SmartHawk

11.8

0-day

52 个模型检测该样本为恶意！

重新分析

下载样本

8e3f5fd5bee4accb8b97a189288698796ef58595077f8598725f125c58b70485

669b9ef8e59f63a512c9939dd291f21f.exe

分析耗时

98s

最近分析

文件大小

859.5KB

静态报毒动态报毒 AI SCORE=89 ATTRIBUTE BTU5C8 CONFIDENCE EJPKW ELDORADO EMOC FAREIT FORMBOOK GDSDA GENERICKD GENKRYPTIK HIGH CONFIDENCE HIGHCONFIDENCE HLYDVG IGENT INJECTNET KRYPTIK MALICIOUS PE MALWARE@#1SKCHBRY279P MASSLOGGER PMGQ R340474 SCORE STATIC AI SUSGEN TROJANX UNSAFE WPJV 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee	Fareit-FVA!669B9EF8E59F	20201211	6.0.6.653
Alibaba	Trojan:MSIL/FormBook.cd32e5bd	20190527	0.3.0.5
CrowdStrike	win/malicious_confidence_60% (W)	20190702	1.0
Baidu		20190318	1.0.0.2
Avast	Win32:TrojanX-gen [Trj]	20201210	21.1.5827.0
Kingsoft		20201211	2017.9.26.565
Tencent	Msil.Trojan.Crypt.Wpjv	20201211	1.0.0.1

Queries for the computername (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619610655.26575 GetComputerNameW	computer_name: OSKAR-PC	success	1	0
1619624087.940125 GetComputerNameW	computer_name: OSKAR-PC	success	1	0

Checks if process is being debugged by a debugger (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619610605.76575 IsDebuggerPresent		failed	0	0
1619610605.76575 IsDebuggerPresent		failed	0	0

Command line console output was observed (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619624093.690125 WriteConsoleW	buffer: 成功: 成功创建计划任务 "Updates\JCtTegVXXGGLg"。 console_handle: 0x00000007	success	1	0

This executable has a PDB path (1 个事件)

pdb_path

C:\Users\Administrator\Desktop\Client\Temp\TujOyOvoka\src\obj\x86\Debug\XzqcXBBhZjOz.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619610605.79675 GlobalMemoryStatusEx		success	1	0

Allocates read-write-execute memory (usually to unpack itself) (50 out of 93 个事件)

