SmartHawk

6.4

高危

57 个模型检测该样本为恶意！

重新分析

下载样本

3728f6e5e1d46521096729ca985ca48741923cdc7f3da79e6704c02673268262

7fb91ccafe89a2302da9d98990f26546.exe

分析耗时

92s

最近分析

文件大小

461.5KB

静态报毒动态报毒 100% AI SCORE=80 AMMR CONFIDENCE ELDORADO FAREIT FORMBOOK GENERICKD HIGH CONFIDENCE HQSNAV JR1VNP KCLOUD KRYPTIK KTSE MALICIOUS PE MALREP MALWARE@#2QD4E5POVBPDV MALWAREX MASSLOGGER NANOCORE NEGASTEAL QVM03 QXTT S + MAL SAMCA SCORE SMAUJ STATIC AI SUSGEN THICOBO UNSAFE UOOQP WACATAC YAKBEEXMSIL 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee	Fareit-FXH!7FB91CCAFE89	20210102	6.0.6.653
Alibaba	Trojan:MSIL/Formbook.89004bf6	20190527	0.3.0.5
Baidu		20190318	1.0.0.2
Avast	Win32:MalwareX-gen [Trj]	20210102	21.1.5827.0
Tencent	Msil.Trojan.Crypt.Ammr	20210104	1.0.0.1
Kingsoft	Win32.Troj.Undef.(kcloud)	20210104	2017.9.26.565
CrowdStrike	win/malicious_confidence_100% (W)	20190702	1.0

Queries for the computername (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619718298.286502 GetComputerNameW	computer_name: OSKAR-PC	success	1	0

Checks if process is being debugged by a debugger (43 个事件)

Time & API	Arguments	Status	Return	Repeated
1619685983.624375 IsDebuggerPresent		failed	0	0
1619685983.624375 IsDebuggerPresent		failed	0	0
1619686030.359375 IsDebuggerPresent		failed	0	0
1619686030.874375 IsDebuggerPresent		failed	0	0
1619686031.359375 IsDebuggerPresent		failed	0	0
1619686031.874375 IsDebuggerPresent		failed	0	0
1619686032.359375 IsDebuggerPresent		failed	0	0
1619686032.874375 IsDebuggerPresent		failed	0	0
1619686033.359375 IsDebuggerPresent		failed	0	0
1619686033.874375 IsDebuggerPresent		failed	0	0
1619686034.359375 IsDebuggerPresent		failed	0	0
1619686034.874375 IsDebuggerPresent		failed	0	0
1619686035.359375 IsDebuggerPresent		failed	0	0
1619686035.874375 IsDebuggerPresent		failed	0	0
1619686036.359375 IsDebuggerPresent		failed	0	0
1619686036.874375 IsDebuggerPresent		failed	0	0
1619686037.359375 IsDebuggerPresent		failed	0	0
1619686037.874375 IsDebuggerPresent		failed	0	0
1619686038.359375 IsDebuggerPresent		failed	0	0
1619686038.874375 IsDebuggerPresent		failed	0	0
1619686039.359375 IsDebuggerPresent		failed	0	0
1619686039.874375 IsDebuggerPresent		failed	0	0
1619686040.359375 IsDebuggerPresent		failed	0	0
1619686040.874375 IsDebuggerPresent		failed	0	0
1619686041.359375 IsDebuggerPresent		failed	0	0
1619686041.874375 IsDebuggerPresent		failed	0	0
1619686042.359375 IsDebuggerPresent		failed	0	0
1619686042.874375 IsDebuggerPresent		failed	0	0
1619686043.359375 IsDebuggerPresent		failed	0	0
1619686043.874375 IsDebuggerPresent		failed	0	0
1619686044.359375 IsDebuggerPresent		failed	0	0
1619686044.874375 IsDebuggerPresent		failed	0	0
1619686045.359375 IsDebuggerPresent		failed	0	0
1619686045.874375 IsDebuggerPresent		failed	0	0
1619686046.359375 IsDebuggerPresent		failed	0	0
1619686046.874375 IsDebuggerPresent		failed	0	0
1619686047.359375 IsDebuggerPresent		failed	0	0
1619686047.874375 IsDebuggerPresent		failed	0	0
1619686048.359375 IsDebuggerPresent		failed	0	0
1619686048.874375 IsDebuggerPresent		failed	0	0
1619686049.359375 IsDebuggerPresent		failed	0	0
1619686049.874375 IsDebuggerPresent		failed	0	0
1619686050.359375 IsDebuggerPresent		failed	0	0

Command line console output was observed (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619718306.724502 WriteConsoleW	buffer: 成功: 成功创建计划任务 "Updates\ICIFmdLxvU"。 console_handle: 0x00000007	success	1	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619685983.640375 GlobalMemoryStatusEx		success	1	0

Allocates read-write-execute memory (usually to unpack itself) (50 out of 100 个事件)

