SmartHawk

2.5

中危

67 个模型检测该样本为恶意！

重新分析

下载样本

b0e818212b3f4c197632f629c55a8450d7f11b883674f98968a8035d9964edd0

b0e818212b3f4c197632f629c55a8450d7f11b883674f98968a8035d9964edd0.exe

分析耗时

14s

最近分析

392天前

文件大小

32.0KB

静态报毒动态报毒 CVE FAMILY METATYPE PLATFORM TYPE UNKNOWN WIN32 TROJAN DOWNLOADER

DACN 0.14

FACILE 1.00

IMCLNet 0.62

MFGraph 0.00

引擎	描述	特征	威胁分数	可能家族	检测耗时
DACN	基于动态分析和胶囊网络的可视化恶意软件检测	API调用、DLL以及注册表的修改情况	0.14	Unknown	0.04s
FACILE	利用改进的层次胶囊网络对二进制恶意软件图像进行识别分类	二进制图像映射为的灰度图像	1.00	Unknown	0.03s
IMCLNet	轻量化深度卷积网络模型实现恶意软件家族检测	原始二进制映射而成的可视化图像	0.62	Unknown	0.15s
MFGraph	利用静态特征构建图网络以检测恶意软件	原始二进制PE文件的静态特征节点	0.00	Unknown	0.00s

查杀引擎	查杀结果	查杀时间	查杀版本
Alibaba	VirTool:Win32/CeeInject.54281102	20190527	0.3.0.5
Avast	Win32:DropperX-gen [Drp]	20240708	23.9.8494.0
Baidu	Win32.Trojan.Inject.bm	20190318	1.0.0.2
CrowdStrike	win/malicious_confidence_100% (D)	20231026	1.0
Kingsoft	malware.kb.a.1000	20230906	None
McAfee	Downloader-BIJ.a	20240707	6.0.6.653
Tencent	Trojan.Win32.Miancha.za	20240708	1.0.0.1

观察到命令行控制台输出 (11 个事件)

Time & API	Arguments	Status	Return
1727110794.328 WriteConsoleW	console_handle: 0x00000007 buffer: C:\Users\Administrator\AppData\Local\Temp>	success	1
1727110794.328 WriteConsoleW	console_handle: 0x00000007 buffer: del	success	1
1727110794.328 WriteConsoleW	console_handle: 0x00000007 buffer: "C:\Users\Administrator\AppData\Local\SharedAccess.exe" /a	success	1
1727110794.328 WriteConsoleW	console_handle: 0x00000007 buffer: C:\Users\Administrator\AppData\Local\Temp>	success	1
1727110794.328 WriteConsoleW	console_handle: 0x00000007 buffer: move	success	1
1727110794.328 WriteConsoleW	console_handle: 0x00000007 buffer: "C:\Users\Administrator\AppData\Local\SharedAccess.exe.tmp1" "C:\Users\Administrator\AppData\Local\SharedAccess.exe"	success	1
1727110794.344 WriteConsoleW	console_handle: 0x00000007 buffer: 移动了 1 个文件。	success	1
1727110794.344 WriteConsoleW	console_handle: 0x00000007 buffer: C:\Users\Administrator\AppData\Local\Temp>	success	1
1727110794.344 WriteConsoleW	console_handle: 0x00000007 buffer: del	success	1
1727110794.344 WriteConsoleW	console_handle: 0x00000007 buffer: a.bat	success	1
1727110794.344 WriteConsoleW	console_handle: 0x0000000b buffer: 找不到批处理文件。	success	1

一个或多个进程崩溃 (3 个事件)

