SmartHawk

11.2

0-day

该样本未表现出任何异常！

重新分析

下载样本

dd0d7e33f1ec7186e3898248ae8f9ad8a93b3860fb2558652059940d39835e52

6488dd5a4e3befb5f59af2b7ed53cce8.exe

分析耗时

119s

最近分析

文件大小

704.0KB

静态报毒动态报毒

未检测暂无鹰眼引擎检测结果

未检测暂无反病毒引擎检测结果

Queries for the computername (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619648249.176 GetComputerNameW	computer_name: OSKAR-PC	success	1	0

Checks if process is being debugged by a debugger (50 out of 92 个事件)

Time & API	Arguments	Status	Return	Repeated
1619610663.5465 IsDebuggerPresent		failed	0	0
1619610663.5465 IsDebuggerPresent		failed	0	0
1619610704.5625 IsDebuggerPresent		failed	0	0
1619610705.0625 IsDebuggerPresent		failed	0	0
1619610705.5625 IsDebuggerPresent		failed	0	0
1619610706.0625 IsDebuggerPresent		failed	0	0
1619610706.5625 IsDebuggerPresent		failed	0	0
1619610707.0625 IsDebuggerPresent		failed	0	0
1619610707.5625 IsDebuggerPresent		failed	0	0
1619610708.0625 IsDebuggerPresent		failed	0	0
1619610708.5625 IsDebuggerPresent		failed	0	0
1619610709.0625 IsDebuggerPresent		failed	0	0
1619610709.5625 IsDebuggerPresent		failed	0	0
1619610710.0625 IsDebuggerPresent		failed	0	0
1619610710.5625 IsDebuggerPresent		failed	0	0
1619610711.0625 IsDebuggerPresent		failed	0	0
1619610711.5625 IsDebuggerPresent		failed	0	0
1619610712.0625 IsDebuggerPresent		failed	0	0
1619610712.5625 IsDebuggerPresent		failed	0	0
1619610713.0625 IsDebuggerPresent		failed	0	0
1619610713.5625 IsDebuggerPresent		failed	0	0
1619610714.0625 IsDebuggerPresent		failed	0	0
1619610714.5625 IsDebuggerPresent		failed	0	0
1619610715.0625 IsDebuggerPresent		failed	0	0
1619610715.5625 IsDebuggerPresent		failed	0	0
1619610716.0625 IsDebuggerPresent		failed	0	0
1619610716.5625 IsDebuggerPresent		failed	0	0
1619610717.0625 IsDebuggerPresent		failed	0	0
1619610717.5625 IsDebuggerPresent		failed	0	0
1619610718.0625 IsDebuggerPresent		failed	0	0
1619610718.5625 IsDebuggerPresent		failed	0	0
1619610719.0625 IsDebuggerPresent		failed	0	0
1619610719.5625 IsDebuggerPresent		failed	0	0
1619610720.0625 IsDebuggerPresent		failed	0	0
1619610720.5625 IsDebuggerPresent		failed	0	0
1619610721.0625 IsDebuggerPresent		failed	0	0
1619610721.5625 IsDebuggerPresent		failed	0	0
1619610722.0625 IsDebuggerPresent		failed	0	0
1619610722.5625 IsDebuggerPresent		failed	0	0
1619610723.0625 IsDebuggerPresent		failed	0	0
1619610723.5625 IsDebuggerPresent		failed	0	0
1619610724.0625 IsDebuggerPresent		failed	0	0
1619610724.5625 IsDebuggerPresent		failed	0	0
1619610725.0625 IsDebuggerPresent		failed	0	0
1619610725.5625 IsDebuggerPresent		failed	0	0
1619610726.0625 IsDebuggerPresent		failed	0	0
1619610726.5625 IsDebuggerPresent		failed	0	0
1619610727.0625 IsDebuggerPresent		failed	0	0
1619610727.5625 IsDebuggerPresent		failed	0	0
1619610728.0625 IsDebuggerPresent		failed	0	0

Command line console output was observed (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619648254.332 WriteConsoleW	buffer: 成功: 成功创建计划任务 "Updates\UCuWAIIw"。 console_handle: 0x00000007	success	1	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619610663.5625 GlobalMemoryStatusEx		success	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 个事件)

suspicious_features

POST method with no referer header

suspicious_request

POST https://update.googleapis.com/service/update2?cup2key=10:1297952207&cup2hreq=28a94a4d814070d5636f07294a6eca5b8dd8d47dd47bf785b4496a25cc2b99ff

