SmartHawk

14.4

0-day

52 个模型检测该样本为恶意！

重新分析

下载样本

62dfd6f1e26aaad4c5efc61482f969cf6f73e6ad54c11c93f02ca14eadf157ab

90b37416f92cf65d79794c170169b116.exe

分析耗时

71s

最近分析

文件大小

954.5KB

静态报毒动态报毒 7M0@AQF4NJF AI SCORE=85 ANDROM BULZ ELDORADO FCSU GDSDA HIGH CONFIDENCE HPPTMA KCLOUD KRYPTIK MALWARE@#315BS1625N2OY PWSX SCORE STATIC AI SUSGEN SUSPICIOUS PE THIAHBO TSCOPE UCBIY UNSAFE YAKBEEXMSIL ZEMSILF 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee	PWS-FCSU!90B37416F92C	20201228	6.0.6.653
Baidu		20190318	1.0.0.2
Avast	Win32:PWSX-gen [Trj]	20201228	21.1.5827.0
Alibaba	Backdoor:MSIL/Androm.215fd957	20190527	0.3.0.5
Kingsoft	Win32.Hack.Undef.(kcloud)	20201228	2017.9.26.565

Checks if process is being debugged by a debugger (3 个事件)

Time & API	Arguments	Status	Return	Repeated
1619686135.117626 IsDebuggerPresent		failed	0	0
1619686171.007626 IsDebuggerPresent		failed	0	0
1619686171.507626 IsDebuggerPresent		failed	0	0

Command line console output was observed (50 out of 302 个事件)

Time & API	Arguments	Status	Return
1619697145.104374 WriteConsoleW	buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp> console_handle: 0x00000007	success	1
1619697145.104374 WriteConsoleW	buffer: del console_handle: 0x00000007	success	1
1619697145.104374 WriteConsoleW	buffer: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\90b37416f92cf65d79794c170169b116.exe" console_handle: 0x00000007	success	1
1619697145.260374 WriteConsoleW	buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\90b37416f92cf65d79794c170169b116.exe console_handle: 0x00000007	success	1
1619697145.291374 WriteConsoleW	buffer: 拒绝访问。 console_handle: 0x0000000b	success	1
1619697145.307374 WriteConsoleW	buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp> console_handle: 0x00000007	success	1
1619697145.307374 WriteConsoleW	buffer: if console_handle: 0x00000007	success	1
1619697145.307374 WriteConsoleW	buffer: exist "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\90b37416f92cf65d79794c170169b116.exe" console_handle: 0x00000007	success	1
1619697145.307374 WriteConsoleW	buffer: goto console_handle: 0x00000007	success	1
1619697145.323374 WriteConsoleW	buffer: ktk console_handle: 0x00000007	success	1
1619697145.354374 WriteConsoleW	buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp> console_handle: 0x00000007	success	1
1619697145.354374 WriteConsoleW	buffer: del console_handle: 0x00000007	success	1
1619697145.369374 WriteConsoleW	buffer: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\90b37416f92cf65d79794c170169b116.exe" console_handle: 0x00000007	success	1
1619697145.448374 WriteConsoleW	buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\90b37416f92cf65d79794c170169b116.exe console_handle: 0x00000007	success	1
1619697145.448374 WriteConsoleW	buffer: 拒绝访问。 console_handle: 0x0000000b	success	1
1619697145.463374 WriteConsoleW	buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp> console_handle: 0x00000007	success	1
1619697145.463374 WriteConsoleW	buffer: if console_handle: 0x00000007	success	1
1619697145.463374 WriteConsoleW	buffer: exist "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\90b37416f92cf65d79794c170169b116.exe" console_handle: 0x00000007	success	1
1619697145.479374 WriteConsoleW	buffer: goto console_handle: 0x00000007	success	1
1619697145.479374 WriteConsoleW	buffer: ktk console_handle: 0x00000007	success	1
1619697145.494374 WriteConsoleW	buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp> console_handle: 0x00000007	success	1
1619697145.494374 WriteConsoleW	buffer: del console_handle: 0x00000007	success	1
1619697145.494374 WriteConsoleW	buffer: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\90b37416f92cf65d79794c170169b116.exe" console_handle: 0x00000007	success	1
1619697145.557374 WriteConsoleW	buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\90b37416f92cf65d79794c170169b116.exe console_handle: 0x00000007	success	1
1619697145.557374 WriteConsoleW	buffer: 拒绝访问。 console_handle: 0x0000000b	success	1
1619697145.588374 WriteConsoleW	buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp> console_handle: 0x00000007	success	1
1619697145.588374 WriteConsoleW	buffer: if console_handle: 0x00000007	success	1
1619697145.588374 WriteConsoleW	buffer: exist "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\90b37416f92cf65d79794c170169b116.exe" console_handle: 0x00000007	success	1
1619697145.588374 WriteConsoleW	buffer: goto console_handle: 0x00000007	success	1
1619697145.588374 WriteConsoleW	buffer: ktk console_handle: 0x00000007	success	1
1619697145.619374 WriteConsoleW	buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp> console_handle: 0x00000007	success	1
1619697145.619374 WriteConsoleW	buffer: del console_handle: 0x00000007	success	1
1619697145.619374 WriteConsoleW	buffer: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\90b37416f92cf65d79794c170169b116.exe" console_handle: 0x00000007	success	1
1619697145.666374 WriteConsoleW	buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\90b37416f92cf65d79794c170169b116.exe console_handle: 0x00000007	success	1
1619697145.682374 WriteConsoleW	buffer: 拒绝访问。 console_handle: 0x0000000b	success	1
1619697145.682374 WriteConsoleW	buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp> console_handle: 0x00000007	success	1
1619697145.698374 WriteConsoleW	buffer: if console_handle: 0x00000007	success	1
1619697145.698374 WriteConsoleW	buffer: exist "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\90b37416f92cf65d79794c170169b116.exe" console_handle: 0x00000007	success	1
1619697145.698374 WriteConsoleW	buffer: goto console_handle: 0x00000007	success	1
1619697145.698374 WriteConsoleW	buffer: ktk console_handle: 0x00000007	success	1
1619697145.713374 WriteConsoleW	buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp> console_handle: 0x00000007	success	1
1619697145.713374 WriteConsoleW	buffer: del console_handle: 0x00000007	success	1
1619697145.713374 WriteConsoleW	buffer: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\90b37416f92cf65d79794c170169b116.exe" console_handle: 0x00000007	success	1
1619697145.744374 WriteConsoleW	buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\90b37416f92cf65d79794c170169b116.exe console_handle: 0x00000007	success	1
1619697145.744374 WriteConsoleW	buffer: 拒绝访问。 console_handle: 0x0000000b	success	1
1619697145.760374 WriteConsoleW	buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp> console_handle: 0x00000007	success	1
1619697145.760374 WriteConsoleW	buffer: if console_handle: 0x00000007	success	1
1619697145.776374 WriteConsoleW	buffer: exist "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\90b37416f92cf65d79794c170169b116.exe" console_handle: 0x00000007	success	1
1619697145.776374 WriteConsoleW	buffer: goto console_handle: 0x00000007	success	1
1619697145.776374 WriteConsoleW	buffer: ktk console_handle: 0x00000007	success	1

