SmartHawk

14.4

0-day

52 个模型检测该样本为恶意！

重新分析

下载样本

fb6f6789fb2184fe14b56614fe7dc80860d156a6ae4800f4cbbb633d47620fbf

5fd995d30bff1a62afd56735e2f93f84.exe

分析耗时

89s

最近分析

文件大小

554.0KB

静态报毒动态报毒 AI SCORE=88 ATTRIBUTE CLOUD CONFIDENCE ELDORADO FAREIT GENERICKD HEAPOVERRIDE HIGH CONFIDENCE HIGHCONFIDENCE HRGSMF IM0@AGRY7EK KRYPTIK MALICIOUS PE MASSLOGGER PWSX R03BC0WH720 R347092 SCORE SKEEYAH TBJD UNCLASSIFIEDMALWARE@0 UNSAFE WQRXW ZEMSILF 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee	Fareit-FXH!5FD995D30BFF	20200821	6.0.6.653
Alibaba	Trojan:Win32/Kryptik.19c740bd	20190527	0.3.0.5
Baidu		20190318	1.0.0.2
Tencent	Msil.Trojan.Crypt.Tbjd	20200821	1.0.0.1
Kingsoft		20200821	2013.8.14.323
CrowdStrike	win/malicious_confidence_90% (W)	20190702	1.0

Queries for the computername (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619526216.630876 GetComputerNameW	computer_name: OSKAR-PC	success	1	0
1619526222.614124 GetComputerNameW	computer_name: OSKAR-PC	success	1	0

Checks if process is being debugged by a debugger (19 个事件)

Time & API	Arguments	Status	Return	Repeated
1619513304.758465 IsDebuggerPresent		failed	0	0
1619513353.101465 IsDebuggerPresent		failed	0	0
1619513353.586465 IsDebuggerPresent		failed	0	0
1619513354.101465 IsDebuggerPresent		failed	0	0
1619513354.586465 IsDebuggerPresent		failed	0	0
1619513355.101465 IsDebuggerPresent		failed	0	0
1619513355.586465 IsDebuggerPresent		failed	0	0
1619513356.101465 IsDebuggerPresent		failed	0	0
1619513356.586465 IsDebuggerPresent		failed	0	0
1619513357.101465 IsDebuggerPresent		failed	0	0
1619513357.586465 IsDebuggerPresent		failed	0	0
1619513358.101465 IsDebuggerPresent		failed	0	0
1619513358.586465 IsDebuggerPresent		failed	0	0
1619513359.101465 IsDebuggerPresent		failed	0	0
1619513359.586465 IsDebuggerPresent		failed	0	0
1619513360.101465 IsDebuggerPresent		failed	0	0
1619513360.586465 IsDebuggerPresent		failed	0	0
1619513361.101465 IsDebuggerPresent		failed	0	0
1619526219.677124 IsDebuggerPresent		failed	0	0

Command line console output was observed (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619526217.271876 WriteConsoleW	buffer: 成功: 成功创建计划任务 "Updates\rDIJJErRm"。 console_handle: 0x00000007	success	1	0

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 个事件)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619513347.555465 GlobalMemoryStatusEx		success	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (50 out of 176 个事件)

