9.2
极危
48 个模型检测该样本为恶意！
重新分析
更多

70d86fc8d1247dcd26ed0927411614973d45216d676978f768e14cb16d362536

6d9e487ea1469c940f2533324beead56.exe

分析耗时

101s

最近分析

文件大小

2.3MB
静态报毒 动态报毒 100% AGEN AGENERIC AI SCORE=82 AIDETECTVM CONFIDENCE ENIGMA GEN@24TBUS GENERICRXJO HIGH CONFIDENCE LXNP MALWARE1 MUPX PACK QVM11 R266317 RARMAL RASFTUBY S + MAL SCORE TATRIO UNSAFE VASAL WSAW YMACCO 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee GenericRXJO-BH!6D9E487EA146 20201211 6.0.6.653
Alibaba Packed:Win32/Enigma.0c797c92 20190527 0.3.0.5
Avast Win32:Malware-gen 20201210 21.1.5827.0
Tencent Win32.Trojan.Generic.Wsaw 20201211 1.0.0.1
Baidu 20190318 1.0.0.2
Kingsoft 20201211 2017.9.26.565
CrowdStrike win/malicious_confidence_90% (W) 20190702 1.0
静态指标
Queries for the computername (1 个事件)
Time & API Arguments Status Return Repeated
1619599991.253896
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
Checks if process is being debugged by a debugger (2 个事件)
Time & API Arguments Status Return Repeated
1619599979.097896
IsDebuggerPresent
failed 0 0
1619599979.112896
IsDebuggerPresent
failed 0 0
Command line console output was observed (7 个事件)
Time & API Arguments Status Return Repeated
1619600406.172
WriteConsoleW
buffer: C:\Users\Administrator.Oskar-PC\AppData\Roaming\WindUpd>
console_handle: 0x00000007
success 1 0
1619600406.187
WriteConsoleW
buffer: copy
console_handle: 0x00000007
success 1 0
1619600406.187
WriteConsoleW
buffer: System.lnk "C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\"
console_handle: 0x00000007
success 1 0
1619600406.203
WriteConsoleW
buffer: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\WindUpd\win_update.exe"
console_handle: 0x00000007
success 1 0
1619600406.25
WriteConsoleW
buffer: reg
console_handle: 0x00000007
success 1 0
1619600406.265
WriteConsoleW
buffer: add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
console_handle: 0x00000007
success 1 0
1619600406.328
WriteConsoleW
buffer: 已复制 1 个文件。
console_handle: 0x00000007
success 1 0
Uses Windows APIs to generate a cryptographic key (3 个事件)
Time & API Arguments Status Return Repeated
1619599998.440896
CryptExportKey
crypto_handle: 0x000000001bb6e6e0
crypto_export_handle: 0x0000000000000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619599998.456896
CryptExportKey
crypto_handle: 0x000000001bb6e6e0
crypto_export_handle: 0x0000000000000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619599998.643896
CryptExportKey
crypto_handle: 0x000000001bb6e750
crypto_export_handle: 0x0000000000000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)
Time & API Arguments Status Return Repeated
1619599979.190896
GlobalMemoryStatusEx
success 1 0
The executable contains unknown PE section names indicative of a packer (could be a false positive) (2 个事件)
section .enigma1
section .enigma2
The file contains an unknown PE resource name possibly indicative of a packer (1 个事件)
resource name PNG
行为判定
动态指标
Allocates read-write-execute memory (usually to unpack itself) (50 out of 195 个事件)
Time & API Arguments Status Return Repeated
1619600014.190644
NtAllocateVirtualMemory
process_identifier: 1424
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00000000041f0000
success 0 0
1619599978.003896
NtAllocateVirtualMemory
process_identifier: 3692
region_size: 1900544
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x0000000000820000
success 0 0
1619599978.003896
NtAllocateVirtualMemory
process_identifier: 3692
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0000000000970000
success 0 0
1619599978.472896
NtAllocateVirtualMemory
process_identifier: 3692
region_size: 2490368
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x0000000000d40000
success 0 0
1619599978.472896
NtAllocateVirtualMemory
process_identifier: 3692
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0000000000f20000