Tries to locate where the browsers are installed (1 个事件)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619686166.148626 GlobalMemoryStatusEx		success	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (50 out of 97 个事件)

Time & API	Arguments	Status	Return
1619686133.945626 NtAllocateVirtualMemory	process_identifier: 2984 region_size: 458752 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00380000	success	0
1619686133.945626 NtAllocateVirtualMemory	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003b0000	success	0
1619686134.789626 NtProtectVirtualMemory	process_identifier: 2984 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73f31000	success	0
1619686135.117626 NtAllocateVirtualMemory	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003fa000	success	0
1619686135.117626 NtProtectVirtualMemory	process_identifier: 2984 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73f32000	success	0
1619686135.117626 NtAllocateVirtualMemory	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003f2000	success	0
1619686135.570626 NtAllocateVirtualMemory	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00402000	success	0
1619686135.773626 NtAllocateVirtualMemory	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00403000	success	0
1619686135.820626 NtAllocateVirtualMemory	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0043b000	success	0
1619686135.820626 NtAllocateVirtualMemory	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00437000	success	0
1619686136.554626 NtAllocateVirtualMemory	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00404000	success	0
1619686136.554626 NtAllocateVirtualMemory	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00405000	success	0
1619686136.601626 NtAllocateVirtualMemory	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0040c000	success	0
1619686136.601626 NtAllocateVirtualMemory	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00406000	success	0
1619686136.664626 NtAllocateVirtualMemory	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00950000	success	0
1619686136.835626 NtAllocateVirtualMemory	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00407000	success	0
1619686136.851626 NtAllocateVirtualMemory	process_identifier: 2984 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) base_address: 0x7ef50000	success	0
1619686136.851626 NtAllocateVirtualMemory	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x7ef50000	success	0
1619686136.851626 NtAllocateVirtualMemory	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x7ef50000	success	0
1619686136.851626 NtAllocateVirtualMemory	process_identifier: 2984 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) base_address: 0x7ef40000	success	0
1619686136.851626 NtAllocateVirtualMemory	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x7ef40000	success	0
1619686136.882626 NtAllocateVirtualMemory	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0042a000	success	0
1619686136.898626 NtAllocateVirtualMemory	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00408000	success	0
1619686136.929626 NtAllocateVirtualMemory	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0041a000	success	0
1619686136.929626 NtAllocateVirtualMemory	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00417000	success	0
1619686137.039626 NtAllocateVirtualMemory	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00951000	success	0
1619686137.085626 NtAllocateVirtualMemory	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003fb000	success	0
1619686137.351626 NtAllocateVirtualMemory	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0040a000	success	0
1619686137.382626 NtAllocateVirtualMemory	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00416000	success	0
1619686137.507626 NtAllocateVirtualMemory	process_identifier: 2984 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00952000	success	0
1619686137.570626 NtAllocateVirtualMemory	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00422000	success	0
1619686137.664626 NtAllocateVirtualMemory	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00954000	success	0
1619686137.710626 NtAllocateVirtualMemory	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00955000	success	0
1619686137.726626 NtAllocateVirtualMemory	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00435000	success	0
1619686137.914626 NtAllocateVirtualMemory	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00409000	success	0
1619686137.914626 NtAllocateVirtualMemory	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00cb0000	success	0
1619686137.960626 NtAllocateVirtualMemory	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0042c000	success	0
1619686164.273626 NtAllocateVirtualMemory	process_identifier: 2984 region_size: 24576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00956000	success	0
1619686164.289626 NtAllocateVirtualMemory	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003b1000	success	0
