.101:49190
dead_host	192.168.56.101:49192
dead_host	192.168.56.101:49189
dead_host	192.168.56.101:49197
dead_host	172.217.24.14:443
dead_host	118.184.176.34:37762
dead_host	192.168.56.101:49187
dead_host	192.168.56.101:49186
dead_host	192.168.56.101:49183
dead_host	192.168.56.101:49185

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-03-17 13:01:37

Imports

Library mscoree.dll:

• 0x402000 _CorExeMain

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
yj233.in.3322.org	A 118.184.176.34 CNAME v22.3322.net	118.184.176.34
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
clients2.google.com	A 172.217.24.14 CNAME clients.l.google.com	172.217.24.14
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	50568	114.114.114.114	53
192.168.56.101	51808	114.114.114.114	53
192.168.56.101	51963	114.114.114.114	53
192.168.56.101	55368	114.114.114.114	53
192.168.56.101	60384	114.114.114.114	53
192.168.56.101	63429	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	49713	224.0.0.252	5355
192.168.56.101	51378	224.0.0.252	5355
192.168.56.101	53237	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	58367	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	62318	224.0.0.252	5355
192.168.56.101	62912	224.0.0.252	5355
192.168.56.101	65004	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.