Performs some HTTP requests (4 个事件)

request	HEAD http://redirector.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe
request	HEAD http://r1---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?cms_redirect=yes&mh=ms&mip=202.100.214.100&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619618657&mv=m&mvi=1&pl=23&shardbypass=yes
request	HEAD http://r3---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=267b4447c4211223&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619618657&mv=m
request	POST https://update.googleapis.com/service/update2?cup2key=10:1297952207&cup2hreq=28a94a4d814070d5636f07294a6eca5b8dd8d47dd47bf785b4496a25cc2b99ff

Sends data using the HTTP POST Method (1 个事件)

request

POST https://update.googleapis.com/service/update2?cup2key=10:1297952207&cup2hreq=28a94a4d814070d5636f07294a6eca5b8dd8d47dd47bf785b4496a25cc2b99ff

Allocates read-write-execute memory (usually to unpack itself) (50 out of 131 个事件)

Time & API	Arguments	Status	Return
1619610663.0935 NtAllocateVirtualMemory	process_identifier: 2868 region_size: 1245184 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00580000	success	0
1619610663.0935 NtAllocateVirtualMemory	process_identifier: 2868 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00670000	success	0
1619610663.4845 NtAllocateVirtualMemory	process_identifier: 2868 region_size: 1900544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x02250000	success	0
1619610663.4845 NtAllocateVirtualMemory	process_identifier: 2868 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x023e0000	success	0
1619610663.5155 NtProtectVirtualMemory	process_identifier: 2868 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73b91000	success	0
1619610663.5465 NtAllocateVirtualMemory	process_identifier: 2868 region_size: 1048576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x020b0000	success	0
1619610663.5465 NtAllocateVirtualMemory	process_identifier: 2868 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x02170000	success	0
1619610663.5465 NtAllocateVirtualMemory	process_identifier: 2868 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0039a000	success	0
1619610663.5465 NtProtectVirtualMemory	process_identifier: 2868 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73b92000	success	0
1619610663.5465 NtAllocateVirtualMemory	process_identifier: 2868 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00392000	success	0
1619610663.7345 NtAllocateVirtualMemory	process_identifier: 2868 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003a2000	success	0
1619610663.8125 NtAllocateVirtualMemory	process_identifier: 2868 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003c5000	success	0
1619610663.8125 NtAllocateVirtualMemory	process_identifier: 2868 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003cb000	success	0
1619610663.8125 NtAllocateVirtualMemory	process_identifier: 2868 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003c7000	success	0
1619610663.9375 NtAllocateVirtualMemory	process_identifier: 2868 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003a3000	success	0
1619610663.9685 NtAllocateVirtualMemory	process_identifier: 2868 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003ac000	success	0
1619610664.5775 NtAllocateVirtualMemory	process_identifier: 2868 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003a4000	success	0
1619610664.5775 NtAllocateVirtualMemory	process_identifier: 2868 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003a6000	success	0
1619610664.7345 NtAllocateVirtualMemory	process_identifier: 2868 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004f0000	success	0
1619610664.8595 NtAllocateVirtualMemory	process_identifier: 2868 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003ba000	success	0
1619610664.8595 NtAllocateVirtualMemory	process_identifier: 2868 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003b7000	success	0
1619610665.9055 NtAllocateVirtualMemory	process_identifier: 2868 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003a7000	success	0
1619610665.9055 NtAllocateVirtualMemory	process_identifier: 2868 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003a8000	success	0
1619610666.2655 NtAllocateVirtualMemory	process_identifier: 2868 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003a9000	success	0
1619610666.4055 NtAllocateVirtualMemory	process_identifier: 2868 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x006b0000	success	0
1619610666.4055 NtAllocateVirtualMemory	process_identifier: 2868 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003aa000	success	0
1619610666.4525 NtAllocateVirtualMemory	process_identifier: 2868 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x006c0000	success	0
1619610666.5305 NtAllocateVirtualMemory	process_identifier: 2868 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004f1000	success	0
1619610666.5465 NtAllocateVirtualMemory	process_identifier: 2868 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003b6000	success	0
1619610666.5625 NtAllocateVirtualMemory	process_identifier: 2868 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x006c1000	success	0
1619610666.5935 NtAllocateVirtualMemory	process_identifier: 2868 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004f2000	success	0
1619610666.5935 NtAllocateVirtualMemory	process_identifier: 2868 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x006c2000	success	0
1619610666.6095 NtAllocateVirtualMemory	process_identifier: 2868 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004f3000	success	0
1619610666.6245 NtAllocateVirtualMemory	process_identifier: 2868 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004f5000	success	0
1619610666.6245 NtAllocateVirtualMemory	process_identifier: 2868 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004f6000	success	0
1619610700.8745 NtAllocateVirtualMemory	process_identifier: 2868 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004f8000	success	0
1619610701.1095 NtAllocateVirtualMemory	process_identifier: 2868 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0039c000	success	0
1619610701.2345 NtAllocateVirtualMemory	process_identifier: 2868 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x006c3000	success	0
1619610701.2495 NtAllocateVirtualMemory	process_identifier: 2868 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003ad000	success	0
1619610701.2495 NtAllocateVirtualMemory	process_identifier: 2868 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004f9000	success	0
1619610701.4375 NtAllocateVirtualMemory	process_identifier: 2868 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x006c4000	success	0
1619610701.4375 NtAllocateVirtualMemory	process_identifier: 2868 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004fa000	success	0
1619610701.4375 NtProtectVirtualMemory	process_identifier: 2868 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 505856 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x05860400	failed	3221225550
1619610704.1875 NtAllocateVirtualMemory	process_identifier: 2868 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004fb000	success	0
1619610704.2025 NtAllocateVirtualMemory	process_identifier: 2868 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004fc000	success	0
1619610704.2185 NtAllocateVirtualMemory	process_identifier: 2868 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004fd000	success	0
1619610704.2655 NtAllocateVirtualMemory	process_identifier: 2868 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004fe000	success	0
1619610704.3905 NtAllocateVirtualMemory	process_identifier: 2868 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x006c5000	success	0
1619610704.3905 NtAllocateVirtualMemory	process_identifier: 2868 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004ff000	success	0
1619610704.4055 NtAllocateVirtualMemory	process_identifier: 2868 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x023c0000	success	0