1619686164.304626 NtAllocateVirtualMemory	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003f3000	success	0
1619686164.398626 NtAllocateVirtualMemory	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0095c000	success	0
1619686164.429626 NtAllocateVirtualMemory	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00cb1000	success	0
1619686164.445626 NtAllocateVirtualMemory	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0095d000	success	0
1619686164.539626 NtAllocateVirtualMemory	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00ea0000	success	0
1619686164.539626 NtProtectVirtualMemory	process_identifier: 2984 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 183296 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x04b50400	failed	3221225550
1619686170.632626 NtAllocateVirtualMemory	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0095e000	success	0
1619686170.648626 NtAllocateVirtualMemory	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00cb2000	success	0
1619686170.648626 NtAllocateVirtualMemory	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0095f000	success	0
1619686170.679626 NtAllocateVirtualMemory	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x04c40000	success	0
1619686170.710626 NtAllocateVirtualMemory	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x04c41000	success	0

Steals private information from local Internet browsers (5 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Default\Web Data-journal
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Default\Login Data-journal
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Default\Web Data
registry	HKEY_CURRENT_USER\Software\Opera Software

Creates executable files on the filesystem (1 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\34936843.bat

Drops a binary and executes it (2 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\90b37416f92cf65d79794c170169b116.exe
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\34936843.bat

Drops an executable to the user AppData folder (1 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\90b37416f92cf65d79794c170169b116.exe

A process created a hidden window (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619697144.652249 ShellExecuteExW	parameters: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\90b37416f92cf65d79794c170169b116.exe" filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\34936843.bat filepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\34936843.bat show_type: 0	success	1	0

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

7.8916195210667155

section

{'size_of_data': '0x000ede00', 'virtual_address': '0x00002000', 'entropy': 7.8916195210667155, 'name': '.text', 'virtual_size': '0x000edc44'}

description

A section with a high entropy has been found

entropy

0.9973794549266247

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (21 个事件)

Time & API	Arguments	Status	Return
1619686164.539626 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1
1619697134.245249 LookupPrivilegeValueW	system_name: privilege_name: SeTcbPrivilege	success	1
1619697134.245249 LookupPrivilegeValueW	system_name: privilege_name: SeCreateTokenPrivilege	success	1
1619697134.245249 LookupPrivilegeValueW	system_name: privilege_name: SeBackupPrivilege	success	1
1619697134.245249 LookupPrivilegeValueW	system_name: privilege_name: SeRestorePrivilege	success	1
1619697134.261249 LookupPrivilegeValueW	system_name: privilege_name: SeAssignPrimaryTokenPrivilege	success	1
1619697143.730249 LookupPrivilegeValueW	system_name: privilege_name: SeTcbPrivilege	success	1
1619697143.730249 LookupPrivilegeValueW	system_name: privilege_name: SeCreateTokenPrivilege	success	1
1619697143.730249 LookupPrivilegeValueW	system_name: privilege_name: SeBackupPrivilege	success	1
1619697143.730249 LookupPrivilegeValueW	system_name: privilege_name: SeRestorePrivilege	success	1
1619697143.730249 LookupPrivilegeValueW	system_name: privilege_name: SeAssignPrimaryTokenPrivilege	success	1
1619697144.058249 LookupPrivilegeValueW	system_name: privilege_name: SeTcbPrivilege	success	1
1619697144.058249 LookupPrivilegeValueW	system_name: privilege_name: SeCreateTokenPrivilege	success	1
1619697144.058249 LookupPrivilegeValueW	system_name: privilege_name: SeBackupPrivilege	success	1
1619697144.058249 LookupPrivilegeValueW	system_name: privilege_name: SeRestorePrivilege	success	1
1619697144.058249 LookupPrivilegeValueW	system_name: privilege_name: SeAssignPrimaryTokenPrivilege	success	1
1619697144.402249 LookupPrivilegeValueW	system_name: privilege_name: SeTcbPrivilege	success	1
1619697144.417249 LookupPrivilegeValueW	system_name: privilege_name: SeCreateTokenPrivilege	success	1
1619697144.417249 LookupPrivilegeValueW	system_name: privilege_name: SeBackupPrivilege	success	1
1619697144.417249 LookupPrivilegeValueW	system_name: privilege_name: SeRestorePrivilege	success	1
1619697144.417249 LookupPrivilegeValueW	system_name: privilege_name: SeAssignPrimaryTokenPrivilege	success	1

