SmartHawk

14.4

0-day

57 个模型检测该样本为恶意！

重新分析

下载样本

0353a90102276045a708f151d0d4c6e1e3008e0de89b33ffc1329d0034932e28

542bbbd3e1fb1d367a0e1d860528aa37.exe

分析耗时

25s

最近分析

文件大小

392.0KB

静态报毒动态报毒 100% 66C98U5XYII AI SCORE=83 AIDETECTVM ATRAPS BDJL BLOCKER BSCOPE CONFIDENCE ELDORADO GENASA GENCIRC GENERICRXJA GENETIC GGBJBZ HIGH CONFIDENCE INVADER MALICIOUS PE MALWARE1 NCA@8M98I8 QVM20 R + TROJ RLW8FKXCJGM SCORE SHIFU SHIZ SIGGEN9 STATIC AI SUSGEN UNSAFE YQZ@XOAYA0C 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
Alibaba	TrojanSpy:Win32/Invader.6b4c75c2	20190527	0.3.0.5
Baidu		20190318	1.0.0.2
Avast	Win32:Shifu-B [Trj]	20201210	21.1.5827.0
Kingsoft		20201211	2017.9.26.565
McAfee	GenericRXJA-YC!542BBBD3E1FB	20201211	6.0.6.653
Tencent	Malware.Win32.Gencirc.10b0780b	20201211	1.0.0.1
CrowdStrike	win/malicious_confidence_100% (W)	20190702	1.0

Queries for the computername (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619448556.025751 GetComputerNameA	computer_name: OSKAR-PC	success	1	0

Command line console output was observed (9 个事件)

Time & API	Arguments	Status	Return
1619448555.308249 WriteConsoleW	buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp> console_handle: 0x00000007	success	1
1619448555.308249 WriteConsoleW	buffer: echo console_handle: 0x00000007	success	1
1619448555.308249 WriteConsoleW	buffer: hlvdjdmidpqqblsp console_handle: 0x00000007	success	1
1619448555.323249 WriteConsoleW	buffer: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\542bbbd3e1fb1d367a0e1d860528aa37.exe" console_handle: 0x00000007	success	1
1619448555.370249 WriteConsoleW	buffer: 另一个程序正在使用此文件，进程无法访问。 console_handle: 0x0000000b	success	1
1619448555.370249 WriteConsoleW	buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp> console_handle: 0x00000007	success	1
1619448555.370249 WriteConsoleW	buffer: del console_handle: 0x00000007	success	1
1619448555.370249 WriteConsoleW	buffer: "C:\Users\Administrator.Oskar-PC\AppData\Local\sokE04.tmp.bat" console_handle: 0x00000007	success	1
1619448555.433249 WriteConsoleW	buffer: 找不到批处理文件。 console_handle: 0x0000000b	success	1

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 个事件)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\InstallDate

This executable has a PDB path (1 个事件)

pdb_path

Z:\coding\project\main\result\result.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619426985.08511 GlobalMemoryStatusEx		success	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (50 out of 2271 个事件)