Time & API	Arguments	Status	Return
1619513303.851465 NtAllocateVirtualMemory	process_identifier: 2988 region_size: 1966080 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x008a0000	success	0
1619513303.851465 NtAllocateVirtualMemory	process_identifier: 2988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00a40000	success	0
1619513304.555465 NtProtectVirtualMemory	process_identifier: 2988 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73f31000	success	0
1619513304.758465 NtAllocateVirtualMemory	process_identifier: 2988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0045a000	success	0
1619513304.758465 NtProtectVirtualMemory	process_identifier: 2988 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73f32000	success	0
1619513304.758465 NtAllocateVirtualMemory	process_identifier: 2988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00452000	success	0
1619513304.992465 NtAllocateVirtualMemory	process_identifier: 2988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00462000	success	0
1619513305.070465 NtAllocateVirtualMemory	process_identifier: 2988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00463000	success	0
1619513305.086465 NtAllocateVirtualMemory	process_identifier: 2988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0052b000	success	0
1619513305.086465 NtAllocateVirtualMemory	process_identifier: 2988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00527000	success	0
1619513305.086465 NtAllocateVirtualMemory	process_identifier: 2988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0046c000	success	0
1619513305.133465 NtAllocateVirtualMemory	process_identifier: 2988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00860000	success	0
1619513305.570465 NtAllocateVirtualMemory	process_identifier: 2988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00464000	success	0
1619513305.570465 NtAllocateVirtualMemory	process_identifier: 2988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00465000	success	0
1619513305.601465 NtAllocateVirtualMemory	process_identifier: 2988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00466000	success	0
1619513305.617465 NtAllocateVirtualMemory	process_identifier: 2988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00467000	success	0
1619513305.617465 NtAllocateVirtualMemory	process_identifier: 2988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00468000	success	0
1619513305.633465 NtAllocateVirtualMemory	process_identifier: 2988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0046a000	success	0
1619513305.664465 NtAllocateVirtualMemory	process_identifier: 2988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0048a000	success	0
1619513305.664465 NtAllocateVirtualMemory	process_identifier: 2988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00487000	success	0
1619513305.664465 NtAllocateVirtualMemory	process_identifier: 2988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0049a000	success	0
1619513305.789465 NtAllocateVirtualMemory	process_identifier: 2988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00486000	success	0
1619513305.805465 NtAllocateVirtualMemory	process_identifier: 2988 region_size: 20480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00861000	success	0
1619513305.805465 NtAllocateVirtualMemory	process_identifier: 2988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0045b000	success	0
1619513306.070465 NtAllocateVirtualMemory	process_identifier: 2988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x02170000	success	0
1619513306.086465 NtAllocateVirtualMemory	process_identifier: 2988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00866000	success	0
1619513306.195465 NtAllocateVirtualMemory	process_identifier: 2988 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00867000	success	0
1619513306.211465 NtAllocateVirtualMemory	process_identifier: 2988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00492000	success	0
1619513306.242465 NtAllocateVirtualMemory	process_identifier: 2988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00525000	success	0
1619513306.367465 NtAllocateVirtualMemory	process_identifier: 2988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0086a000	success	0
1619513306.414465 NtAllocateVirtualMemory	process_identifier: 2988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00469000	success	0
1619513347.461465 NtAllocateVirtualMemory	process_identifier: 2988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0086b000	success	0
1619513347.461465 NtAllocateVirtualMemory	process_identifier: 2988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00a41000	success	0
1619513347.523465 NtAllocateVirtualMemory	process_identifier: 2988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0086c000	success	0
1619513347.586465 NtAllocateVirtualMemory	process_identifier: 2988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0049c000	success	0
1619513347.617465 NtAllocateVirtualMemory	process_identifier: 2988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0086d000	success	0
1619513347.695465 NtAllocateVirtualMemory	process_identifier: 2988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x04bb0000	success	0
1619513347.711465 NtAllocateVirtualMemory	process_identifier: 2988 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0086e000	success	0
1619513347.805465 NtProtectVirtualMemory	process_identifier: 2988 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 260096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x04aa0400	failed	3221225550
1619513352.289465 NtAllocateVirtualMemory	process_identifier: 2988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x04bb1000	success	0
1619513352.289465 NtAllocateVirtualMemory	process_identifier: 2988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x04bc0000	success	0
1619513352.305465 NtAllocateVirtualMemory	process_identifier: 2988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x04bc1000	success	0
1619513352.305465 NtAllocateVirtualMemory	process_identifier: 2988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x04bc2000	success	0
1619513352.383465 NtAllocateVirtualMemory	process_identifier: 2988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x04bc3000	success	0
1619513352.398465 NtAllocateVirtualMemory	process_identifier: 2988 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x04bc4000	success	0
1619513352.789465 NtAllocateVirtualMemory	process_identifier: 2988 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x04bc5000	success	0
1619513352.820465 NtProtectVirtualMemory	process_identifier: 2988 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x04aa0178	failed	3221225550
1619513352.820465 NtProtectVirtualMemory	process_identifier: 2988 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x04aa01a0	failed	3221225550
1619513352.820465 NtProtectVirtualMemory	process_identifier: 2988 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x04aa01c8	failed	3221225550
1619513352.820465 NtProtectVirtualMemory	process_identifier: 2988 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x04aa01f0	failed	3221225550