Time & API	Arguments	Status
1727110792.8915 __exception__	exception.address: 0x402133 exception.instruction: xor byte ptr [ecx], al exception.instruction_r: 30 01 ff 45 fc 8b 45 fc 3b 45 10 7c ad 5f 5e 5b exception.symbol: szFile-0x210d b0e818212b3f4c197632f629c55a8450d7f11b883674f98968a8035d9964edd0+0x2133 exception.exception_code: 0xc0000005 registers.eax: 243 registers.ecx: 4214964 registers.edx: 133 registers.ebx: 256 registers.esp: 1637600 registers.ebp: 1637624 registers.esi: 1637976 registers.edi: 256 stacktrace: szFile-0x2fc6 b0e818212b3f4c197632f629c55a8450d7f11b883674f98968a8035d9964edd0+0x127a @ 0x40127a BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76ee33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x775b9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x775b9ea5	success
1727110792.8915 __exception__	exception.address: 0x402133 exception.instruction: xor byte ptr [ecx], al exception.instruction_r: 30 01 ff 45 fc 8b 45 fc 3b 45 10 7c ad 5f 5e 5b exception.symbol: szFile-0x210d b0e818212b3f4c197632f629c55a8450d7f11b883674f98968a8035d9964edd0+0x2133 exception.exception_code: 0xc0000005 registers.eax: 237 registers.ecx: 4218880 registers.edx: 145 registers.ebx: 256 registers.esp: 1637600 registers.ebp: 1637624 registers.esi: 1637976 registers.edi: 256 stacktrace: szFile-0x2fc6 b0e818212b3f4c197632f629c55a8450d7f11b883674f98968a8035d9964edd0+0x127a @ 0x40127a BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76ee33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x775b9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x775b9ea5	success
1727110792.8915 __exception__	exception.address: 0x402133 exception.instruction: xor byte ptr [ecx], al exception.instruction_r: 30 01 ff 45 fc 8b 45 fc 3b 45 10 7c ad 5f 5e 5b exception.symbol: szFile-0x210d b0e818212b3f4c197632f629c55a8450d7f11b883674f98968a8035d9964edd0+0x2133 exception.exception_code: 0xc0000005 registers.eax: 106 registers.ecx: 4222976 registers.edx: 162 registers.ebx: 256 registers.esp: 1637600 registers.ebp: 1637624 registers.esi: 1637976 registers.edi: 256 stacktrace: szFile-0x2fc6 b0e818212b3f4c197632f629c55a8450d7f11b883674f98968a8035d9964edd0+0x127a @ 0x40127a BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76ee33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x775b9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x775b9ea5	success

分配可读-可写-可执行内存（通常用于自解压） (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1727110792.8915 NtProtectVirtualMemory	process_handle: 0xffffffff base_address: 0x00400000 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_identifier: 1860	success	0	0
1727110792.8915 NtProtectVirtualMemory	process_handle: 0xffffffff base_address: 0x72591000 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_identifier: 1860	success	0	0

在文件系统上创建可执行文件 (2 个事件)

file	C:\Users\Administrator\AppData\Local\Temp\a.bat
file	C:\Users\Administrator\AppData\Local\Temp\~dfds3.reg

将可执行文件投放到用户的 AppData 文件夹 (1 个事件)

file	C:\Users\Administrator\AppData\Local\SharedAccess.exe

该二进制文件可能包含加密或压缩数据，表明使用了打包工具 (2 个事件)

section

{'name': '.rsrc', 'virtual_address': '0x00005000', 'virtual_size': '0x00002cc4', 'size_of_data': '0x00003000', 'entropy': 7.739968478319286}

entropy

7.739968478319286

description

发现高熵的节

entropy

0.42857142857142855

description

此PE文件的整体熵值较高

与未执行 DNS 查询的主机进行通信 (1 个事件)

host

114.114.114.114

枚举服务，可能用于反虚拟化 (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1727110792.8915 EnumServicesStatusA	service_handle: 0x008647a0 service_type: 48 service_status: 2	success	1	0

在 Windows 启动时自我安装以实现自动运行 (1 个事件)

reg_key

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\SharedAccess

reg_value

C:\Users\Administrator\AppData\Local\SharedAccess.exe

文件已被 VirusTotal 上 67 个反病毒引擎识别为恶意 (50 out of 67 个事件)