Time & API	Arguments	Status
1619426986.02211 NtProtectVirtualMemory	process_identifier: 2316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00372000	success
1619426986.02211 NtProtectVirtualMemory	process_identifier: 2316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00372000	success
1619426986.02211 NtProtectVirtualMemory	process_identifier: 2316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00372000	success
1619426986.02211 NtProtectVirtualMemory	process_identifier: 2316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00372000	success
1619426986.02211 NtProtectVirtualMemory	process_identifier: 2316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00372000	success
1619426986.02211 NtProtectVirtualMemory	process_identifier: 2316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00372000	success
1619426986.02211 NtProtectVirtualMemory	process_identifier: 2316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00372000	success
1619426986.02211 NtProtectVirtualMemory	process_identifier: 2316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00372000	success
1619426986.02211 NtProtectVirtualMemory	process_identifier: 2316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00372000	success
1619426986.02211 NtProtectVirtualMemory	process_identifier: 2316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00372000	success
1619426986.02211 NtProtectVirtualMemory	process_identifier: 2316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00372000	success
1619426986.02211 NtProtectVirtualMemory	process_identifier: 2316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00372000	success
1619426986.02211 NtProtectVirtualMemory	process_identifier: 2316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00372000	success
1619426986.02211 NtProtectVirtualMemory	process_identifier: 2316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00372000	success
1619426986.02211 NtProtectVirtualMemory	process_identifier: 2316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00372000	success
1619426986.02211 NtProtectVirtualMemory	process_identifier: 2316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00372000	success
1619426986.02211 NtProtectVirtualMemory	process_identifier: 2316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00372000	success
1619426986.02211 NtProtectVirtualMemory	process_identifier: 2316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x003ae000	success
1619426986.02211 NtProtectVirtualMemory	process_identifier: 2316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x003ae000	success
1619426986.02211 NtProtectVirtualMemory	process_identifier: 2316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x003ae000	success
1619426986.02211 NtProtectVirtualMemory	process_identifier: 2316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x003ae000	success
1619426986.02211 NtProtectVirtualMemory	process_identifier: 2316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x003ae000	success
1619426986.02211 NtProtectVirtualMemory	process_identifier: 2316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x003ae000	success
1619426986.02211 NtProtectVirtualMemory	process_identifier: 2316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x003ae000	success
1619426986.02211 NtProtectVirtualMemory	process_identifier: 2316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x003ae000	success
1619426986.02211 NtProtectVirtualMemory	process_identifier: 2316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x003ae000	success
1619426986.02211 NtProtectVirtualMemory	process_identifier: 2316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x003ae000	success
1619426986.03811 NtProtectVirtualMemory	process_identifier: 2316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x003ae000	success
1619426986.03811 NtProtectVirtualMemory	process_identifier: 2316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x003ae000	success
1619426986.03811 NtProtectVirtualMemory	process_identifier: 2316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x003ae000	success
1619426986.03811 NtProtectVirtualMemory	process_identifier: 2316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x003ae000	success
1619426986.03811 NtProtectVirtualMemory	process_identifier: 2316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x003ae000	success
1619426986.03811 NtProtectVirtualMemory	process_identifier: 2316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x003ae000	success
1619426986.03811 NtProtectVirtualMemory	process_identifier: 2316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x003ae000	success
1619426986.03811 NtProtectVirtualMemory	process_identifier: 2316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x003ae000	success
1619426986.03811 NtProtectVirtualMemory	process_identifier: 2316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x003ae000	success
1619426986.03811 NtProtectVirtualMemory	process_identifier: 2316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x003ae000	success
1619426986.03811 NtProtectVirtualMemory	process_identifier: 2316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x003ae000	success
1619426986.03811 NtProtectVirtualMemory	process_identifier: 2316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x003ae000	success
1619426986.03811 NtProtectVirtualMemory	process_identifier: 2316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x003ae000	success
1619426986.03811 NtProtectVirtualMemory	process_identifier: 2316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x003ae000	success
1619426986.03811 NtProtectVirtualMemory	process_identifier: 2316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x003ae000	success
1619426986.03811 NtProtectVirtualMemory	process_identifier: 2316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x003ae000	success
1619426986.03811 NtProtectVirtualMemory	process_identifier: 2316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x003ae000	success
1619426986.03811 NtProtectVirtualMemory	process_identifier: 2316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x003ae000	success
1619426986.03811 NtProtectVirtualMemory	process_identifier: 2316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x003ae000	success
1619426986.03811 NtProtectVirtualMemory	process_identifier: 2316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x003ae000	success
1619426986.03811 NtProtectVirtualMemory	process_identifier: 2316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x003ae000	success
1619426986.03811 NtProtectVirtualMemory	process_identifier: 2316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x003af000	success
1619426986.03811 NtProtectVirtualMemory	process_identifier: 2316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x003af000	success

Creates executable files on the filesystem (2 个事件)

file	C:\ProgramData\djj808hj8h.exe
file	C:\Users\Administrator.Oskar-PC\AppData\Local\sokE04.tmp.bat

Drops a binary and executes it (1 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Local\sokE04.tmp.bat

A process created a hidden window (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619426986.27211 ShellExecuteExW	parameters: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\542bbbd3e1fb1d367a0e1d860528aa37.exe" filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\sokE04.tmp.bat filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\sokE04.tmp.bat show_type: 0	success	1	0

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619448554.588751 Process32NextW	process_name: snapshot_handle: 0x000001ac process_identifier: 1966308433	failed	0	0