Time & API	Arguments	Status	Return
1619685982.874375 NtAllocateVirtualMemory	process_identifier: 2636 region_size: 1376256 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00870000	success	0
1619685982.874375 NtAllocateVirtualMemory	process_identifier: 2636 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00980000	success	0
1619685983.484375 NtAllocateVirtualMemory	process_identifier: 2636 region_size: 1572864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x020e0000	success	0
1619685983.484375 NtAllocateVirtualMemory	process_identifier: 2636 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x02220000	success	0
1619685983.531375 NtProtectVirtualMemory	process_identifier: 2636 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73b91000	success	0
1619685983.624375 NtAllocateVirtualMemory	process_identifier: 2636 region_size: 917504 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00750000	success	0
1619685983.624375 NtAllocateVirtualMemory	process_identifier: 2636 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x007f0000	success	0
1619685983.624375 NtAllocateVirtualMemory	process_identifier: 2636 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0042a000	success	0
1619685983.624375 NtProtectVirtualMemory	process_identifier: 2636 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73b92000	success	0
1619685983.624375 NtAllocateVirtualMemory	process_identifier: 2636 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00422000	success	0
1619685983.890375 NtAllocateVirtualMemory	process_identifier: 2636 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00432000	success	0
1619685983.984375 NtAllocateVirtualMemory	process_identifier: 2636 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00455000	success	0
1619685983.999375 NtAllocateVirtualMemory	process_identifier: 2636 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0045b000	success	0
1619685983.999375 NtAllocateVirtualMemory	process_identifier: 2636 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00457000	success	0
1619685984.171375 NtAllocateVirtualMemory	process_identifier: 2636 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00433000	success	0
1619685984.202375 NtAllocateVirtualMemory	process_identifier: 2636 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0043c000	success	0
1619685984.296375 NtAllocateVirtualMemory	process_identifier: 2636 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00640000	success	0
1619685984.890375 NtAllocateVirtualMemory	process_identifier: 2636 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00434000	success	0
1619685984.890375 NtAllocateVirtualMemory	process_identifier: 2636 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00436000	success	0
1619685985.015375 NtAllocateVirtualMemory	process_identifier: 2636 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00437000	success	0
1619685985.046375 NtAllocateVirtualMemory	process_identifier: 2636 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00438000	success	0
1619685985.109375 NtAllocateVirtualMemory	process_identifier: 2636 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0044a000	success	0
1619685985.109375 NtAllocateVirtualMemory	process_identifier: 2636 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00447000	success	0
1619685985.234375 NtAllocateVirtualMemory	process_identifier: 2636 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00446000	success	0
1619685985.296375 NtAllocateVirtualMemory	process_identifier: 2636 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00641000	success	0
1619685985.562375 NtAllocateVirtualMemory	process_identifier: 2636 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0043a000	success	0
1619685985.702375 NtAllocateVirtualMemory	process_identifier: 2636 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00439000	success	0
1619685985.827375 NtAllocateVirtualMemory	process_identifier: 2636 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x02190000	success	0
1619685985.890375 NtAllocateVirtualMemory	process_identifier: 2636 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00644000	success	0
1619685985.952375 NtAllocateVirtualMemory	process_identifier: 2636 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00645000	success	0
1619685986.296375 NtAllocateVirtualMemory	process_identifier: 2636 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x02191000	success	0
1619685986.312375 NtAllocateVirtualMemory	process_identifier: 2636 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x02192000	success	0
1619685986.327375 NtAllocateVirtualMemory	process_identifier: 2636 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00647000	success	0
1619685986.327375 NtAllocateVirtualMemory	process_identifier: 2636 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x02193000	success	0
1619685986.343375 NtAllocateVirtualMemory	process_identifier: 2636 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00648000	success	0
1619685986.343375 NtAllocateVirtualMemory	process_identifier: 2636 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0064b000	success	0
1619685986.343375 NtAllocateVirtualMemory	process_identifier: 2636 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0043d000	success	0
1619686027.359375 NtAllocateVirtualMemory	process_identifier: 2636 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x02194000	success	0
1619686027.359375 NtAllocateVirtualMemory	process_identifier: 2636 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0064c000	success	0
1619686027.359375 NtAllocateVirtualMemory	process_identifier: 2636 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x02221000	success	0
1619686027.546375 NtAllocateVirtualMemory	process_identifier: 2636 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0064d000	success	0
1619686027.687375 NtAllocateVirtualMemory	process_identifier: 2636 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0042c000	success	0
1619686027.687375 NtAllocateVirtualMemory	process_identifier: 2636 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0064e000	success	0
1619686027.796375 NtAllocateVirtualMemory	process_identifier: 2636 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0064f000	success	0
1619686027.812375 NtAllocateVirtualMemory	process_identifier: 2636 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x02195000	success	0
1619686027.827375 NtAllocateVirtualMemory	process_identifier: 2636 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x04a00000	success	0
1619686027.827375 NtAllocateVirtualMemory	process_identifier: 2636 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x04a01000	success	0
1619686027.952375 NtProtectVirtualMemory	process_identifier: 2636 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 244224 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x05230400	failed	3221225550
1619686030.046375 NtAllocateVirtualMemory	process_identifier: 2636 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x04a02000	success	0
1619686030.046375 NtAllocateVirtualMemory	process_identifier: 2636 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x02196000	success	0