success 0 0
1619599978.534896
NtProtectVirtualMemory
process_identifier: 3692
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
base_address: 0x000007fef19b1000
success 0 0
1619599978.550896
NtProtectVirtualMemory
process_identifier: 3692
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
base_address: 0x000007fef19b1000
success 0 0
1619599978.581896
NtProtectVirtualMemory
process_identifier: 3692
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
base_address: 0x000007fef2030000
success 0 0
1619599979.081896
NtAllocateVirtualMemory
process_identifier: 3692
region_size: 1900544
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x0000000000d40000
success 0 0
1619599979.081896
NtAllocateVirtualMemory
process_identifier: 3692
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0000000000e90000
success 0 0
1619599979.143896
NtProtectVirtualMemory
process_identifier: 3692
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
base_address: 0x000007fef19b2000
success 0 0
1619599979.143896
NtProtectVirtualMemory
process_identifier: 3692
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
base_address: 0x000007fef19b2000
success 0 0
1619599979.143896
NtProtectVirtualMemory
process_identifier: 3692
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
base_address: 0x000007fef19b2000
success 0 0
1619599979.143896
NtProtectVirtualMemory
process_identifier: 3692
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
base_address: 0x000007fef19b2000
success 0 0
1619599979.143896
NtProtectVirtualMemory
process_identifier: 3692
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
base_address: 0x000007fef19b2000
success 0 0
1619599979.143896
NtProtectVirtualMemory
process_identifier: 3692
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
base_address: 0x000007fef19b3000
success 0 0
1619599979.143896
NtProtectVirtualMemory
process_identifier: 3692
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
base_address: 0x000007fef19b3000
success 0 0
1619599979.143896
NtProtectVirtualMemory
process_identifier: 3692
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
base_address: 0x000007fef19b3000
success 0 0
1619599979.143896
NtProtectVirtualMemory
process_identifier: 3692
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
base_address: 0x000007fef19b3000
success 0 0
1619599979.143896
NtProtectVirtualMemory
process_identifier: 3692
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
base_address: 0x000007fef19b3000
success 0 0
1619599979.143896
NtProtectVirtualMemory
process_identifier: 3692
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
base_address: 0x000007fef19b3000
success 0 0
1619599979.143896
NtProtectVirtualMemory
process_identifier: 3692
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
base_address: 0x000007fef19b3000
success 0 0
1619599979.143896
NtProtectVirtualMemory
process_identifier: 3692
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
base_address: 0x000007fef19b1000
success 0 0
1619599979.143896
NtProtectVirtualMemory
process_identifier: 3692
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
base_address: 0x000007fef19b2000
success 0 0
1619599979.159896
NtProtectVirtualMemory
process_identifier: 3692
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
base_address: 0x000007fef19b2000
success 0 0
1619599979.159896
NtProtectVirtualMemory
process_identifier: 3692
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
base_address: 0x000007fef19b2000
success 0 0
1619599979.159896
NtProtectVirtualMemory
process_identifier: 3692
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
base_address: 0x000007fef19b2000
success 0 0
1619599979.159896
NtProtectVirtualMemory
process_identifier: 3692
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
base_address: 0x000007fef19b2000
success 0 0