ALYac	Trojan.Agent.GBXM
APEX	Malicious
AVG	Win32:DropperX-gen [Drp]
Acronis	suspicious
AhnLab-V3	Backdoor/Win32.CSon.R885
Alibaba	VirTool:Win32/CeeInject.54281102
Antiy-AVL	Trojan[Downloader]/Win32.Rubinurd.b
Arcabit	Trojan.Agent.GBXM
Avast	Win32:DropperX-gen [Drp]
Avira	TR/Dropper.Gen
Baidu	Win32.Trojan.Inject.bm
BitDefender	Trojan.Agent.GBXM
BitDefenderTheta	AI:Packer.54A3CF691F
Bkav	W32.AIDetectMalware
CAT-QuickHeal	Trojan.Mauvaise.SL1
ClamAV	Win.Downloader.Kazy-6804111-0
CrowdStrike	win/malicious_confidence_100% (D)
Cybereason	malicious.e6a926
Cylance	Unsafe
Cynet	Malicious (score: 100)
DeepInstinct	MALICIOUS
DrWeb	Win32.HLLW.Autoruner.27746
ESET-NOD32	Win32/TrojanDownloader.Agent.PTT
Elastic	malicious (high confidence)
Emsisoft	Trojan.Agent.GBXM (B)
F-Secure	Trojan.TR/Dropper.Gen
FireEye	Generic.mg.68ef62ce6a926f66
Fortinet	W32/Injector.BFSU!tr
GData	Win32.Trojan.Agent.ASM
Google	Detected
Ikarus	SuspectFile
Jiangmin	TrojanDownloader.Small.akba
K7AntiVirus	Trojan-Downloader ( 0040f54b1 )
K7GW	Trojan-Downloader ( 000918cf1 )
Kaspersky	HEUR:Trojan.Win32.Miancha.gen
Kingsoft	malware.kb.a.1000
Lionic	Trojan.Win32.Generic.lk0q
MAX	malware (ai score=87)
Malwarebytes	Generic.Malware.AI.DDS
MaxSecure	Trojan.Downloader.Rubinurd.bf
McAfee	Downloader-BIJ.a
McAfeeD	Real Protect-LS!68EF62CE6A92
MicroWorld-eScan	Trojan.Agent.GBXM
Microsoft	Trojan:Win32/Injector.ARA!MTB
NANO-Antivirus	Trojan.Win32.Autoruner.bbwavd
Paloalto	generic.ml
Panda	Trj/Genetic.gen
Rising	Trojan.Injector!1.A7C6 (CLASSIC)
Sangfor	Trojan.Win32.Save.a
Skyhigh	BehavesLike.Win32.Generic.nm

288x288

224x224

192x192

160x160

128x128

96x96

64x64

32x32

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2010-09-07 10:27:10

PE Imphash

f54bab47f74e370cf85ce98d899e8149

Sections

Name	Virtual Address	Virtual Size	Size of Raw Data	Entropy
.text	0x00001000	0x00001755	0x00002000	5.851955980735015
.rdata	0x00003000	0x000005a5	0x00001000	2.233959569513802
.data	0x00004000	0x00000593	0x00001000	1.1476625760781263
.rsrc	0x00005000	0x00002cc4	0x00003000	7.739968478319286

Resources

Name	Offset	Size	Language	Sub-language	File type
RT_RCDATA	0x000050b4	0x00002800	LANG_ENGLISH	SUBLANG_ENGLISH_US	None
RT_VERSION	0x000078b4	0x00000410	LANG_ENGLISH	SUBLANG_ENGLISH_US	None

Imports

Library KERNEL32.dll:

• 0x40301c ExitProcess

• 0x403020 ReadFile

• 0x403024 HeapAlloc

• 0x403028 GetProcessHeap

• 0x40302c GetFileSize

• 0x403030 CopyFileA

• 0x403034 GetModuleFileNameA

• 0x403038 LeaveCriticalSection

• 0x40303c GetProcAddress

• 0x403040 EnterCriticalSection

• 0x403044 VirtualProtect

• 0x403048 InitializeCriticalSection

• 0x40304c GetModuleHandleA

• 0x403050 LockResource

• 0x403054 LoadResource

• 0x403058 SetFilePointer

• 0x40305c FindResourceA

• 0x403060 GetLastError

• 0x403064 MoveFileA

• 0x403068 DeleteFileA

• 0x40306c lstrcmpiA

• 0x403070 GetLongPathNameA

• 0x403074 ExpandEnvironmentStringsA

• 0x403078 GetTickCount

• 0x40307c OutputDebugStringA

• 0x403080 lstrlenA

• 0x403084 TerminateProcess

• 0x403088 VirtualAllocEx

• 0x40308c HeapFree

• 0x403090 VirtualAlloc

• 0x403094 Sleep

• 0x403098 lstrcpyA

• 0x40309c lstrcatA

• 0x4030a0 CreateFileA

• 0x4030a4 WriteFile

• 0x4030a8 CloseHandle

• 0x4030ac SizeofResource

• 0x4030b0 WinExec

Library USER32.dll:

• 0x4030c4 wsprintfA

• 0x4030c8 MessageBoxA

Library ADVAPI32.dll:

• 0x403000 CloseServiceHandle

• 0x403004 CryptGenRandom

• 0x403008 CryptReleaseContext

• 0x40300c EnumServicesStatusA

• 0x403010 OpenSCManagerA

• 0x403014 CryptAcquireContextA

Library SHLWAPI.dll:

• 0x4030b8 PathRemoveFileSpecA

• 0x4030bc StrChrA

Exports

Ordinal	Address	Name
1	0x404240	szFile

L!This program cannot be run in DOS mode.
.rdata
@.data
3fj@3Yu
tESPh
SVWj@3Y3j?fY3f^
EPEPhL@@
MSQEuPV
YYPV5X0@
ESPuW=0@
ESPuh$
ESPuh/
ESPuhl
;t$uuh
jfhL@@
_^3[UQQe
H<EHC@
X^UQQV5
WEWP}}
;t'EPEPEPh
3?;3j u
A(;r3_^[
8Xr($zSC
RC[|_b
7$ha5IY'up&
3@2CG9w
IsCBEO9R
-oHGg\
'rLSBW-5
K1^WRS_%
Z|QH,I
A&Ab)M
]qiH*hH,fs>
Z_seY(xij
fq>BlC
sKQ:<MpyiDirp5=b9
jIBZrHs
;3],7BO
<8/B,Jou
/7xU|;B
&%x=2|h
wYsg6dnI;Th
f*>bq`>
qC?~X<8
#yUSVu
|_^[]UE
t1P7^pUis
8H3H3)Sy#fTGDPD7i[tm&'Q
;N"Iy5KgIGI
}a){^WVD=|
Mr_z@26O%
ji'v?z
ye[f!76^
Y\v(|2Xn^z<9gz6[0.-U
4C&i]o[XK"h
W5v/%J
8&^R+0;RsW4gQ?
z[jKDc("C
f?>Ig>XY# 
h0`*{U;
EE~cSVu
3fj@3Yj@fY3fj@3Yu
]f]@~)M
GEQ@9E|
3tESPPPPu
uRFGHt
t+t'NW8u
;uH_^Q=
r)$h%@
DDDDDDDDDDDDDD
WinExec
CloseHandle
WriteFile
CreateFileA
lstrcatA
lstrcpyA
SetFilePointer
ExitProcess
ReadFile
HeapAlloc
GetProcessHeap
GetFileSize
CopyFileA
GetModuleFileNameA
LeaveCriticalSection
GetProcAddress
EnterCriticalSection
VirtualProtect
InitializeCriticalSection
GetModuleHandleA
LockResource
LoadResource
SizeofResource
FindResourceA
GetLastError
MoveFileA
DeleteFileA
lstrcmpiA
GetLongPathNameA
ExpandEnvironmentStringsA
GetTickCount
OutputDebugStringA
lstrlenA
TerminateProcess
VirtualAllocEx
HeapFree
VirtualAlloc
KERNEL32.dll
wsprintfA
MessageBoxA
USER32.dll
CryptReleaseContext
CryptGenRandom
CryptAcquireContextA
CloseServiceHandle
EnumServicesStatusA
OpenSCManagerA
ADVAPI32.dll
StrChrA
PathRemoveFileSpecA
SHLWAPI.dll
roudanx.exe
szFile
del "%s" /a
move "%s" "%s"
del %%0
rwbinru/dyd
RT_RCDATA
EndUpdateResourceA
UpdateResourceA
BeginUpdateResourceA
kernel32
szFile
ResumeThread
SetThreadContext
WriteProcessMemory
VirtualProtectEx
VirtualQueryEx
ReadProcessMemory
GetThreadContext
CreateProcessA
ZwUnmapViewOfSection
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
WinHttp
Are you sure?
regedit.exe /s 
~dfds3.reg
%tmp%\
Windows Registry Editor Version 5.00
"%s"="%s"
\EQ3Z.=4w9b
ai@3bdJ/=>.,/<h@
1O&9.Tg
G~(dy-A
Dp AH$;g*
4^DDV~P4&:
^3ll[kC{r1yJ?
|fx[m!f
me+f{GR
;X6|{8Y
G<?MQI$
(aQ@kH8%/
Z*SwU+4/%2Q)8tQD-3%4GVe
U1Uf&k
j:Vn:f9V
nA~$I
u:0DP, I
s)#);@p)W3
F3(@"9
{N!AkF4|F
WX!lP;llnAq
r0o))4'4_
&(=:"w
8}W.F.%
CQm-S#;
k/kILAzw
nBFC<stu
ol*NK4
d/.O~JZi
GX(0CaSv . 
$6J[bM#|~
'6$0RN+fH0"[N\
~-\tPQ"{TD
%DY%tUb
T4lOG5QO3}0av;
:9Dc6UB@!|P
gwJ>SRZ<Ty
@m,}R:
C\e F=h
^7%<z.o
%oO6tT
zwCYk>
.)K{R1.MTTeZJ
MiB$UA
4Pp;[!U
IJy[M0EQ
VN(;Lxs#
VK.J-#
Mm%(s6
8+e"eD'
 U{xT=
O,Xdh@c
))I,wf-tHtC2>M
*.~;,b
j2AW%Zt
`Q6/si
*P\&Y|uu^uNdLP-
g/#%`S
dM6&?,k57gF\t
T']9Um
jZ8b6]
3/]v<2
P(2pbuH7w6K|}tZVwyy"
LLLm0aJ{P@c1
OG+-SchLH4[
C=hU-\h
UVuuyS2Z"
+dN`I%
Xr% nq7
I$cB\(
Z\ }` >v~.83-(_/"dxA&~-~0+|d
EuD!^iI
dkKRSoEK
h-(HY1Y2-
_MzJw_
S%$v%fq_
rhH(P4
;8fJfaZ:@:
VRGTS##e-8xN
Socmrj3X5
o?0w-P
Y4V$o+dm`S;`('Na
L8?'+C
;LDt>q
=|fq2`8p'4
H=ZutS
WXE4n"9b*`
-/JPi|
UD_3$y
O%fLiK
ea`gY2
Rg;HHRu2
!#D!6Y
T3+*8 
3Z["*bm
;U#m%AX
lal4,n;{2
:]Wsd Bi
|c<xUC
Z(MZzo $G
eX [oC
4s\z"/~I=bQUyNs
)M# a[
`ou%[,7/
\nl,b%cSR"
LM,={/
reW,LHVG
U5Z{mZ
'}qr1S7g#k`\,
_mkyT@`,:F
1XfJD611s'
ag}$DS=
v.zD#c
|ky&Er
zOD$F7
OPet^t
eFjH*bn-IE_34<S
nODaUcHC|0sq]
a:qe.%
Ccd"14
D}6cm!-
Bo#UN#4-R3GIsr
 >:'2X8
NNRi_`
>Vh~i|Od
c&_Qyy0/P
-s&{s)U+
"<X?ai_
yy+AAo
aZDa;AIT
`34oXfo/
<oTy:VcG
HKucO|
W6B7W'pUFq1doQZoK
,k3xf&
}D]EU11iMZ
2Vk.si
HW7.,on?
S5t4JL6M[
caITO"p
4.ITYFv
O>)%t`Gy
O\ND<\w
Vx<GlE9f`
~#g{}"3N
ezb|v
T/IN4
_Z5M:e7
!Hw,u
;^#JExhWjoDOc"C
M#+3k,tWD
<}'%'FU>
Un|:T>'npVx$C.GFIr.pL,1
VrNi@;Bz
gK)gJnnAV)3l
;|ca^0
YUUHh{
Zx08\&%fAo
I#-1[kX#
g,Ao5"
2#^2RL
Yk{]2Q(ZM|bRf!kE
&.'\]3&
yC]"yZ'
~$dI(H*]
aS@&x$
}Tsdcv[l
%5pl'h
^3nms4
|oGs+Zop;
6?9q[TO
`I~qEd/
b*mt%1F-B
'RTj~a- L#e
Z^:ewPS
-jA2(Mc
EEWj`NXBFMy
DqT2/N
Y+|"W/
+p_i}~
2Lf<bP3%Nm5'
"80BlptD$
|.vyux[!
=uL}t9)8
#9v9nU0
0Z!2=O
4fAr%z
>Aw>e``07
S&/5RH'oic
oWK{n!N7V
wJP51JK
q!?!Km2]
+6)SKtEgU
ZD*m>F6=R5VB
&|Li2h!Q{JW
2=+i>kSXpKJH`?Y
PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPAD
RT_RCDATA
VS_VERSION_INFO
StringFileInfo
040904b0
CompanyName
Adobe Systems, Inc.
FileDescription
Adobe? Flash? Player Installer/Uninstaller 10.1 r53
FileVersion
10,1,53,64
InternalName
Adobe? Flash? Player Installer/Uninstaller 10.1
LegalCopyright
Copyright ? 1996-2010 Adobe, Inc.
LegalTrademarks
Adobe? Flash? Player
OriginalFilename
FlashUtil.exe
ProductName
Flash? Player Installer/Uninstaller
ProductVersion
10,1,53,64
VarFileInfo
Translation