Checks whether any human activity is being performed by constantly checking whether the foreground window changed

Creates a suspicious process (2 个事件)

cmdline	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\rDIJJErRm" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp25FC.tmp"
cmdline	schtasks.exe /Create /TN "Updates\rDIJJErRm" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp25FC.tmp"

A process created a hidden window (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619513358.695465 ShellExecuteExW	parameters: /Create /TN "Updates\rDIJJErRm" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp25FC.tmp" filepath: schtasks.exe filepath_r: schtasks.exe show_type: 0	success	1	0

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

7.609559706990381

section

{'size_of_data': '0x00089c00', 'virtual_address': '0x00002000', 'entropy': 7.609559706990381, 'name': '.text', 'virtual_size': '0x00089a64'}

description

A section with a high entropy has been found

entropy

0.995483288166215

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619513347.805465 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1	0
1619526222.146124 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1	0

Uses Windows utilities for basic Windows functionality (2 个事件)

cmdline	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\rDIJJErRm" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp25FC.tmp"
cmdline	schtasks.exe /Create /TN "Updates\rDIJJErRm" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp25FC.tmp"

One or more of the buffers contains an embedded PE file (2 个事件)

buffer	Buffer with sha1: 874b7c3c97cc5b13b9dd172fec5a54bc1f258005
buffer	Buffer with sha1: 874f3caf663265f7dd18fb565d91b7d915031251

Communicates with host for which no DNS query was performed (2 个事件)

host	172.217.24.14
host	185.165.153.188

Allocates execute permission to another process indicative of possible code injection (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619513361.351465 NtAllocateVirtualMemory	process_identifier: 1816 region_size: 229376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x000114f4 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	success	0	0

Looks for the Windows Idle Time to determine the uptime (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619526222.552124 NtQuerySystemInformation	information_class: 8 (SystemProcessorPerformanceInformation)	success	0	0

A process attempted to delay the analysis task. (1 个事件)

description

RegSvcs.exe tried to sleep 5456362 seconds, actually delayed analysis time by 5456362 seconds

Installs itself for autorun at Windows startup (1 个事件)

reg_key

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DSL Service

reg_value

C:\Program Files (x86)\DSL Service\dslsvc.exe

Potential code injection by writing to the memory of another process (3 个事件)

Time & API	Arguments	Status	Return
1619513361.351465 WriteProcessMemory	process_identifier: 1816 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL¡'éTàÈ`ç @ 8çW ] H.textÇ È `.relocÊ@B.rsrc] ^Ì@@ process_handle: 0x000114f4 base_address: 0x00400000	success	1
1619513361.351465 WriteProcessMemory	process_identifier: 1816 buffer: à7 process_handle: 0x000114f4 base_address: 0x00420000	success	1
1619513361.351465 WriteProcessMemory	process_identifier: 1816 buffer: @ process_handle: 0x000114f4 base_address: 0x7efde008	success	1