1619599979.628896
NtAllocateVirtualMemory
process_identifier: 3692
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x000007ff00032000
success 0 0
1619599979.659896
NtAllocateVirtualMemory
process_identifier: 3692
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x000007ff00022000
success 0 0
1619599980.831896
NtAllocateVirtualMemory
process_identifier: 3692
region_size: 655360
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 1056768 (MEM_RESERVE|MEM_TOP_DOWN)
base_address: 0x000007fffff00000
success 0 0
1619599980.847896
NtAllocateVirtualMemory
process_identifier: 3692
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x000007fffff00000
success 0 0
1619599980.847896
NtAllocateVirtualMemory
process_identifier: 3692
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x000007fffff00000
success 0 0
1619599980.847896
NtAllocateVirtualMemory
process_identifier: 3692
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x000007fffff10000
success 0 0
1619599980.847896
NtAllocateVirtualMemory
process_identifier: 3692
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 1056768 (MEM_RESERVE|MEM_TOP_DOWN)
base_address: 0x000007ffffef0000
success 0 0
1619599980.847896
NtAllocateVirtualMemory
process_identifier: 3692
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x000007ffffef0000
success 0 0
1619599980.862896
NtAllocateVirtualMemory
process_identifier: 3692
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x000007ff0002a000
success 0 0
1619599981.206896
NtAllocateVirtualMemory
process_identifier: 3692
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x000007ff00033000
success 0 0
1619599981.222896
NtAllocateVirtualMemory
process_identifier: 3692
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x000007ff000dc000
success 0 0
1619599981.222896
NtAllocateVirtualMemory
process_identifier: 3692
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x000007ff00106000
success 0 0
1619599981.237896
NtAllocateVirtualMemory
process_identifier: 3692
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x000007ff000e0000
success 0 0
1619599981.722896
NtAllocateVirtualMemory
process_identifier: 3692
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x000007ff00034000
success 0 0
1619599981.722896
NtAllocateVirtualMemory
process_identifier: 3692
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x000007ff00036000
success 0 0
1619599981.737896
NtAllocateVirtualMemory
process_identifier: 3692
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x000007ff00037000
success 0 0
1619599981.862896
NtAllocateVirtualMemory
process_identifier: 3692
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x000007ff0003c000
success 0 0
1619599985.706896
NtAllocateVirtualMemory
process_identifier: 3692
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x000007ff0002b000
success 0 0
1619599987.331896
NtAllocateVirtualMemory
process_identifier: 3692
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x000007ff00170000
success 0 0
1619599987.487896
NtAllocateVirtualMemory
process_identifier: 3692
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x000007ff00038000
success 0 0
1619599987.800896
NtAllocateVirtualMemory
process_identifier: 3692
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x000007ff00039000
success 0 0
1619599988.472896
NtAllocateVirtualMemory
process_identifier: 3692
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x000007ff001d0000
success 0 0
Creates executable files on the filesystem (8 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\WindUpd\vmcheck32.dll
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\WindUpd\System.vbe
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\WindUpd\h0fplRJzVKuZcexPUsVYxbCiy4F3GG.vbs
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\WindUpd\ADPR0QXlb6DVaIuA20fKAkgghRVwf5.bat
