SmartHawk

10.4

0-day

46 个模型检测该样本为恶意！

重新分析

下载样本

2974c94fe4c11eafe2c8ee47f3d02f827552ea4411ec3aa4d3f726d2407d3ade

4c84f12f1981c259b73f63fc0a366340.exe

分析耗时

142s

最近分析

文件大小

136.1KB

静态报毒动态报毒 100% AGEN AI SCORE=84 ATTRIBUTE CONFIDENCE DOWNLOADER34 ELDORADO EMOTET EPAZ GENCIRC GENERICKD GENETIC GENKRYPTIK HIGH CONFIDENCE HIGHCONFIDENCE HNFTPAKBWQC HPHUZO IY1@AAZ7UNHK MALWARE@#1B7TN7I5JKJN6 R + TROJ R346379 SCORE SGENERIC UNSAFE ZEXTET 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
Avast		20201211	21.1.5827.0
Alibaba	Trojan:Win32/Emotet.f800ca5f	20190527	0.3.0.5
Tencent	Malware.Win32.Gencirc.10cde566	20201211	1.0.0.1
Baidu		20190318	1.0.0.2
Kingsoft		20201211	2017.9.26.565
McAfee		20201211	6.0.6.653
CrowdStrike	win/malicious_confidence_100% (W)	20190702	1.0

Queries for the computername (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619519774.581625 GetComputerNameA	computer_name: OSKAR-PC	success	1	0

Uses Windows APIs to generate a cryptographic key (4 个事件)

Time & API	Arguments	Status	Return
1619519759.909625 CryptGenKey	crypto_handle: 0x00506980 algorithm_identifier: 0x0000660e () provider_handle: 0x00505ed8 flags: 1 key: fòÇ-8E:ÿIïðûä3	success	1
1619519774.581625 CryptExportKey	crypto_handle: 0x00506980 crypto_export_handle: 0x00505e98 buffer: f¤³µÄj+¸è:f_àk4-ÜÑöJcFü©ÂGqOþí7VvÂ»Y©{ë5Ó$vBMí²ij7M¾ôíü[§íæÀúëîÑòN·Ô2.Ýñ£ÊàR blob_type: 1 flags: 64	success	1
1619519802.238625 CryptExportKey	crypto_handle: 0x00506980 crypto_export_handle: 0x00505e98 buffer: f¤ðÃÈUªuZÉ´°òãwà2½®Ýð)\|Ê,YæÐgY´ =ñ¸$CS1i L_këTûâ¹Æzç ùûeËá÷V°¯S¸åNi²OÙm H^ blob_type: 1 flags: 64	success	1
1619519827.159625 CryptExportKey	crypto_handle: 0x00506980 crypto_export_handle: 0x00505e98 buffer: f¤si 4EúÖkåÉÈ{öÄì#VË>ÒÇµïCy2ÜÃ)*¯ºùåîmfÚðPð>ªý»!èv½>©$Òµ%MåZ©EÏõ&Ê¯¦ÞwXÃ blob_type: 1 flags: 64	success	1

The executable uses a known packer (1 个事件)

packer

Armadillo v1.71

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 个事件)

suspicious_features

POST method with no referer header

suspicious_request

POST https://update.googleapis.com/service/update2?cup2key=10:1879254174&cup2hreq=1b88f36c31e5e8ec1963886aad0f063a0ddd2a4bce2dc4522dcee73febf44961

Performs some HTTP requests (1 个事件)

request

POST https://update.googleapis.com/service/update2?cup2key=10:1879254174&cup2hreq=1b88f36c31e5e8ec1963886aad0f063a0ddd2a4bce2dc4522dcee73febf44961

Sends data using the HTTP POST Method (1 个事件)

request

POST https://update.googleapis.com/service/update2?cup2key=10:1879254174&cup2hreq=1b88f36c31e5e8ec1963886aad0f063a0ddd2a4bce2dc4522dcee73febf44961

Allocates read-write-execute memory (usually to unpack itself) (3 个事件)

Time & API	Arguments	Status
1619519756.394625 NtAllocateVirtualMemory	process_identifier: 2576 region_size: 36864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12289 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x01d70000	success
1619519785.80075 NtAllocateVirtualMemory	process_identifier: 1424 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0000000004110000	success
1619519759.597625 NtAllocateVirtualMemory	process_identifier: 2316 region_size: 36864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12289 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x01d70000	success