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

7.93472237364679

section

{'size_of_data': '0x00025200', 'virtual_address': '0x00006000', 'entropy': 7.93472237364679, 'name': '.data', 'virtual_size': '0x000256d4'}

description

A section with a high entropy has been found

entropy

0.9054878048780488

description

Overall entropy of this PE file is high

Created a process named as a common system process (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619426983.21011 CreateProcessInternalW	thread_identifier: 2764 thread_handle: 0x000000a8 process_identifier: 2620 current_directory: filepath: C:\Windows\System32\svchost.exe track: 1 command_line: C:\ProgramData\djj808hj8h.exe filepath_r: C:\Windows\system32\svchost.exe stack_pivoted: 0 creation_flags: 12 (CREATE_SUSPENDED\|DETACHED_PROCESS) process_handle: 0x000000b4 inherit_handles: 0	success	1	0

Uses Windows utilities for basic Windows functionality (1 个事件)

cmdline

C:\Users\Administrator.Oskar-PC\AppData\Local\sokE04.tmp.bat "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\542bbbd3e1fb1d367a0e1d860528aa37.exe"

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Allocates execute permission to another process indicative of possible code injection (5 个事件)

Time & API	Arguments	Status
1619426983.21011 NtAllocateVirtualMemory	process_identifier: 2620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x000000b4 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x000f0000	success
1619426984.11611 NtProtectVirtualMemory	process_identifier: 2620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 200704 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x000000b4 base_address: 0x00260000	success
1619448554.588751 NtProtectVirtualMemory	process_identifier: 2316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 200704 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x00000264 base_address: 0x02570000	success
1619448554.666751 NtProtectVirtualMemory	process_identifier: 2712 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 200704 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x00000298 base_address: 0x00320000	success
1619448554.947751 NtProtectVirtualMemory	process_identifier: 3000 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 200704 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x00000280 base_address: 0x00300000	success

Installs itself for autorun at Windows startup (1 个事件)

reg_key

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\IntelPowerAgent8

reg_value

rundll32.exe shell32.dll, ShellExec_RunDLL C:\PROGRA~3\DJJ808~1.EXE

Attempts to access Bitcoin/ALTCoin wallets (2 个事件)

file	C:\Users\Administrator.Oskar-PClitecoin\wallet.dat
file	C:\Users\Administrator.Oskar-PCbitcoin\wallet.dat

Disables proxy possibly for traffic interception (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619448555.463751 RegSetValueExA	key_handle: 0x000003a0 value: 0 regkey_r: ProxyEnable reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable	success	0	0

Creates a thread using CreateRemoteThread in a non-child process indicative of process injection (6 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2620 created a remote thread in non-child process 2316
Process injection	Process 2620 created a remote thread in non-child process 2712
Process injection	Process 2620 created a remote thread in non-child process 3000
1619448554.588751 CreateRemoteThread	thread_identifier: 0 process_identifier: 2316 function_address: 0x0257114d flags: 0 process_handle: 0x00000264 parameter: 0x00000000 stack_size: 0	success	668	0
1619448554.947751 CreateRemoteThread	thread_identifier: 0 process_identifier: 2712 function_address: 0x0032114d flags: 0 process_handle: 0x00000298 parameter: 0x00000000 stack_size: 0	failed	0	0
1619448554.963751 CreateRemoteThread	thread_identifier: 0 process_identifier: 3000 function_address: 0x0030114d flags: 0 process_handle: 0x00000280 parameter: 0x00000000 stack_size: 0	success	720	0

Manipulates memory of a non-child process indicative of process injection (9 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2620 manipulating memory of non-child process 2316
Process injection	Process 2620 manipulating memory of non-child process 2712
Process injection	Process 2620 manipulating memory of non-child process 3000
1619448554.510751 NtAllocateVirtualMemory	process_identifier: 2316 region_size: 483328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 (PAGE_READWRITE) process_handle: 0x00000264 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x02570000	success	0	0
1619448554.588751 NtProtectVirtualMemory	process_identifier: 2316 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 200704 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x00000264 base_address: 0x02570000	success	0	0
1619448554.604751 NtAllocateVirtualMemory	process_identifier: 2712 region_size: 483328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 (PAGE_READWRITE) process_handle: 0x00000298 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00320000	success	0	0
1619448554.666751 NtProtectVirtualMemory	process_identifier: 2712 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 200704 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x00000298 base_address: 0x00320000	success	0	0
1619448554.932751 NtAllocateVirtualMemory	process_identifier: 3000 region_size: 483328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 (PAGE_READWRITE) process_handle: 0x00000280 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00300000	success	0	0
1619448554.947751 NtProtectVirtualMemory	process_identifier: 3000 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 200704 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x00000280 base_address: 0x00300000	success	0	0