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\WindUpd\WpnKh1UCCuNvzK31bRMD.exe
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\WindUpd\5PDelIWOaZ1YRh6WwkFt8y75aU5s7v.bat
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\WindUpd\System.lnk
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\WindUpd\win_update.exe
Creates a shortcut to an executable file (3 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System.lnk
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\f0d5395609859d9f831fe611f2b06977ac6ebe64.lnk
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\WindUpd\System.lnk
Drops a binary and executes it (6 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\WindUpd\h0fplRJzVKuZcexPUsVYxbCiy4F3GG.vbs
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\WindUpd\5PDelIWOaZ1YRh6WwkFt8y75aU5s7v.bat
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\WindUpd\WpnKh1UCCuNvzK31bRMD.exe
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\WindUpd\System.vbe
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\WindUpd\ADPR0QXlb6DVaIuA20fKAkgghRVwf5.bat
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\WindUpd\win_update.exe
Drops an executable to the user AppData folder (5 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\WindUpd\dclib\rs2300f068121707def35df4f7b5d2bc8a016bd37f.dclib
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\WindUpd\dclib\AK_33db8088017dd3ba0d1f7d0d6d211cb82b9f06dd.dclib
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\WindUpd\WpnKh1UCCuNvzK31bRMD.exe
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\WindUpd\dclib\al6cf54c5afe698333513f91b6a461a8fe412e5694.dclib
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\WindUpd\win_update.exe
A process created a hidden window (2 个事件)
Time & API Arguments Status Return Repeated
1619600385.797625
ShellExecuteExW
parameters:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\WindUpd\5PDelIWOaZ1YRh6WwkFt8y75aU5s7v.bat
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Roaming/WindUpd/5PDelIWOaZ1YRh6WwkFt8y75aU5s7v.bat
show_type: 0
success 1 0
1619600405.530875
ShellExecuteExW
parameters:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\WindUpd\ADPR0QXlb6DVaIuA20fKAkgghRVwf5.bat
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Roaming/WindUpd/ADPR0QXlb6DVaIuA20fKAkgghRVwf5.bat
show_type: 0
success 1 0
The binary likely contains encrypted or compressed data indicative of a packer (3 个事件)
entropy 7.925723668232036 section {'size_of_data': '0x00020c00', 'virtual_address': '0x00056000', 'entropy': 7.925723668232036, 'name': 'UPX1', 'virtual_size': '0x00021000'} description A section with a high entropy has been found
entropy 7.847798873854888 section {'size_of_data': '0x0001d000', 'virtual_address': '0x00089000', 'entropy': 7.847798873854888, 'name': '.enigma1', 'virtual_size': '0x00001000'} description A section with a high entropy has been found
entropy 0.42258340461933275 description Overall entropy of this PE file is high
The executable is compressed using UPX (2 个事件)
section UPX0 description Section name indicates UPX
section UPX1 description Section name indicates UPX
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
One or more non-safelisted processes were created (4 个事件)
parent_process wscript.exe martian_process "C:\Users\Administrator.Oskar-PC\AppData\Roaming\WindUpd\5PDelIWOaZ1YRh6WwkFt8y75aU5s7v.bat"
parent_process wscript.exe martian_process C:\Users\Administrator.Oskar-PC\AppData\Roaming\WindUpd\5PDelIWOaZ1YRh6WwkFt8y75aU5s7v.bat
parent_process wscript.exe martian_process "C:\Users\Administrator.Oskar-PC\AppData\Roaming\WindUpd\ADPR0QXlb6DVaIuA20fKAkgghRVwf5.bat"
parent_process wscript.exe martian_process C:\Users\Administrator.Oskar-PC\AppData\Roaming\WindUpd\ADPR0QXlb6DVaIuA20fKAkgghRVwf5.bat