Creates a suspicious process (2 个事件)

cmdline	schtasks.exe /Create /TN "Updates\ICIFmdLxvU" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp5A8A.tmp"
cmdline	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ICIFmdLxvU" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp5A8A.tmp"

A process created a hidden window (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619686041.093375 ShellExecuteExW	parameters: /Create /TN "Updates\ICIFmdLxvU" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp5A8A.tmp" filepath: schtasks.exe filepath_r: schtasks.exe show_type: 0	success	1	0

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

7.665292416405536

section

{'size_of_data': '0x00072a00', 'virtual_address': '0x00002000', 'entropy': 7.665292416405536, 'name': '.text', 'virtual_size': '0x00072958'}

description

A section with a high entropy has been found

entropy

0.9945770065075922

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619686027.952375 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1	0

Uses Windows utilities for basic Windows functionality (2 个事件)

cmdline	schtasks.exe /Create /TN "Updates\ICIFmdLxvU" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp5A8A.tmp"
cmdline	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ICIFmdLxvU" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp5A8A.tmp"

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

File has been identified by 57 AntiVirus engines on VirusTotal as malicious (50 out of 57 个事件)

Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.34299921
FireEye	Generic.mg.7fb91ccafe89a230
CAT-QuickHeal	Trojan.YakbeexMSIL.ZZ4
McAfee	Fareit-FXH!7FB91CCAFE89
Cylance	Unsafe
Sangfor	Malware
K7AntiVirus	Trojan ( 0056c20e1 )
Alibaba	Trojan:MSIL/Formbook.89004bf6
K7GW	Trojan ( 0056c20e1 )
Cybereason	malicious.afe89a
Arcabit	Trojan.Generic.D20B6011
Cyren	W32/MSIL_Kryptik.BIL.gen!Eldorado
Symantec	Trojan.Gen.2
TrendMicro-HouseCall	TrojanSpy.MSIL.NEGASTEAL.SMAUJ
Avast	Win32:MalwareX-gen [Trj]
ClamAV	Win.Dropper.Nanocore-9248945-0
Kaspersky	HEUR:Trojan.MSIL.Crypt.gen
BitDefender	Trojan.GenericKD.34299921
NANO-Antivirus	Trojan.Win32.Crypt.hqsnav
Paloalto	generic.ml
AegisLab	Trojan.Win32.Generic.4!c
Tencent	Msil.Trojan.Crypt.Ammr
Ad-Aware	Trojan.GenericKD.34299921
Sophos	Mal/Generic-S + Mal/Generic-L
Comodo	Malware@#2qd4e5povbpdv
F-Secure	Trojan.TR/BAS.Samca.uooqp
DrWeb	Trojan.PWS.Stealer.29035
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	Trojan.MSIL.MALREP.THICOBO
McAfee-GW-Edition	BehavesLike.Win32.Fareit.gc
Emsisoft	Trojan.GenericKD.34299921 (B)
SentinelOne	Static AI - Malicious PE
Jiangmin	Trojan.MSIL.qxtt
eGambit	Unsafe.AI_Score_86%
Avira	TR/BAS.Samca.uooqp
Antiy-AVL	Trojan/Win32.Generic
Kingsoft	Win32.Troj.Undef.(kcloud)
Gridinsoft	Ransom.Win32.Wacatac.oa
Microsoft	Trojan:MSIL/Formbook.VN!MTB
ZoneAlarm	HEUR:Trojan.MSIL.Crypt.gen
GData	Win32.Trojan.Agent.JR1VNP
Cynet	Malicious (score: 100)
ALYac	Trojan.GenericKD.34299921
MAX	malware (ai score=80)
Malwarebytes	Trojan.MalPack
APEX	Malicious
ESET-NOD32	MSIL/NanoCore.E
Rising	Trojan.Crypt!8.2E3 (KTSE)
Ikarus	Trojan-Spy.MassLogger

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (2 个事件)

dead_host	172.217.24.14:443
dead_host	172.217.160.110:443

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-08-06 09:46:35

Imports

Library mscoree.dll:

• 0x402000 _CorExeMain

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
clients2.google.com	A 172.217.160.110 CNAME clients.l.google.com	172.217.160.78
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	50534	114.114.114.114	53
192.168.56.101	51963	114.114.114.114	53
192.168.56.101	55368	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	60384	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	49713	224.0.0.252	5355
192.168.56.101	51378	224.0.0.252	5355
192.168.56.101	51808	224.0.0.252	5355
192.168.56.101	53237	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355
192.168.56.101	61680	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	62318	224.0.0.252	5355
192.168.56.101	65004	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	51379	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.