Code injection by writing an executable or DLL to the memory of another process (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619513361.351465 WriteProcessMemory	process_identifier: 1816 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL¡'éTàÈ`ç @ 8çW ] H.textÇ È `.relocÊ@B.rsrc] ^Ì@@ process_handle: 0x000114f4 base_address: 0x00400000	success	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2988 called NtSetContextThread to modify thread in remote process 1816
1619513361.351465 NtSetContextThread	thread_handle: 0x0001151c registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4319122 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 1816	success	0	0

Attempts to remove evidence of file being downloaded from the Internet (1 个事件)

file	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe:Zone.Identifier

Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2988 resumed a thread in remote process 1816
1619513361.555465 NtResumeThread	thread_handle: 0x0001151c suspend_count: 1 process_identifier: 1816	success	0	0

Executed a process and injected code into it, probably while unpacking (23 个事件)

Time & API	Arguments	Status	Return
1619513304.758465 NtResumeThread	thread_handle: 0x000000d0 suspend_count: 1 process_identifier: 2988	success	0
1619513304.789465 NtResumeThread	thread_handle: 0x00000158 suspend_count: 1 process_identifier: 2988	success	0
1619513353.023465 NtResumeThread	thread_handle: 0x00000fe0 suspend_count: 1 process_identifier: 2988	success	0
1619513353.055465 NtResumeThread	thread_handle: 0x0000e30c suspend_count: 1 process_identifier: 2988	success	0
1619513358.695465 CreateProcessInternalW	thread_identifier: 2496 thread_handle: 0x000112c4 process_identifier: 2648 current_directory: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp filepath: C:\Windows\System32\schtasks.exe track: 1 command_line: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\rDIJJErRm" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp25FC.tmp" filepath_r: C:\Windows\System32\schtasks.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) process_handle: 0x00011514 inherit_handles: 0	success	1
1619513361.336465 CreateProcessInternalW	thread_identifier: 1068 thread_handle: 0x0001151c process_identifier: 1816 current_directory: filepath: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe track: 1 command_line: "{path}" filepath_r: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x000114f4 inherit_handles: 0	success	1
1619513361.336465 NtGetContextThread	thread_handle: 0x0001151c	success	0
1619513361.351465 NtAllocateVirtualMemory	process_identifier: 1816 region_size: 229376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x000114f4 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	success	0
1619513361.351465 WriteProcessMemory	process_identifier: 1816 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL¡'éTàÈ`ç @ 8çW ] H.textÇ È `.relocÊ@B.rsrc] ^Ì@@ process_handle: 0x000114f4 base_address: 0x00400000	success	1
1619513361.351465 WriteProcessMemory	process_identifier: 1816 buffer: process_handle: 0x000114f4 base_address: 0x00402000	success	1
1619513361.351465 WriteProcessMemory	process_identifier: 1816 buffer: à7 process_handle: 0x000114f4 base_address: 0x00420000	success	1
1619513361.351465 WriteProcessMemory	process_identifier: 1816 buffer: process_handle: 0x000114f4 base_address: 0x00422000	success	1
1619513361.351465 WriteProcessMemory	process_identifier: 1816 buffer: @ process_handle: 0x000114f4 base_address: 0x7efde008	success	1
1619513361.351465 NtSetContextThread	thread_handle: 0x0001151c registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4319122 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 1816	success	0
1619513361.555465 NtResumeThread	thread_handle: 0x0001151c suspend_count: 1 process_identifier: 1816	success	0
1619513361.555465 NtResumeThread	thread_handle: 0x0000045c suspend_count: 1 process_identifier: 2988	success	0
1619526219.677124 NtResumeThread	thread_handle: 0x000000d0 suspend_count: 1 process_identifier: 1816	success	0
1619526219.755124 NtResumeThread	thread_handle: 0x0000015c suspend_count: 1 process_identifier: 1816	success	0
1619526221.927124 NtResumeThread	thread_handle: 0x00000254 suspend_count: 1 process_identifier: 1816	success	0
1619526222.052124 NtResumeThread	thread_handle: 0x00000278 suspend_count: 1 process_identifier: 1816	success	0
1619526222.130124 NtResumeThread	thread_handle: 0x000002c4 suspend_count: 1 process_identifier: 1816	success	0
1619526222.755124 NtResumeThread	thread_handle: 0x00000324 suspend_count: 1 process_identifier: 1816	success	0
1619526224.958124 NtResumeThread	thread_handle: 0x00000338 suspend_count: 1 process_identifier: 1816	success	0