Time & API	Arguments	Status
1619610604.87475 NtAllocateVirtualMemory	process_identifier: 2344 region_size: 983040 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00610000	success
1619610604.87475 NtAllocateVirtualMemory	process_identifier: 2344 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x006c0000	success
1619610605.51575 NtAllocateVirtualMemory	process_identifier: 2344 region_size: 2228224 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x02400000	success
1619610605.51575 NtAllocateVirtualMemory	process_identifier: 2344 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x025e0000	success
1619610605.56175 NtProtectVirtualMemory	process_identifier: 2344 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73b91000	success
1619610605.76575 NtAllocateVirtualMemory	process_identifier: 2344 region_size: 1703936 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x02240000	success
1619610605.76575 NtAllocateVirtualMemory	process_identifier: 2344 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x023a0000	success
1619610605.78075 NtAllocateVirtualMemory	process_identifier: 2344 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0047a000	success
1619610605.78075 NtProtectVirtualMemory	process_identifier: 2344 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73b92000	success
1619610605.78075 NtAllocateVirtualMemory	process_identifier: 2344 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00472000	success
1619610605.99975 NtAllocateVirtualMemory	process_identifier: 2344 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00482000	success
1619610606.07775 NtAllocateVirtualMemory	process_identifier: 2344 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004a5000	success
1619610606.07775 NtAllocateVirtualMemory	process_identifier: 2344 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004ab000	success
1619610606.07775 NtAllocateVirtualMemory	process_identifier: 2344 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004a7000	success
1619610606.32775 NtAllocateVirtualMemory	process_identifier: 2344 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00483000	success
1619610606.34375 NtAllocateVirtualMemory	process_identifier: 2344 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0048c000	success
1619610606.40575 NtAllocateVirtualMemory	process_identifier: 2344 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00700000	success
1619610606.42175 NtAllocateVirtualMemory	process_identifier: 2344 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00484000	success
1619610606.56175 NtAllocateVirtualMemory	process_identifier: 2344 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00485000	success
1619610606.84375 NtAllocateVirtualMemory	process_identifier: 2344 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00486000	success
1619610606.84375 NtAllocateVirtualMemory	process_identifier: 2344 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00496000	success
1619610606.87475 NtAllocateVirtualMemory	process_identifier: 2344 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00487000	success
1619610606.87475 NtAllocateVirtualMemory	process_identifier: 2344 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00701000	success
1619610606.87475 NtAllocateVirtualMemory	process_identifier: 2344 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0049a000	success
1619610606.87475 NtAllocateVirtualMemory	process_identifier: 2344 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00497000	success
1619610606.93675 NtAllocateVirtualMemory	process_identifier: 2344 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00488000	success
1619610606.95275 NtAllocateVirtualMemory	process_identifier: 2344 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00702000	success
1619610606.96875 NtAllocateVirtualMemory	process_identifier: 2344 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00705000	success
1619610607.29675 NtAllocateVirtualMemory	process_identifier: 2344 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00489000	success
1619610607.35875 NtAllocateVirtualMemory	process_identifier: 2344 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00706000	success
1619610640.43675 NtAllocateVirtualMemory	process_identifier: 2344 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00707000	success
1619610640.49975 NtAllocateVirtualMemory	process_identifier: 2344 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00af0000	success
1619610640.49975 NtAllocateVirtualMemory	process_identifier: 2344 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0048d000	success
1619610640.49975 NtAllocateVirtualMemory	process_identifier: 2344 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00708000	success
1619610640.51575 NtAllocateVirtualMemory	process_identifier: 2344 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00709000	success
1619610640.53075 NtAllocateVirtualMemory	process_identifier: 2344 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0070a000	success
1619610640.53075 NtAllocateVirtualMemory	process_identifier: 2344 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0070b000	success
1619610640.57775 NtAllocateVirtualMemory	process_identifier: 2344 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0070c000	success
1619610640.90575 NtAllocateVirtualMemory	process_identifier: 2344 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x02490000	success
1619610642.87475 NtAllocateVirtualMemory	process_identifier: 2344 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x02491000	success
1619610644.18675 NtAllocateVirtualMemory	process_identifier: 2344 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00af1000	success
1619610644.21875 NtAllocateVirtualMemory	process_identifier: 2344 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x023a1000	success
1619610644.23375 NtAllocateVirtualMemory	process_identifier: 2344 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x023a2000	success
1619610644.24975 NtAllocateVirtualMemory	process_identifier: 2344 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x023a3000	success
1619610644.24975 NtAllocateVirtualMemory	process_identifier: 2344 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x023a4000	success
1619610644.24975 NtAllocateVirtualMemory	process_identifier: 2344 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x023a5000	success
1619610644.24975 NtAllocateVirtualMemory	process_identifier: 2344 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x023a6000	success
1619610644.24975 NtAllocateVirtualMemory	process_identifier: 2344 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x023a7000	success
1619610644.24975 NtAllocateVirtualMemory	process_identifier: 2344 region_size: 69632 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x023ab000	success
1619610644.24975 NtAllocateVirtualMemory	process_identifier: 2344 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x023bc000	success

Creates a suspicious process (2 个事件)

cmdline	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\JCtTegVXXGGLg" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp3E47.tmp"
cmdline	schtasks.exe /Create /TN "Updates\JCtTegVXXGGLg" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp3E47.tmp"

A process created a hidden window (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619610657.10875 ShellExecuteExW	parameters: /Create /TN "Updates\JCtTegVXXGGLg" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp3E47.tmp" filepath: schtasks.exe filepath_r: schtasks.exe show_type: 0	success	1	0