A process attempted to delay the analysis task. (1 个事件)

description

6488dd5a4e3befb5f59af2b7ed53cce8.exe tried to sleep 166 seconds, actually delayed analysis time by 166 seconds

Creates a suspicious process (2 个事件)

cmdline	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\UCuWAIIw" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp1EA9.tmp"
cmdline	schtasks.exe /Create /TN "Updates\UCuWAIIw" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp1EA9.tmp"

A process created a hidden window (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619610705.2345 ShellExecuteExW	parameters: /Create /TN "Updates\UCuWAIIw" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp1EA9.tmp" filepath: schtasks.exe filepath_r: schtasks.exe show_type: 0	success	1	0

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

7.93093944757787

section

{'size_of_data': '0x000af600', 'virtual_address': '0x00002000', 'entropy': 7.93093944757787, 'name': '.text', 'virtual_size': '0x000af584'}

description

A section with a high entropy has been found

entropy

0.9971570717839374

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619610701.4375 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1	0
1619648266.816125 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1	0

Terminates another process (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619648292.176125 NtTerminateProcess	status_code: 0xffffffff process_identifier: 2868 process_handle: 0x00000234	failed	0	0
1619648292.176125 NtTerminateProcess	status_code: 0xffffffff process_identifier: 2868 process_handle: 0x00000234	success	0	0

Uses Windows utilities for basic Windows functionality (2 个事件)

cmdline	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\UCuWAIIw" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp1EA9.tmp"
cmdline	schtasks.exe /Create /TN "Updates\UCuWAIIw" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp1EA9.tmp"

Allocates execute permission to another process indicative of possible code injection (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619610711.4845 NtAllocateVirtualMemory	process_identifier: 1832 region_size: 360448 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x0000c26c allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	success	0	0

Deletes executed files from disk (1 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp1EA9.tmp

Potential code injection by writing to the memory of another process (4 个事件)

Time & API	Arguments	Status	Return
1619610711.4845 WriteProcessMemory	process_identifier: 1832 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL¸ /_à5 @@ @Ì4O@Ø` H.text$ `.rsrcØ@@@.reloc`@B process_handle: 0x0000c26c base_address: 0x00400000	success	1
1619610711.4995 WriteProcessMemory	process_identifier: 1832 buffer: 0HX@\|\|4VS_VERSION_INFO½ïþ?DVarFileInfo$Translation°ÜStringFileInfo¸000004b0,FileDescription 0FileVersion0.0.0.0TInternalNameAmOTjZKKlMRYRjNZLpcWD.exe(LegalCopyright \OriginalFilenameAmOTjZKKlMRYRjNZLpcWD.exe4ProductVersion0.0.0.08Assembly Version0.0.0.0 process_handle: 0x0000c26c base_address: 0x00454000	success	1
1619610711.4995 WriteProcessMemory	process_identifier: 1832 buffer: 0 5 process_handle: 0x0000c26c base_address: 0x00456000	success	1
1619610711.4995 WriteProcessMemory	process_identifier: 1832 buffer: @ process_handle: 0x0000c26c base_address: 0x7efde008	success	1