File has been identified by 52 AntiVirus engines on VirusTotal as malicious (50 out of 52 个事件)

Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.34301436
FireEye	Generic.mg.5fd995d30bff1a62
CAT-QuickHeal	Trojan.MSIL
McAfee	Fareit-FXH!5FD995D30BFF
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
Sangfor	Malware
K7AntiVirus	Trojan ( 0056c20e1 )
Alibaba	Trojan:Win32/Kryptik.19c740bd
K7GW	Trojan ( 0056c20e1 )
Cybereason	malicious.1dfcbd
Arcabit	Trojan.Generic.D20B65FC
TrendMicro	TROJ_GEN.R03BC0WH720
Cyren	W32/MSIL_Kryptik.BIL.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Paloalto	generic.ml
Kaspersky	HEUR:Trojan.MSIL.Crypt.gen
BitDefender	Trojan.GenericKD.34301436
NANO-Antivirus	Trojan.Win32.Crypt.hrgsmf
AegisLab	Trojan.MSIL.Crypt.4!c
Tencent	Msil.Trojan.Crypt.Tbjd
Ad-Aware	Trojan.GenericKD.34301436
Comodo	.UnclassifiedMalware@0
F-Secure	Trojan.TR/Dropper.MSIL.wqrxw
Zillya	Trojan.Crypt.Win32.64959
Invincea	heuristic
Sophos	Mal/Generic-S
SentinelOne	DFI - Malicious PE
Avira	TR/Dropper.MSIL.wqrxw
Microsoft	Trojan:Win32/Skeeyah.A!rfn
ViRobot	Trojan.Win32.Z.Masslogger.567296
ZoneAlarm	HEUR:Trojan.MSIL.Crypt.gen
GData	Trojan.GenericKD.34301436
Cynet	Malicious (score: 85)
AhnLab-V3	Trojan/Win32.MSIL.R347092
BitDefenderTheta	Gen:NN.ZemsilF.34186.Im0@aGrY7Ek
ALYac	Trojan.GenericKD.34301436
MAX	malware (ai score=88)
VBA32	CIL.HeapOverride.Heur
Malwarebytes	Trojan.MalPack
ESET-NOD32	a variant of MSIL/Kryptik.XGH
TrendMicro-HouseCall	TROJ_GEN.R03BC0WH720
Rising	Trojan.Kryptik!8.8 (CLOUD)
Ikarus	Trojan-Spy.MassLogger
eGambit	Unsafe.AI_Score_77%
Fortinet	MSIL/Kryptik.XFP!tr
AVG	Win32:PWSX-gen [Trj]
Panda	Trj/CI.A

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (2 个事件)

dead_host	185.165.153.188:1985
dead_host	192.168.56.101:49185

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-08-06 11:49:21

Imports

Library mscoree.dll:

• 0x402000 _CorExeMain

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	50534	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	63429	114.114.114.114	53
192.168.56.101	65004	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	49235	224.0.0.252	5355
192.168.56.101	51963	224.0.0.252	5355
192.168.56.101	53657	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	56540	239.255.255.250	3702
192.168.56.101	56807	239.255.255.250	1900
192.168.56.101	58368	239.255.255.250	3702
192.168.56.101	58370	239.255.255.250	3702
192.168.56.101	58707	239.255.255.250	3702
192.168.56.101	50534	8.8.8.8	53
192.168.56.101	58367	8.8.8.8	53

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.