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

7.921426594616941

section

{'size_of_data': '0x000d6400', 'virtual_address': '0x00002000', 'entropy': 7.921426594616941, 'name': '.text', 'virtual_size': '0x000d6330'}

description

A section with a high entropy has been found

entropy

0.9976717112922002

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619610664.45275 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1	0

Terminates another process (10 个事件)

Time & API	Arguments	Status
1619610665.93675 NtTerminateProcess	status_code: 0xffffffff process_identifier: 2516 process_handle: 0x000003bc	failed
1619610665.93675 NtTerminateProcess	status_code: 0xffffffff process_identifier: 2516 process_handle: 0x000003bc	success
1619610665.98375 NtTerminateProcess	status_code: 0xffffffff process_identifier: 2964 process_handle: 0x000003b0	failed
1619610665.98375 NtTerminateProcess	status_code: 0xffffffff process_identifier: 2964 process_handle: 0x000003b0	success
1619610666.01575 NtTerminateProcess	status_code: 0xffffffff process_identifier: 1896 process_handle: 0x000003c8	failed
1619610666.01575 NtTerminateProcess	status_code: 0xffffffff process_identifier: 1896 process_handle: 0x000003c8	success
1619610666.06175 NtTerminateProcess	status_code: 0xffffffff process_identifier: 1988 process_handle: 0x000003dc	failed
1619610666.06175 NtTerminateProcess	status_code: 0xffffffff process_identifier: 1988 process_handle: 0x000003dc	success
1619610666.10875 NtTerminateProcess	status_code: 0xffffffff process_identifier: 1300 process_handle: 0x00000410	failed
1619610666.10875 NtTerminateProcess	status_code: 0xffffffff process_identifier: 1300 process_handle: 0x00000410	success

Uses Windows utilities for basic Windows functionality (2 个事件)

cmdline	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\JCtTegVXXGGLg" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp3E47.tmp"
cmdline	schtasks.exe /Create /TN "Updates\JCtTegVXXGGLg" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp3E47.tmp"

Allocates execute permission to another process indicative of possible code injection (5 个事件)

Time & API	Arguments	Status	Return
1619610664.20275 NtAllocateVirtualMemory	process_identifier: 2516 region_size: 688128 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x000003e0 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496
1619610665.95275 NtAllocateVirtualMemory	process_identifier: 2964 region_size: 688128 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x000003e4 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496
1619610665.98375 NtAllocateVirtualMemory	process_identifier: 1896 region_size: 688128 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x000003b8 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496
1619610666.03075 NtAllocateVirtualMemory	process_identifier: 1988 region_size: 688128 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x000003c0 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496
1619610666.07775 NtAllocateVirtualMemory	process_identifier: 1300 region_size: 688128 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x0000040c allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496

Checks the version of Bios, possibly for anti-virtualization (2 个事件)

registry	HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion
registry	HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion

Detects virtualization software with SCSI Disk Identifier trick(s) (1 个事件)

registry

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0

Deletes executed files from disk (1 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp3E47.tmp

Manipulates memory of a non-child process indicative of process injection (10 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2344 manipulating memory of non-child process 2516
Process injection	Process 2344 manipulating memory of non-child process 2964
Process injection	Process 2344 manipulating memory of non-child process 1896
Process injection	Process 2344 manipulating memory of non-child process 1988
Process injection	Process 2344 manipulating memory of non-child process 1300
1619610664.20275 NtAllocateVirtualMemory	process_identifier: 2516 region_size: 688128 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x000003e0 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496	0
1619610665.95275 NtAllocateVirtualMemory	process_identifier: 2964 region_size: 688128 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x000003e4 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496	0
1619610665.98375 NtAllocateVirtualMemory	process_identifier: 1896 region_size: 688128 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x000003b8 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496	0
1619610666.03075 NtAllocateVirtualMemory	process_identifier: 1988 region_size: 688128 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x000003c0 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496	0
1619610666.07775 NtAllocateVirtualMemory	process_identifier: 1300 region_size: 688128 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x0000040c allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496	0