Code injection by writing an executable or DLL to the memory of another process (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619610711.4845 WriteProcessMemory	process_identifier: 1832 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL¸ /_à5 @@ @Ì4O@Ø` H.text$ `.rsrcØ@@@.reloc`@B process_handle: 0x0000c26c base_address: 0x00400000	success	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2868 called NtSetContextThread to modify thread in remote process 1832
1619610711.4995 NtSetContextThread	thread_handle: 0x000048fc registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4535582 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 1832	success	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2868 resumed a thread in remote process 1832
1619610711.5155 NtResumeThread	thread_handle: 0x000048fc suspend_count: 1 process_identifier: 1832	success	0	0

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 个事件)

dead_host

172.217.24.14:443

Executed a process and injected code into it, probably while unpacking (20 个事件)

Time & API	Arguments	Status	Return
1619610663.5465 NtResumeThread	thread_handle: 0x000000d8 suspend_count: 1 process_identifier: 2868	success	0
1619610663.5465 NtResumeThread	thread_handle: 0x00000128 suspend_count: 1 process_identifier: 2868	success	0
1619610663.5625 NtResumeThread	thread_handle: 0x00000164 suspend_count: 1 process_identifier: 2868	success	0
1619610704.5305 NtResumeThread	thread_handle: 0x00005cb4 suspend_count: 1 process_identifier: 2868	success	0
1619610704.5465 NtResumeThread	thread_handle: 0x000025c8 suspend_count: 1 process_identifier: 2868	success	0
1619610705.2345 CreateProcessInternalW	thread_identifier: 1344 thread_handle: 0x0000cc20 process_identifier: 2840 current_directory: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp filepath: C:\Windows\System32\schtasks.exe track: 1 command_line: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\UCuWAIIw" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp1EA9.tmp" filepath_r: C:\Windows\System32\schtasks.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) process_handle: 0x00003530 inherit_handles: 0	success	1
1619610711.4845 CreateProcessInternalW	thread_identifier: 1740 thread_handle: 0x000048fc process_identifier: 1832 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\6488dd5a4e3befb5f59af2b7ed53cce8.exe track: 1 command_line: "{path}" filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\6488dd5a4e3befb5f59af2b7ed53cce8.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x0000c26c inherit_handles: 0	success	1
1619610711.4845 NtGetContextThread	thread_handle: 0x000048fc	success	0
1619610711.4845 NtAllocateVirtualMemory	process_identifier: 1832 region_size: 360448 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x0000c26c allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	success	0
1619610711.4845 WriteProcessMemory	process_identifier: 1832 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL¸ /_à5 @@ @Ì4O@Ø` H.text$ `.rsrcØ@@@.reloc`@B process_handle: 0x0000c26c base_address: 0x00400000	success	1
1619610711.4845 WriteProcessMemory	process_identifier: 1832 buffer: process_handle: 0x0000c26c base_address: 0x00402000	success	1
1619610711.4995 WriteProcessMemory	process_identifier: 1832 buffer: 0HX@\|\|4VS_VERSION_INFO½ïþ?DVarFileInfo$Translation°ÜStringFileInfo¸000004b0,FileDescription 0FileVersion0.0.0.0TInternalNameAmOTjZKKlMRYRjNZLpcWD.exe(LegalCopyright \OriginalFilenameAmOTjZKKlMRYRjNZLpcWD.exe4ProductVersion0.0.0.08Assembly Version0.0.0.0 process_handle: 0x0000c26c base_address: 0x00454000	success	1
1619610711.4995 WriteProcessMemory	process_identifier: 1832 buffer: 0 5 process_handle: 0x0000c26c base_address: 0x00456000	success	1
1619610711.4995 WriteProcessMemory	process_identifier: 1832 buffer: @ process_handle: 0x0000c26c base_address: 0x7efde008	success	1
1619610711.4995 NtSetContextThread	thread_handle: 0x000048fc registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4535582 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 1832	success	0
1619610711.5155 NtResumeThread	thread_handle: 0x000048fc suspend_count: 1 process_identifier: 1832	success	0
1619610711.5155 NtResumeThread	thread_handle: 0x0000a474 suspend_count: 1 process_identifier: 2868	success	0
1619648255.394125 NtResumeThread	thread_handle: 0x000000d8 suspend_count: 1 process_identifier: 1832	success	0
1619648255.394125 NtResumeThread	thread_handle: 0x00000128 suspend_count: 1 process_identifier: 1832	success	0
1619648255.394125 NtResumeThread	thread_handle: 0x00000170 suspend_count: 1 process_identifier: 1832	success	0