Potential code injection by writing to the memory of another process (8 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2620 injected into non-child 2316
Process injection	Process 2620 injected into non-child 2712
Process injection	Process 2620 injected into non-child 3000
1619426983.21011 WriteProcessMemory	process_identifier: 2620 buffer: jÿhÿ5vÃ process_handle: 0x000000b4 base_address: 0x000f0000	success	1	0
1619426984.08511 WriteProcessMemory	process_identifier: 2620 buffer: tØÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $º¼_þbÒþbÒþbÒ÷GÿbÒm,JÿbÒAËübÒþbÒýbÒAÿbÒ÷VÿbÒ÷A×bÒþbÓ¸cÒåÿ}¹bÒåÿOÿbÒRichþbÒÕ!L¹LbåUà! äìM@¤'\|ð¤.text¬ÃÄ `codeAà È `.rdataÎABè@@.data$PB*@À.reloc°ðl@B process_handle: 0x000000b4 base_address: 0x00260000	success	1	0
1619448554.510751 WriteProcessMemory	process_identifier: 2316 buffer: tØÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $º¼_þbÒþbÒþbÒ÷GÿbÒm,JÿbÒAËübÒþbÒýbÒAÿbÒ÷VÿbÒ÷A×bÒþbÓ¸cÒåÿ}¹bÒåÿOÿbÒRichþbÒÕ!L¹LbåUà! äìM@¤'\|ð¤.text¬ÃÄ `codeAà È `.rdataÎABè@@.data$PB*@À.reloc°ðl@B process_handle: 0x00000264 base_address: 0x02570000	success	1	0
1619448554.604751 WriteProcessMemory	process_identifier: 2712 buffer: tØÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $º¼_þbÒþbÒþbÒ÷GÿbÒm,JÿbÒAËübÒþbÒýbÒAÿbÒ÷VÿbÒ÷A×bÒþbÓ¸cÒåÿ}¹bÒåÿOÿbÒRichþbÒÕ!L¹LbåUà! äìM@¤'\|ð¤.text¬ÃÄ `codeAà È `.rdataÎABè@@.data$PB*@À.reloc°ðl@B process_handle: 0x00000298 base_address: 0x00320000	success	1	0
1619448554.932751 WriteProcessMemory	process_identifier: 3000 buffer: tØÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $º¼_þbÒþbÒþbÒ÷GÿbÒm,JÿbÒAËübÒþbÒýbÒAÿbÒ÷VÿbÒ÷A×bÒþbÓ¸cÒåÿ}¹bÒåÿOÿbÒRichþbÒÕ!L¹LbåUà! äìM@¤'\|ð¤.text¬ÃÄ `codeAà È `.rdataÎABè@@.data$PB*@À.reloc°ðl@B process_handle: 0x00000280 base_address: 0x00300000	success	1	0

Network activity contains more than one unique useragent (2 个事件)

process	svchost.exe				useragent	Internal
process	svchost.exe				useragent	Mozilla/5.0 (Windows; U; Windows NT 5.2 x64; en-US; rv:1.9a1) Gecko/20061007 Minefield/3.0a1

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2316 called NtSetContextThread to modify thread in remote process 2620
1619426983.21011 NtSetContextThread	thread_handle: 0x000000a8 registers.eip: 2010382788 registers.esp: 2162360 registers.edi: 0 registers.eax: 983040 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 2620	success	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (4 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2316 resumed a thread in remote process 2620
Process injection	Process 2316 resumed a thread in remote process 3000
1619426983.97511 NtResumeThread	thread_handle: 0x000000a8 suspend_count: 1 process_identifier: 2620	success	0	0
1619426986.25611 NtResumeThread	thread_handle: 0x000001dc suspend_count: 1 process_identifier: 3000	success	0	0

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 个事件)

dead_host

121.12.123.242:80

Executed a process and injected code into it, probably while unpacking (40 个事件)