Checks whether any human activity is being performed by constantly checking whether the foreground window changed

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619519802.238625 Process32NextW	process_name: GoogleUpdate.exe snapshot_handle: 0x0000039c process_identifier: 2240	success	1	0
1619519827.159625 Process32NextW	process_name: WmiPrvSE.exe snapshot_handle: 0x000001a4 process_identifier: 2364	success	1	0

Moves the original executable to a new location (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619519756.972625 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\4c84f12f1981c259b73f63fc0a366340.exe newfilepath: C:\Windows\SysWOW64\KBDDV\DevicePairing.exe newfilepath_r: C:\Windows\SysWOW64\KBDDV\DevicePairing.exe flags: 3 oldfilepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\4c84f12f1981c259b73f63fc0a366340.exe	success	1	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619519775.238625 GetAdaptersAddresses	flags: 0 family: 0	failed	111	0

Expresses interest in specific running processes (1 个事件)

process

devicepairing.exe

Reads the systems User Agent and subsequently performs requests (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619519774.847625 InternetOpenW	proxy_bypass: access_type: 0 proxy_name: flags: 0 user_agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)	success	13369348	0

Communicates with host for which no DNS query was performed (6 个事件)

host	172.217.24.14
host	189.212.199.126
host	212.51.142.238
host	76.27.179.47
host	203.208.41.97
host	203.208.41.98

Installs itself for autorun at Windows startup (1 个事件)

service_name

DevicePairing

service_path

C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\"C:\Windows\SysWOW64\KBDDV\DevicePairing.exe"

Created a service where a service was also not started (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619519758.800625 CreateServiceW	service_start_name: start_type: 2 service_handle: 0x02df06c0 display_name: DevicePairing error_control: 0 service_name: DevicePairing filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\"C:\Windows\SysWOW64\KBDDV\DevicePairing.exe" filepath_r: "C:\Windows\SysWOW64\KBDDV\DevicePairing.exe" service_manager_handle: 0x02dddaa8 desired_access: 2 service_type: 16 password:	success	48170688	0

Sets or modifies WPAD proxy autoconfiguration file for traffic interception (8 个事件)

Time & API	Arguments	Status
1619519777.800625 RegSetValueExA	key_handle: 0x0000039c value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason	success
1619519777.800625 RegSetValueExA	key_handle: 0x0000039c value: ¸ÒÍ:;× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime	success
1619519777.800625 RegSetValueExA	key_handle: 0x0000039c value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision	success
1619519777.800625 RegSetValueExW	key_handle: 0x0000039c value: 网络 2 regkey_r: WpadNetworkName reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName	success
1619519777.800625 RegSetValueExA	key_handle: 0x000003b4 value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason	success
1619519777.800625 RegSetValueExA	key_handle: 0x000003b4 value: ¸ÒÍ:;× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime	success
1619519777.800625 RegSetValueExA	key_handle: 0x000003b4 value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision	success
1619519777.816625 RegSetValueExW	key_handle: 0x00000398 value: {40112ABE-63B3-43C3-BE93-1440EE3AF106} regkey_r: WpadLastNetwork reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadLastNetwork	success

Attempts to remove evidence of file being downloaded from the Internet (1 个事件)

file	C:\Windows\SysWOW64\KBDDV\DevicePairing.exe:Zone.Identifier

File has been identified by 46 AntiVirus engines on VirusTotal as malicious (46 个事件)