Resumed a suspended thread in a remote process potentially indicative of process injection (4 个事件)
Process injection Process 420 resumed a thread in remote process 200
Process injection Process 2292 resumed a thread in remote process 3212
Time & API Arguments Status Return Repeated
1619600380.03125
NtResumeThread
thread_handle: 0x0000036c
suspend_count: 1
process_identifier: 200
success 0 0
1619600397.5785
NtResumeThread
thread_handle: 0x00000360
suspend_count: 1
process_identifier: 3212
success 0 0
The process wscript.exe wrote an executable file to disk (1 个事件)
file C:\Windows\SysWOW64\wscript.exe
Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 个事件)
dead_host 172.217.160.110:443
File has been identified by 48 AntiVirus engines on VirusTotal as malicious (48 个事件)
Bkav W32.AIDetectVM.malware1
Elastic malicious (high confidence)
MicroWorld-eScan Gen:Variant.Tatrio.7
FireEye Generic.mg.6d9e487ea1469c94
McAfee GenericRXJO-BH!6D9E487EA146
Cylance Unsafe
Zillya Trojan.Vasal.Win32.23
Sangfor Malware
K7AntiVirus Trojan ( 0054f7ba1 )
Alibaba Packed:Win32/Enigma.0c797c92
K7GW Trojan ( 0054f7ba1 )
Cybereason malicious.3fe14f
Arcabit Trojan.Tatrio.7
Symantec Trojan.Gen.MBT
ESET-NOD32 a variant of Win32/Packed.Enigma.CC
APEX Malicious
Avast Win32:Malware-gen
ClamAV Win.Malware.Vasal-7370294-0
Kaspersky HEUR:Trojan.Win32.Generic
BitDefender Gen:Variant.Tatrio.7
Tencent Win32.Trojan.Generic.Wsaw
Ad-Aware Gen:Variant.Tatrio.7
Emsisoft Gen:Variant.Tatrio.7 (B)
Comodo Packed.Win32.MUPX.Gen@24tbus
F-Secure Heuristic.HEUR/AGEN.1122944
VIPRE Trojan.Win32.Generic!BT
McAfee-GW-Edition BehavesLike.Win32.Generic.vc
Sophos Mal/Generic-S + Mal/RarMal-R
Paloalto generic.ml
Avira HEUR/AGEN.1122944
MAX malware (ai score=82)
Antiy-AVL Trojan/Win32.AGeneric
Gridinsoft Malware.Win32.Pack.21766!se
Microsoft Trojan:Win32/Ymacco.AA70
AegisLab Trojan.Win32.Generic.lXNp
ZoneAlarm HEUR:Trojan.Win32.Generic
GData Gen:Variant.Tatrio.7
Cynet Malicious (score: 100)
AhnLab-V3 Dropper/Win32.RL_Agent.R266317
Acronis suspicious
ALYac Gen:Variant.Tatrio.7
Ikarus Trojan.Rasftuby
eGambit Unsafe.AI_Score_100%
Fortinet W32/Enigma.CC!tr
AVG Win32:Malware-gen
Panda Trj/CI.A
CrowdStrike win/malicious_confidence_90% (W)
Qihoo-360 Generic/HEUR/QVM11.1.AB8F.Malware.Gen
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2018-06-24 23:04:40

Imports

Library kernel32.dll:
• 0x4c218c VirtualFree
• 0x4c2190 VirtualAlloc
• 0x4c2194 LocalFree
• 0x4c2198 LocalAlloc
• 0x4c219c GetTickCount
• 0x4c21a4 GetVersion
• 0x4c21a8 GetCurrentThreadId
• 0x4c21b4 VirtualQuery
• 0x4c21b8 WideCharToMultiByte
• 0x4c21bc MultiByteToWideChar
• 0x4c21c0 lstrlenA
• 0x4c21c4 lstrcpynA
• 0x4c21c8 LoadLibraryExA
• 0x4c21cc GetThreadLocale
• 0x4c21d0 GetStartupInfoA
• 0x4c21d4 GetProcAddress
• 0x4c21d8 GetModuleHandleA
• 0x4c21dc GetModuleFileNameA
• 0x4c21e0 GetLocaleInfoA
• 0x4c21e4 GetCommandLineA
• 0x4c21e8 FreeLibrary
• 0x4c21ec FindFirstFileA
• 0x4c21f0 FindClose
• 0x4c21f4 ExitProcess
• 0x4c21f8 ExitThread
• 0x4c21fc WriteFile
• 0x4c2204 RtlUnwind
• 0x4c2208 RaiseException
• 0x4c220c GetStdHandle
Library user32.dll:
• 0x4c2214 GetKeyboardType
• 0x4c2218 LoadStringA
• 0x4c221c MessageBoxA
• 0x4c2220 CharNextA
Library advapi32.dll:
• 0x4c2228 RegQueryValueExA
• 0x4c222c RegOpenKeyExA
• 0x4c2230 RegCloseKey
Library oleaut32.dll:
• 0x4c2238 SysFreeString
• 0x4c223c SysReAllocStringLen
• 0x4c2240 SysAllocStringLen
Library kernel32.dll:
• 0x4c2248 TlsSetValue
• 0x4c224c TlsGetValue
• 0x4c2250 TlsFree
• 0x4c2254 TlsAlloc
• 0x4c2258 LocalFree
• 0x4c225c LocalAlloc
Library advapi32.dll:
• 0x4c2264 RegOpenKeyA
Library kernel32.dll:
• 0x4c226c WriteProcessMemory
• 0x4c2270 WriteFile
• 0x4c2274 WideCharToMultiByte
• 0x4c2278 WaitForSingleObject
• 0x4c227c VirtualQuery
• 0x4c2280 VirtualProtectEx
• 0x4c2284 VirtualProtect
• 0x4c2288 VirtualFree