Time & API	Arguments	Status	Return
1619426983.21011 CreateProcessInternalW	thread_identifier: 2764 thread_handle: 0x000000a8 process_identifier: 2620 current_directory: filepath: C:\Windows\System32\svchost.exe track: 1 command_line: C:\ProgramData\djj808hj8h.exe filepath_r: C:\Windows\system32\svchost.exe stack_pivoted: 0 creation_flags: 12 (CREATE_SUSPENDED\|DETACHED_PROCESS) process_handle: 0x000000b4 inherit_handles: 0	success	1
1619426983.21011 NtGetContextThread	thread_handle: 0x000000a8	success	0
1619426983.21011 NtAllocateVirtualMemory	process_identifier: 2620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x000000b4 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x000f0000	success	0
1619426983.21011 WriteProcessMemory	process_identifier: 2620 buffer: jÿhÿ5vÃ process_handle: 0x000000b4 base_address: 0x000f0000	success	1
1619426983.21011 NtSetContextThread	thread_handle: 0x000000a8 registers.eip: 2010382788 registers.esp: 2162360 registers.edi: 0 registers.eax: 983040 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 2620	success	0
1619426983.97511 NtResumeThread	thread_handle: 0x000000a8 suspend_count: 1 process_identifier: 2620	success	0
1619426984.08511 NtAllocateVirtualMemory	process_identifier: 2620 region_size: 483328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 (PAGE_READWRITE) process_handle: 0x000000b4 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00260000	success	0
1619426984.08511 WriteProcessMemory	process_identifier: 2620 buffer: tØÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $º¼_þbÒþbÒþbÒ÷GÿbÒm,JÿbÒAËübÒþbÒýbÒAÿbÒ÷VÿbÒ÷A×bÒþbÓ¸cÒåÿ}¹bÒåÿOÿbÒRichþbÒÕ!L¹LbåUà! äìM@¤'\|ð¤.text¬ÃÄ `codeAà È `.rdataÎABè@@.data$PB*@À.reloc°ðl@B process_handle: 0x000000b4 base_address: 0x00260000	success	1
1619426984.08511 WriteProcessMemory	process_identifier: 2620 buffer: process_handle: 0x000000b4 base_address: 0x00261000	success	1
1619426984.08511 WriteProcessMemory	process_identifier: 2620 buffer: process_handle: 0x000000b4 base_address: 0x0027e000	success	1
1619426984.08511 WriteProcessMemory	process_identifier: 2620 buffer: process_handle: 0x000000b4 base_address: 0x00280000	success	1
1619426984.10011 WriteProcessMemory	process_identifier: 2620 buffer: process_handle: 0x000000b4 base_address: 0x00285000	success	1
1619426984.10011 WriteProcessMemory	process_identifier: 2620 buffer: process_handle: 0x000000b4 base_address: 0x0028f000	success	1
1619426984.10011 WriteProcessMemory	process_identifier: 2620 buffer: process_handle: 0x000000b4 base_address: 0x00291000	success	1
1619426985.31911 CreateProcessInternalW	thread_identifier: 324 thread_handle: 0x000001dc process_identifier: 3000 current_directory: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp filepath: track: 1 command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\sokE04.tmp.bat" "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\542bbbd3e1fb1d367a0e1d860528aa37.exe" filepath_r: stack_pivoted: 0 creation_flags: 67634196 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_SUSPENDED\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) process_handle: 0x000001e4 inherit_handles: 0	success	1
1619426986.25611 NtResumeThread	thread_handle: 0x000001dc suspend_count: 1 process_identifier: 3000	success	0
1619448554.510751 NtAllocateVirtualMemory	process_identifier: 2316 region_size: 483328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 (PAGE_READWRITE) process_handle: 0x00000264 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x02570000	success	0
1619448554.510751 WriteProcessMemory	process_identifier: 2316 buffer: tØÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $º¼_þbÒþbÒþbÒ÷GÿbÒm,JÿbÒAËübÒþbÒýbÒAÿbÒ÷VÿbÒ÷A×bÒþbÓ¸cÒåÿ}¹bÒåÿOÿbÒRichþbÒÕ!L¹LbåUà! äìM@¤'\|ð¤.text¬ÃÄ `codeAà È `.rdataÎABè@@.data$PB*@À.reloc°ðl@B process_handle: 0x00000264 base_address: 0x02570000	success	1