Elastic	malicious (high confidence)
DrWeb	Trojan.DownLoader34.10042
MicroWorld-eScan	Trojan.GenericKD.43564958
FireEye	Trojan.GenericKD.43564958
Qihoo-360	Win32/Trojan.653
ALYac	Trojan.GenericKD.43564958
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
AegisLab	Trojan.Multi.Generic.4!c
Sangfor	Malware
K7AntiVirus	Trojan ( 0056fe271 )
BitDefender	Trojan.GenericKD.43564958
K7GW	Trojan ( 0056fe271 )
BitDefenderTheta	Gen:NN.Zextet.34670.iy1@aaz7UNhk
Cyren	W32/Emotet.AOC.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
ClamAV	Win.Packed.Emotet-9528739-0
Kaspersky	HEUR:Trojan-Banker.Win32.Emotet.pef
Alibaba	Trojan:Win32/Emotet.f800ca5f
NANO-Antivirus	Trojan.Win32.Emotet.hphuzo
Tencent	Malware.Win32.Gencirc.10cde566
Ad-Aware	Trojan.GenericKD.43564958
TACHYON	Backdoor/W32.Emotet.139377
Sophos	Mal/Generic-R + Troj/Emotet-CKK
Comodo	Malware@#1b7tn7i5jkjn6
Zillya	Backdoor.Emotet.Win32.647
Emsisoft	Trojan.Emotet (A)
Jiangmin	Backdoor.Emotet.ow
Avira	HEUR/AGEN.1136732
Antiy-AVL	Trojan/Win32.SGeneric
Gridinsoft	Trojan.Win32.Emotet.oa
Arcabit	Trojan.Generic.D298BF9E
ZoneAlarm	HEUR:Trojan-Banker.Win32.Emotet.pef
GData	Trojan.GenericKD.43564958
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.Emotet.R346379
MAX	malware (ai score=84)
VBA32	Trojan.Downloader
Malwarebytes	Trojan.MalPack.TRE
Panda	Trj/Genetic.gen
Yandex	Trojan.GenKryptik!HNftpAKbWqc
Ikarus	Trojan-Banker.Emotet
Fortinet	W32/GenKryptik.EPAZ!tr
Paloalto	generic.ml
CrowdStrike	win/malicious_confidence_100% (W)

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (4 个事件)

dead_host	172.217.24.14:443
dead_host	76.27.179.47:80
dead_host	212.51.142.238:8080
dead_host	172.217.160.78:443

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-07-29 19:47:14

Imports

Library SHLWAPI.dll:

• 0x412a60 StrRetToStrA

Library MFC42.DLL:

• 0x41263c

• 0x412640

• 0x412644

• 0x412648

• 0x41264c

• 0x412650

• 0x412654

• 0x412658

• 0x41265c

• 0x412660

• 0x412664

• 0x412668

• 0x41266c

• 0x412670

• 0x412674

• 0x412678

• 0x41267c

• 0x412680

• 0x412684

• 0x412688

• 0x41268c

• 0x412690

• 0x412694

• 0x412698

• 0x41269c

• 0x4126a0

• 0x4126a4

• 0x4126a8

• 0x4126ac

• 0x4126b0

• 0x4126b4

• 0x4126b8

• 0x4126bc

• 0x4126c0

• 0x4126c4

• 0x4126c8

• 0x4126cc

• 0x4126d0

• 0x4126d4

• 0x4126d8

• 0x4126dc

• 0x4126e0

• 0x4126e4

• 0x4126e8

• 0x4126ec

• 0x4126f0

• 0x4126f4

• 0x4126f8

• 0x4126fc

• 0x412700

• 0x412704

• 0x412708

• 0x41270c

• 0x412710

• 0x412714

• 0x412718

• 0x41271c

• 0x412720

• 0x412724

• 0x412728

• 0x41272c

• 0x412730

• 0x412734

• 0x412738

• 0x41273c

• 0x412740

• 0x412744

• 0x412748

• 0x41274c

• 0x412750

• 0x412754

• 0x412758

• 0x41275c

• 0x412760

• 0x412764

• 0x412768

• 0x41276c

• 0x412770

• 0x412774

• 0x412778

• 0x41277c

• 0x412780

• 0x412784

• 0x412788

• 0x41278c

• 0x412790

• 0x412794

• 0x412798

• 0x41279c

• 0x4127a0

• 0x4127a4

• 0x4127a8

• 0x4127ac

• 0x4127b0

• 0x4127b4

• 0x4127b8

• 0x4127bc

• 0x4127c0

• 0x4127c4

• 0x4127c8

• 0x4127cc

• 0x4127d0

• 0x4127d4

• 0x4127d8

• 0x4127dc

• 0x4127e0

• 0x4127e4

• 0x4127e8

• 0x4127ec

• 0x4127f0

• 0x4127f4

• 0x4127f8

• 0x4127fc

• 0x412800

• 0x412804

• 0x412808

• 0x41280c

• 0x412810

• 0x412814

• 0x412818

• 0x41281c

• 0x412820

• 0x412824

• 0x412828

• 0x41282c

• 0x412830

• 0x412834

• 0x412838

• 0x41283c

• 0x412840

• 0x412844

• 0x412848

• 0x41284c

• 0x412850

• 0x412854

• 0x412858

• 0x41285c

• 0x412860

• 0x412864

• 0x412868

• 0x41286c

• 0x412870

• 0x412874

• 0x412878

• 0x41287c

Library MSVCRT.dll:

• 0x41298c ?terminate@@YAXXZ

• 0x412990 _except_handler3

• 0x412994 wcslen

• 0x412998 atoi

• 0x41299c __dllonexit

• 0x4129a0 _mbsicoll

• 0x4129a4 _mbscmp

• 0x4129a8 __CxxFrameHandler

• 0x4129ac _onexit

• 0x4129b0 _setmbcp

• 0x4129b4 _controlfp

• 0x4129b8 __set_app_type

• 0x4129bc __p__fmode

• 0x4129c0 __p__commode

• 0x4129c4 _adjust_fdiv

• 0x4129c8 __setusermatherr

• 0x4129cc _initterm

• 0x4129d0 __getmainargs

• 0x4129d4 _acmdln

• 0x4129d8 exit

• 0x4129dc _XcptFilter

• 0x4129e0 _exit

• 0x4129e4 qsort

Library KERNEL32.dll:

• 0x4125e8 GetTickCount

• 0x4125ec GetCurrentProcess

• 0x4125f0 SizeofResource

• 0x4125f4 GetProcAddress

• 0x4125f8 LoadLibraryExA

• 0x4125fc LoadLibraryExW

• 0x412600 GetModuleHandleA

• 0x412604 GetStartupInfoA

• 0x412608 GetFileAttributesA

Library USER32.dll:

• 0x412a90 DrawIcon

• 0x412a94 SendMessageA

• 0x412a98 IsIconic

• 0x412a9c GetSystemMetrics

• 0x412aa0 GetClientRect

• 0x412aa4 AppendMenuA

• 0x412aa8 GetSystemMenu

• 0x412aac LoadIconA

• 0x412ab0 EnableWindow

• 0x412ab4 GetParent

Library SHELL32.dll:

• 0x412a24 SHGetFileInfoA

• 0x412a28 SHGetMalloc

• 0x412a2c SHGetSpecialFolderLocation

• 0x412a30 SHGetDesktopFolder

Library ole32.dll:

• 0x412aec CoTaskMemFree

Library MSVCP60.dll:

• 0x412920 ??1_Winit@std@@QAE@XZ

• 0x412924 ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ

• 0x412928 ??0Init@ios_base@std@@QAE@XZ

• 0x41292c ??1Init@ios_base@std@@QAE@XZ

• 0x412930 ??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ

• 0x412934 ?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB

• 0x412938 ??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@0@Z

• 0x41293c ?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z

• 0x412940 ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z

• 0x412944 ??0_Winit@std@@QAE@XZ

• 0x412948 ?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z

• 0x41294c ??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z

• 0x412950 ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A

• 0x412954 ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
clients2.google.com	A 172.217.160.78 CNAME clients.l.google.com	172.217.160.78
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
update.googleapis.com	A 203.208.40.66	203.208.40.98
teredo.ipv6.microsoft.com		127.0.0.1

TCP

Source	Source Port	Destination	Destination Port
192.168.56.101	49192	203.208.40.66 update.googleapis.com	443

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	51378	114.114.114.114	53
192.168.56.101	51963	114.114.114.114	53
192.168.56.101	54991	114.114.114.114	53
192.168.56.101	55368	114.114.114.114	53
192.168.56.101	60123	114.114.114.114	53
192.168.56.101	60215	114.114.114.114	53
192.168.56.101	63429	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	49713	224.0.0.252	5355
192.168.56.101	50568	224.0.0.252	5355
192.168.56.101	53210	224.0.0.252	5355
192.168.56.101	53237	224.0.0.252	5355
192.168.56.101	53657	224.0.0.252	5355
192.168.56.101	54260	224.0.0.252	5355
192.168.56.101	56539	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	58367	224.0.0.252	5355
192.168.56.101	58970	224.0.0.252	5355

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.