Process Tree

b0e818212b3f4c197632f629c55a8450d7f11b883674f98968a8035d9964edd0.exe (1860) "C:\Users\Administrator\AppData\Local\Temp\b0e818212b3f4c197632f629c55a8450d7f11b883674f98968a8035d9964edd0.exe"
- regedit.exe (1856) regedit.exe /s C:\Users\ADMINI~1\AppData\Local\Temp\~dfds3.reg
- cmd.exe (600) cmd /c a.bat

b0e818212b3f4c197632f629c55a8450d7f11b883674f98968a8035d9964edd0.exe, PID: 1860, Parent PID: 928

default registry file network process services synchronisation iexplore office pdf

regedit.exe, PID: 1856, Parent PID: 1860

default registry file network process services synchronisation iexplore office pdf

cmd.exe, PID: 600, Parent PID: 1860

default registry file network process services synchronisation iexplore office pdf

Hosts

IP
114.114.114.114

DNS

Name	Response	Post-Analysis Lookup
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	53179	224.0.0.252	5355
192.168.56.101	49642	224.0.0.252	5355
192.168.56.101	137	192.168.56.255	137
192.168.56.101	61714	114.114.114.114	53
192.168.56.101	56933	114.114.114.114	53

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Name	b5543fd1968e1ef7_sharedaccess.exe
Filepath	c:\users\administrator\appdata\local\sharedaccess.exe
Size	32.0KB
Processes	1860 (b0e818212b3f4c197632f629c55a8450d7f11b883674f98968a8035d9964edd0.exe) 600 (cmd.exe)
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`f83133b20790ec13345558994c68b5e2`
SHA1	`3aa3bc5d9bc7037e60d75e0a3e9cd9368e0cd379`
SHA256	`b5543fd1968e1ef7b112ca6f369fff6e03e537fd9df3a8a8f8a8b4807a492eeb`
CRC32	`6C358BE8`
ssdeep	`None`
Yara	None matched
VirusTotal	Search for analysis

Name	b0e818212b3f4c19_SharedAccess.exe
Filepath	C:\Users\Administrator\AppData\Local\SharedAccess.exe
Size	32.0KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`68ef62ce6a926f662dd1ac1d71aebd2b`
SHA1	`ad72d9971cd8163e28ab2469e7f2867a6ee12776`
SHA256	`b0e818212b3f4c197632f629c55a8450d7f11b883674f98968a8035d9964edd0`
CRC32	`4708B894`
ssdeep	`None`
Yara	None matched
VirusTotal	Search for analysis

Name	7acaedac1f2d5864_a.bat
Filepath	C:\Users\Administrator\AppData\Local\Temp\a.bat
Size	1.0KB
Processes	1860 (b0e818212b3f4c197632f629c55a8450d7f11b883674f98968a8035d9964edd0.exe) 600 (cmd.exe)
Type	data
MD5	`dfd3d176435ec0f226ea71f766108be5`
SHA1	`cd42f5d8aa3254a28d4e67eae0ba6e5a62b1d70a`
SHA256	`7acaedac1f2d5864f3a270813976ddc750648da836edb84c46abb858150f4595`
CRC32	`7391C5DF`
ssdeep	`None`
Yara	None matched
VirusTotal	Search for analysis

Sorry! No dropped buffers.