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-08-24 08:20:28

Imports

Library mscoree.dll:

• 0x402000 _CorExeMain

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
r3---sn-j5o7dn7e.gvt1.com	CNAME r3.sn-j5o7dn7e.gvt1.com A 113.108.239.196	113.108.239.196
redirector.gvt1.com	A 203.208.41.65
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
r1---sn-j5o7dn7e.gvt1.com	A 113.108.239.194 CNAME r1.sn-j5o7dn7e.gvt1.com	113.108.239.194
clients2.google.com	A 172.217.24.14 CNAME clients.l.google.com	172.217.160.78
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
update.googleapis.com	A 203.208.41.34	203.208.41.34
teredo.ipv6.microsoft.com		127.0.0.1

TCP

Source	Source Port	Destination	Destination Port
192.168.56.101	49196	113.108.239.194 r1---sn-j5o7dn7e.gvt1.com	80
192.168.56.101	49197	113.108.239.196 r3---sn-j5o7dn7e.gvt1.com	80
192.168.56.101	49191	203.208.41.34 update.googleapis.com	443
192.168.56.101	49193	203.208.41.65 redirector.gvt1.com	80

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	51378	114.114.114.114	53
192.168.56.101	51963	114.114.114.114	53
192.168.56.101	53210	114.114.114.114	53
192.168.56.101	54260	114.114.114.114	53
192.168.56.101	54991	114.114.114.114	53
192.168.56.101	55368	114.114.114.114	53
192.168.56.101	60088	114.114.114.114	53
192.168.56.101	60384	114.114.114.114	53
192.168.56.101	63429	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	49713	224.0.0.252	5355
192.168.56.101	53237	224.0.0.252	5355
192.168.56.101	53380	224.0.0.252	5355
192.168.56.101	53657	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	58367	224.0.0.252	5355
192.168.56.101	58970	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355

HTTP & HTTPS Requests

URI	Data
http://redirector.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe	HEAD /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.5 X-Old-UID: cnt=0 X-Last-HR: 0x0 X-Last-HTTP-Status-Code: 0 X-Retry-Count: 0 X-HTTP-Attempts: 1 Host: redirector.gvt1.com
http://r1---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?cms_redirect=yes&mh=ms&mip=202.100.214.100&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619618657&mv=m&mvi=1&pl=23&shardbypass=yes	HEAD /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?cms_redirect=yes&mh=ms&mip=202.100.214.100&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619618657&mv=m&mvi=1&pl=23&shardbypass=yes HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.5 X-Old-UID: cnt=0 X-Last-HR: 0x0 X-Last-HTTP-Status-Code: 0 X-Retry-Count: 0 X-HTTP-Attempts: 1 Host: r1---sn-j5o7dn7e.gvt1.com
http://r3---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=267b4447c4211223&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619618657&mv=m	HEAD /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=267b4447c4211223&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619618657&mv=m HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.5 X-Old-UID: cnt=0 X-Last-HR: 0x0 X-Last-HTTP-Status-Code: 0 X-Retry-Count: 0 X-HTTP-Attempts: 1 Host: r3---sn-j5o7dn7e.gvt1.com

URI

Data

http://redirector.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe

HEAD /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: redirector.gvt1.com

http://r1---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?cms_redirect=yes&mh=ms&mip=202.100.214.100&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619618657&mv=m&mvi=1&pl=23&shardbypass=yes

HEAD /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?cms_redirect=yes&mh=ms&mip=202.100.214.100&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619618657&mv=m&mvi=1&pl=23&shardbypass=yes HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: r1---sn-j5o7dn7e.gvt1.com

http://r3---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=267b4447c4211223&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619618657&mv=m

HEAD /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=267b4447c4211223&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619618657&mv=m HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: r3---sn-j5o7dn7e.gvt1.com

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.