1619448554.525751 WriteProcessMemory	process_identifier: 2316 buffer: process_handle: 0x00000264 base_address: 0x02571000	success	1
1619448554.525751 WriteProcessMemory	process_identifier: 2316 buffer: process_handle: 0x00000264 base_address: 0x0258e000	success	1
1619448554.525751 WriteProcessMemory	process_identifier: 2316 buffer: process_handle: 0x00000264 base_address: 0x02590000	success	1
1619448554.541751 WriteProcessMemory	process_identifier: 2316 buffer: process_handle: 0x00000264 base_address: 0x02595000	success	1
1619448554.557751 WriteProcessMemory	process_identifier: 2316 buffer: process_handle: 0x00000264 base_address: 0x0259f000	success	1
1619448554.557751 WriteProcessMemory	process_identifier: 2316 buffer: process_handle: 0x00000264 base_address: 0x025a1000	success	1
1619448554.604751 NtAllocateVirtualMemory	process_identifier: 2712 region_size: 483328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 (PAGE_READWRITE) process_handle: 0x00000298 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00320000	success	0
1619448554.604751 WriteProcessMemory	process_identifier: 2712 buffer: tØÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $º¼_þbÒþbÒþbÒ÷GÿbÒm,JÿbÒAËübÒþbÒýbÒAÿbÒ÷VÿbÒ÷A×bÒþbÓ¸cÒåÿ}¹bÒåÿOÿbÒRichþbÒÕ!L¹LbåUà! äìM@¤'\|ð¤.text¬ÃÄ `codeAà È `.rdataÎABè@@.data$PB*@À.reloc°ðl@B process_handle: 0x00000298 base_address: 0x00320000	success	1
1619448554.619751 WriteProcessMemory	process_identifier: 2712 buffer: process_handle: 0x00000298 base_address: 0x00321000	success	1
1619448554.635751 WriteProcessMemory	process_identifier: 2712 buffer: process_handle: 0x00000298 base_address: 0x0033e000	success	1
1619448554.635751 WriteProcessMemory	process_identifier: 2712 buffer: process_handle: 0x00000298 base_address: 0x00340000	success	1
1619448554.635751 WriteProcessMemory	process_identifier: 2712 buffer: process_handle: 0x00000298 base_address: 0x00345000	success	1
1619448554.650751 WriteProcessMemory	process_identifier: 2712 buffer: process_handle: 0x00000298 base_address: 0x0034f000	success	1
1619448554.650751 WriteProcessMemory	process_identifier: 2712 buffer: process_handle: 0x00000298 base_address: 0x00351000	success	1
1619448554.932751 NtAllocateVirtualMemory	process_identifier: 3000 region_size: 483328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 (PAGE_READWRITE) process_handle: 0x00000280 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00300000	success	0
1619448554.932751 WriteProcessMemory	process_identifier: 3000 buffer: tØÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $º¼_þbÒþbÒþbÒ÷GÿbÒm,JÿbÒAËübÒþbÒýbÒAÿbÒ÷VÿbÒ÷A×bÒþbÓ¸cÒåÿ}¹bÒåÿOÿbÒRichþbÒÕ!L¹LbåUà! äìM@¤'\|ð¤.text¬ÃÄ `codeAà È `.rdataÎABè@@.data$PB*@À.reloc°ðl@B process_handle: 0x00000280 base_address: 0x00300000	success	1
1619448554.932751 WriteProcessMemory	process_identifier: 3000 buffer: process_handle: 0x00000280 base_address: 0x00301000	success	1
1619448554.932751 WriteProcessMemory	process_identifier: 3000 buffer: process_handle: 0x00000280 base_address: 0x0031e000	success	1
1619448554.932751 WriteProcessMemory	process_identifier: 3000 buffer: process_handle: 0x00000280 base_address: 0x00320000	success	1
1619448554.932751 WriteProcessMemory	process_identifier: 3000 buffer: process_handle: 0x00000280 base_address: 0x00325000	success	1
1619448554.932751 WriteProcessMemory	process_identifier: 3000 buffer: process_handle: 0x00000280 base_address: 0x0032f000	success	1
1619448554.932751 WriteProcessMemory	process_identifier: 3000 buffer: process_handle: 0x00000280 base_address: 0x00331000	success	1