Detects VirtualBox through the presence of a registry key (1 个事件)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions

Detects VMWare through the presence of a registry key (1 个事件)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\VMware, Inc.\VMware Tools

Detects the presence of Wine emulator (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619610654.78075 LdrGetProcedureAddress	ordinal: 0 module: KERNEL32 module_address: 0x76340000 function_address: 0x002ec80c function_name: wine_get_unix_file_name	failed	3221225785	0

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 个事件)

dead_host

172.217.24.14:443

Executed a process and injected code into it, probably while unpacking (20 个事件)

Time & API	Arguments	Status	Return
1619610605.76575 NtResumeThread	thread_handle: 0x000000d8 suspend_count: 1 process_identifier: 2344	success	0
1619610605.78075 NtResumeThread	thread_handle: 0x00000128 suspend_count: 1 process_identifier: 2344	success	0
1619610605.79675 NtResumeThread	thread_handle: 0x00000164 suspend_count: 1 process_identifier: 2344	success	0
1619610656.18675 NtResumeThread	thread_handle: 0x000002e4 suspend_count: 1 process_identifier: 2344	success	0
1619610657.10875 CreateProcessInternalW	thread_identifier: 1832 thread_handle: 0x000003c8 process_identifier: 1760 current_directory: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp filepath: C:\Windows\System32\schtasks.exe track: 1 command_line: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\JCtTegVXXGGLg" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp3E47.tmp" filepath_r: C:\Windows\System32\schtasks.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) process_handle: 0x0000040c inherit_handles: 0	success	1
1619610664.20275 CreateProcessInternalW	thread_identifier: 2008 thread_handle: 0x000002e8 process_identifier: 2516 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\669b9ef8e59f63a512c9939dd291f21f.exe track: 1 command_line: "{path}" filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\669b9ef8e59f63a512c9939dd291f21f.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x000003e0 inherit_handles: 0	success	1
1619610664.20275 NtGetContextThread	thread_handle: 0x000002e8	success	0
1619610664.20275 NtAllocateVirtualMemory	process_identifier: 2516 region_size: 688128 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x000003e0 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496
1619610665.95275 CreateProcessInternalW	thread_identifier: 2184 thread_handle: 0x000003bc process_identifier: 2964 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\669b9ef8e59f63a512c9939dd291f21f.exe track: 1 command_line: "{path}" filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\669b9ef8e59f63a512c9939dd291f21f.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x000003e4 inherit_handles: 0	success	1
1619610665.95275 NtGetContextThread	thread_handle: 0x000003bc	success	0
1619610665.95275 NtAllocateVirtualMemory	process_identifier: 2964 region_size: 688128 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x000003e4 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496
1619610665.98375 CreateProcessInternalW	thread_identifier: 1876 thread_handle: 0x000003b0 process_identifier: 1896 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\669b9ef8e59f63a512c9939dd291f21f.exe track: 1 command_line: "{path}" filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\669b9ef8e59f63a512c9939dd291f21f.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x000003b8 inherit_handles: 0	success	1
1619610665.98375 NtGetContextThread	thread_handle: 0x000003b0	success	0
1619610665.98375 NtAllocateVirtualMemory	process_identifier: 1896 region_size: 688128 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x000003b8 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496
1619610666.03075 CreateProcessInternalW	thread_identifier: 2576 thread_handle: 0x000003c8 process_identifier: 1988 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\669b9ef8e59f63a512c9939dd291f21f.exe track: 1 command_line: "{path}" filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\669b9ef8e59f63a512c9939dd291f21f.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x000003c0 inherit_handles: 0	success	1
1619610666.03075 NtGetContextThread	thread_handle: 0x000003c8	success	0
1619610666.03075 NtAllocateVirtualMemory	process_identifier: 1988 region_size: 688128 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x000003c0 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496
1619610666.07775 CreateProcessInternalW	thread_identifier: 2364 thread_handle: 0x000003dc process_identifier: 1300 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\669b9ef8e59f63a512c9939dd291f21f.exe track: 1 command_line: "{path}" filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\669b9ef8e59f63a512c9939dd291f21f.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x0000040c inherit_handles: 0	success	1
1619610666.07775 NtGetContextThread	thread_handle: 0x000003dc	success	0
1619610666.07775 NtAllocateVirtualMemory	process_identifier: 1300 region_size: 688128 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x0000040c allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496