• 0x4c228c VirtualAllocEx
• 0x4c2290 VirtualAlloc
• 0x4c2298 SizeofResource
• 0x4c229c SetThreadContext
• 0x4c22a0 SetLastError
• 0x4c22a4 SetFileTime
• 0x4c22a8 SetFilePointer
• 0x4c22ac SetFileAttributesW
• 0x4c22b0 SetFileAttributesA
• 0x4c22b4 SetEvent
• 0x4c22b8 SetErrorMode
• 0x4c22bc SetEndOfFile
• 0x4c22c8 ResetEvent
• 0x4c22cc RemoveDirectoryW
• 0x4c22d0 RemoveDirectoryA
• 0x4c22d4 ReadProcessMemory
• 0x4c22d8 ReadFile
• 0x4c22dc QueryDosDeviceW
• 0x4c22e4 MultiByteToWideChar
• 0x4c22e8 LockResource
• 0x4c22ec LoadResource
• 0x4c22f0 LoadLibraryW
• 0x4c22f4 LoadLibraryA
• 0x4c22fc IsBadWritePtr
• 0x4c2300 IsBadStringPtrW
• 0x4c2304 IsBadReadPtr
• 0x4c2314 GetVersionExA
• 0x4c2318 GetVersion
• 0x4c231c GetThreadLocale
• 0x4c2320 GetThreadContext
• 0x4c2324 GetTempPathW
• 0x4c2328 GetTempPathA
• 0x4c232c GetTempFileNameW
• 0x4c2330 GetTempFileNameA
• 0x4c2334 GetSystemDirectoryW
• 0x4c2338 GetSystemDirectoryA
• 0x4c233c GetStringTypeExW
• 0x4c2340 GetStringTypeExA
• 0x4c2344 GetStdHandle
• 0x4c2348 GetProcAddress
• 0x4c234c GetModuleHandleA
• 0x4c2350 GetModuleFileNameW
• 0x4c2354 GetModuleFileNameA
• 0x4c235c GetLocaleInfoW
• 0x4c2360 GetLocaleInfoA
• 0x4c2364 GetLocalTime
• 0x4c2368 GetLastError
• 0x4c236c GetFullPathNameW
• 0x4c2370 GetFullPathNameA
• 0x4c2374 GetFileSize
• 0x4c2378 GetFileAttributesW
• 0x4c237c GetFileAttributesA
• 0x4c2380 GetDiskFreeSpaceA
• 0x4c2384 GetDateFormatA
• 0x4c2388 GetCurrentThreadId
• 0x4c238c GetCurrentProcessId
• 0x4c2390 GetCurrentProcess
• 0x4c239c GetCPInfo
• 0x4c23a0 GetACP
• 0x4c23a4 FreeResource
• 0x4c23a8 FreeLibrary
• 0x4c23ac FormatMessageA
• 0x4c23b4 FindResourceW
• 0x4c23b8 FindNextFileW
• 0x4c23bc FindNextFileA
• 0x4c23c0 FindFirstFileW
• 0x4c23c4 FindFirstFileA
• 0x4c23c8 FindClose
• 0x4c23d4 ExitProcess
• 0x4c23d8 EnumCalendarInfoA
• 0x4c23e0 DeleteFileW
• 0x4c23e4 DeleteFileA
• 0x4c23ec CreateFileW
• 0x4c23f0 CreateFileA
• 0x4c23f4 CreateEventA
• 0x4c23f8 CreateDirectoryW
• 0x4c23fc CreateDirectoryA
• 0x4c2400 CompareStringW
• 0x4c2404 CompareStringA
• 0x4c2408 CloseHandle
Library user32.dll:
• 0x4c2410 MessageBoxA
• 0x4c2414 LoadStringA
• 0x4c2418 GetSystemMetrics
• 0x4c241c CharUpperBuffW
• 0x4c2420 CharUpperW
• 0x4c2424 CharLowerBuffW
• 0x4c2428 CharLowerW
• 0x4c242c CharNextA
• 0x4c2430 CharLowerA
• 0x4c2434 CharUpperA
• 0x4c2438 CharToOemA
Library kernel32.dll:
• 0x4c2440 Sleep
Library kernel32.dll:
• 0x4c2448 ActivateActCtx
• 0x4c244c CreateActCtxW
• 0x4c2450 QueryDosDeviceW
Library ole32.dll:
• 0x4c245c CoUninitialize
• 0x4c2460 CoInitialize
Library oleaut32.dll:
• 0x4c2468 GetErrorInfo
• 0x4c246c SysFreeString
Library oleaut32.dll:
• 0x4c2474 SafeArrayPtrOfIndex
• 0x4c2478 SafeArrayGetUBound
• 0x4c247c SafeArrayGetLBound
• 0x4c2480 SafeArrayCreate
• 0x4c2484 VariantChangeType
• 0x4c2488 VariantCopy
• 0x4c248c VariantClear
• 0x4c2490 VariantInit
Library ntdll.dll:
Library SHFolder.dll:
• 0x4c24ac SHGetFolderPathW
• 0x4c24b0 SHGetFolderPathA
Library ntdll.dll:
Library shlwapi.dll:
• 0x4c24c0 PathMatchSpecW
Library ntdll.dll:
• 0x4c24d0 RtlInitAnsiString
• 0x4c24d8 LdrLoadDll

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 50534 114.114.114.114 53
192.168.56.101 51808 114.114.114.114 53
192.168.56.101 53237 114.114.114.114 53
192.168.56.101 53657 114.114.114.114 53
192.168.56.101 58367 114.114.114.114 53
192.168.56.101 60123 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 55368 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 57874 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 63429 224.0.0.252 5355
192.168.56.101 65004 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 53658 239.255.255.250 3702
192.168.56.101 53660 239.255.255.250 3702
192.168.56.101 58707 239.255.255.250 3702
192.168.56.101 60124 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.