File has been identified by 57 AntiVirus engines on VirusTotal as malicious (50 out of 57 个事件)

Bkav	W32.AIDetectVM.malware1
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Trojan.Heur.yqZ@XoAYa0c
CAT-QuickHeal	Trojan.Invader
Cylance	Unsafe
Zillya	Trojan.Shiz.Win32.3194
Sangfor	Malware
K7AntiVirus	Riskware ( 0040eff71 )
Alibaba	TrojanSpy:Win32/Invader.6b4c75c2
K7GW	Riskware ( 0040eff71 )
Cybereason	malicious.3e1fb1
Arcabit	Trojan.Heur.EEF3DF
BitDefenderTheta	AI:Packer.2DCEC4981B
Cyren	W32/Shiz.S.gen!Eldorado
Symantec	SMG.Heur!gen
APEX	Malicious
Paloalto	generic.ml
Kaspersky	HEUR:Trojan.Win32.Invader
BitDefender	Gen:Trojan.Heur.yqZ@XoAYa0c
NANO-Antivirus	Trojan.Win32.Invader.ggbjbz
Avast	Win32:Shifu-B [Trj]
Rising	Spyware.Shiz!8.4BA (TFE:2:RlW8FkxcJgM)
Ad-Aware	Gen:Trojan.Heur.yqZ@XoAYa0c
Sophos	Mal/Generic-R + Troj/Agent-BDJL
Comodo	TrojWare.Win32.Spy.Shiz.NCA@8m98i8
F-Secure	Trojan.TR/ATRAPS.Gen
DrWeb	Trojan.Siggen9.25119
VIPRE	Trojan.Win32.Generic!BT
McAfee-GW-Edition	BehavesLike.Win32.Generic.fm
FireEye	Generic.mg.542bbbd3e1fb1d36
Emsisoft	Gen:Trojan.Heur.yqZ@XoAYa0c (B)
SentinelOne	Static AI - Malicious PE
Jiangmin	Trojan.Invader.cms
eGambit	Unsafe.AI_Score_99%
Avira	TR/ATRAPS.Gen
Antiy-AVL	Trojan/Win32.Invader
Gridinsoft	Trojan.Win32.Packed.vb!s1
Microsoft	TrojanSpy:Win32/Invader.S!MSR
ZoneAlarm	HEUR:Trojan.Win32.Invader
GData	Gen:Trojan.Heur.yqZ@XoAYa0c
Cynet	Malicious (score: 100)
AhnLab-V3	Malware/Win32.Generic.C3559287
Acronis	suspicious
McAfee	GenericRXJA-YC!542BBBD3E1FB
MAX	malware (ai score=83)
VBA32	BScope.TrojanRansom.Blocker
Malwarebytes	Spyware.Shiz
ESET-NOD32	a variant of Win32/Spy.Shiz.NCR
Tencent	Malware.Win32.Gencirc.10b0780b
Yandex	Trojan.GenAsa!66C98u5XYiI

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2015-09-01 16:30:23

Imports

Library KERNEL32.dll:

• 0x40402c GetLastError

• 0x404030 CloseHandle

• 0x404034 GetModuleFileNameW

• 0x404038 DeleteFileA

• 0x40403c Sleep

• 0x404040 GetProcessHeap

• 0x404044 WaitForSingleObject

• 0x404048 HeapFree

• 0x40404c HeapAlloc

• 0x404050 GetCommandLineW

• 0x404054 LocalFree

• 0x404058 GetCurrentProcessId

• 0x40405c GetVersionExA

• 0x404060 LocalAlloc

• 0x404064 LoadLibraryA

• 0x404068 FreeLibrary

• 0x40406c GetModuleHandleA

• 0x404070 GetProcAddress

• 0x404074 GetModuleFileNameA

• 0x404078 GetVersionExW

• 0x40407c GetSystemWindowsDirectoryA

• 0x404080 GlobalFindAtomA

• 0x404084 ExpandEnvironmentStringsA

• 0x404088 GetCurrentProcess

• 0x40408c GlobalAddAtomA

• 0x404090 SetErrorMode

• 0x404094 lstrcpynA

• 0x404098 ExitProcess

• 0x40409c GetTickCount

• 0x4040a0 Module32Next

• 0x4040a4 GlobalMemoryStatusEx

• 0x4040a8 VirtualProtectEx

• 0x4040ac VirtualAlloc

• 0x4040b0 Module32First

• 0x4040b4 GetExitCodeProcess

• 0x4040b8 CreateRemoteThread

• 0x4040bc VirtualFree

• 0x4040c0 GetThreadContext

• 0x4040c4 CreateFileA

• 0x4040c8 SetThreadContext

• 0x4040cc OpenProcess

• 0x4040d0 TerminateThread

• 0x4040d4 CreateProcessA

• 0x4040d8 TerminateProcess

• 0x4040dc FlushInstructionCache

• 0x4040e0 GetShortPathNameA

• 0x4040e4 GetHandleInformation

• 0x4040e8 VirtualAllocEx

• 0x4040ec CreateToolhelp32Snapshot

• 0x4040f0 WriteProcessMemory

• 0x4040f4 ResumeThread

• 0x4040f8 CreateThread

• 0x4040fc WriteFile

• 0x404100 ReadFile

• 0x404104 GetFileSizeEx

• 0x404108 lstrcmpiA

• 0x40410c CopyFileA

• 0x404110 SetFileAttributesA

• 0x404114 GetTempFileNameA

Library USER32.dll:

• 0x404164 wsprintfW

• 0x404168 DestroyWindow

• 0x40416c keybd_event

• 0x404170 GetMessageA

• 0x404174 SetTimer

• 0x404178 RegisterClassExA

• 0x40417c PostQuitMessage

• 0x404180 KillTimer

• 0x404184 TranslateMessage

• 0x404188 DefWindowProcA

• 0x40418c ShowWindow

• 0x404190 FlashWindow

• 0x404194 DispatchMessageA

• 0x404198 UpdateWindow

• 0x40419c CreateWindowExA

Library SHELL32.dll:

• 0x404124 SHGetFolderPathA

• 0x404128 ShellExecuteExA

• 0x40412c SHGetFolderPathW

• 0x404130 ShellExecuteExW

Library ole32.dll:

• 0x4041c8 CoInitializeEx

• 0x4041cc CoUninitialize

Library PSAPI.DLL:

• 0x40411c GetModuleBaseNameW

Library SHLWAPI.dll:

• 0x404138 StrRChrA

• 0x40413c PathAppendA

• 0x404140 PathAppendW

• 0x404144 StrStrIA

• 0x404148 PathFileExistsA

• 0x40414c StrStrNIW

• 0x404150 PathAddExtensionA

• 0x404154 PathIsDirectoryA

• 0x404158 PathCombineA

• 0x40415c PathAddBackslashA

Library ntdll.dll:

• 0x4041a4 RtlImageNtHeader

• 0x4041a8 ZwClose

• 0x4041ac memset

• 0x4041b0 _alloca_probe

• 0x4041b4 strstr

• 0x4041b8 _snprintf

• 0x4041bc ZwSetInformationThread

• 0x4041c0 RtlUnwind

Library ADVAPI32.dll:

• 0x404000 CryptGetHashParam

• 0x404004 CryptAcquireContextA

• 0x404008 CryptCreateHash

• 0x40400c CryptDestroyHash

• 0x404010 CryptHashData

• 0x404014 OpenProcessToken

• 0x404018 GetSidSubAuthority

• 0x40401c GetSidSubAuthorityCount

• 0x404020 GetTokenInformation

• 0x404024 CryptReleaseContext

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
download.windowsupdate.com	CNAME www.download.windowsupdate.com.cdn.dnsv1.com A 218.75.176.168 A 121.12.123.242 CNAME 3573033.pack.cdntip.com A 175.6.92.186 A 124.225.105.97 CNAME windowsupdate.sched.s11.tdnsv5.com CNAME 2-01-3cf7-0009.cdx.cedexis.net A 119.147.227.210 CNAME wu-fg-shim.trafficmanager.net A 218.75.176.148	124.225.105.97
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	50534	114.114.114.114	53
192.168.56.101	51808	114.114.114.114	53
192.168.56.101	53657	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	58367	114.114.114.114	53
192.168.56.101	63429	114.114.114.114	53
192.168.56.101	65004	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	49235	224.0.0.252	5355
192.168.56.101	51963	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	51809	239.255.255.250	3702
192.168.56.101	56540	239.255.255.250	3702
192.168.56.101	56807	239.255.255.250	1900
192.168.56.101	58707	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.