File has been identified by 52 AntiVirus engines on VirusTotal as malicious (50 out of 52 个事件)

Elastic	malicious (high confidence)
ClamAV	Win.Trojan.Agent-8069585-0
FireEye	Trojan.GenericKD.34027117
CAT-QuickHeal	Trojan.MSIL
Qihoo-360	Generic/Trojan.21a
McAfee	Fareit-FVA!669B9EF8E59F
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
Sangfor	Malware
K7AntiVirus	Trojan ( 00568cec1 )
Alibaba	Trojan:MSIL/FormBook.cd32e5bd
K7GW	Trojan ( 00568cec1 )
CrowdStrike	win/malicious_confidence_60% (W)
Arcabit	Trojan.Generic.D207366D
Cyren	W32/MSIL_Agent.BKB.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Avast	Win32:TrojanX-gen [Trj]
Cynet	Malicious (score: 100)
Kaspersky	HEUR:Trojan.MSIL.Crypt.gen
BitDefender	Trojan.GenericKD.34027117
NANO-Antivirus	Trojan.Win32.InjectNET.hlydvg
Paloalto	generic.ml
MicroWorld-eScan	Trojan.GenericKD.34027117
Ad-Aware	Trojan.GenericKD.34027117
Sophos	Mal/Generic-S
Comodo	Malware@#1skchbry279p
F-Secure	Trojan.TR/Kryptik.ejpkw
DrWeb	Trojan.InjectNET.14
McAfee-GW-Edition	Fareit-FVA!669B9EF8E59F
Emsisoft	Trojan.GenericKD.34027117 (B)
SentinelOne	Static AI - Malicious PE
Jiangmin	Trojan.MSIL.pmgq
Avira	TR/Kryptik.ejpkw
Antiy-AVL	Trojan/MSIL.Crypt
Microsoft	Trojan:MSIL/FormBook.CT!MTB
AegisLab	Trojan.Multi.Generic.4!c
ZoneAlarm	HEUR:Trojan.MSIL.Crypt.gen
GData	Trojan.GenericKD.34027117
AhnLab-V3	Trojan/Win32.Kryptik.R340474
ALYac	Trojan.GenericKD.34027117
MAX	malware (ai score=89)
Malwarebytes	Trojan.Crypt.MSIL
ESET-NOD32	a variant of MSIL/Kryptik.WIO
Tencent	Msil.Trojan.Crypt.Wpjv
Yandex	Trojan.Igent.bTU5c8.58
Ikarus	Trojan-Spy.MassLogger
eGambit	Unsafe.AI_Score_99%
Fortinet	MSIL/GenKryptik.EMOC!tr
AVG	Win32:TrojanX-gen [Trj]

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-06-15 15:13:49

Imports

Library mscoree.dll:

• 0x402000 _CorExeMain

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
clients2.google.com	A 172.217.24.14 CNAME clients.l.google.com	172.217.160.78
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	50534	114.114.114.114	53
192.168.56.101	51963	114.114.114.114	53
192.168.56.101	55368	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	60384	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	49713	224.0.0.252	5355
192.168.56.101	51378	224.0.0.252	5355
192.168.56.101	51808	224.0.0.252	5355
192.168.56.101	53237	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355
192.168.56.101	61680	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	62318	224.0.0.252	5355
192.168.56.101	65004	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	51379	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.