Queries for potentially installed applications (36 个事件)

Time & API	Arguments	Status
1619697134.261249 RegOpenKeyExA	access: 0x02000000 base_handle: 0x80000002 key_handle: 0x00000134 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall options: 0	success
1619697134.261249 RegOpenKeyExA	access: 0x00020019 base_handle: 0x80000002 key_handle: 0x00000138 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook options: 0	success
1619697134.277249 RegOpenKeyExA	access: 0x00020219 base_handle: 0x80000002 key_handle: 0x00000138 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook options: 0	success
1619697134.277249 RegOpenKeyExA	access: 0x00020119 base_handle: 0x80000002 key_handle: 0x00000138 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook options: 0	success
1619697134.277249 RegOpenKeyExA	access: 0x00020019 base_handle: 0x80000002 key_handle: 0x00000138 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager options: 0	success
1619697134.277249 RegOpenKeyExA	access: 0x00020219 base_handle: 0x80000002 key_handle: 0x00000138 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager options: 0	success
1619697134.277249 RegOpenKeyExA	access: 0x00020119 base_handle: 0x80000002 key_handle: 0x00000138 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager options: 0	success
1619697134.277249 RegOpenKeyExA	access: 0x00020019 base_handle: 0x80000002 key_handle: 0x00000138 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx options: 0	success
1619697134.277249 RegOpenKeyExA	access: 0x00020219 base_handle: 0x80000002 key_handle: 0x00000138 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx options: 0	success
1619697134.277249 RegOpenKeyExA	access: 0x00020119 base_handle: 0x80000002 key_handle: 0x00000138 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx options: 0	success
1619697134.277249 RegOpenKeyExA	access: 0x00020019 base_handle: 0x80000002 key_handle: 0x00000138 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore options: 0	success
1619697134.277249 RegOpenKeyExA	access: 0x00020219 base_handle: 0x80000002 key_handle: 0x00000138 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore options: 0	success
1619697134.277249 RegOpenKeyExA	access: 0x00020119 base_handle: 0x80000002 key_handle: 0x00000138 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore options: 0	success
1619697134.277249 RegOpenKeyExA	access: 0x00020019 base_handle: 0x80000002 key_handle: 0x00000138 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome options: 0	success
1619697134.277249 RegOpenKeyExA	access: 0x00020019 base_handle: 0x80000002 key_handle: 0x00000138 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome options: 0	success
1619697134.277249 RegOpenKeyExA	access: 0x00020019 base_handle: 0x80000002 key_handle: 0x00000138 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE40 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE40 options: 0	success
1619697134.277249 RegOpenKeyExA	access: 0x00020219 base_handle: 0x80000002 key_handle: 0x00000138 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE40 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE40 options: 0	success
1619697134.277249 RegOpenKeyExA	access: 0x00020119 base_handle: 0x80000002 key_handle: 0x00000138 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE40 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE40 options: 0	success
1619697134.277249 RegOpenKeyExA	access: 0x00020019 base_handle: 0x80000002 key_handle: 0x00000138 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data options: 0	success
1619697134.277249 RegOpenKeyExA	access: 0x00020219 base_handle: 0x80000002 key_handle: 0x00000138 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data options: 0	success
1619697134.292249 RegOpenKeyExA	access: 0x00020119 base_handle: 0x80000002 key_handle: 0x00000138 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data options: 0	success
1619697134.292249 RegOpenKeyExA	access: 0x00020019 base_handle: 0x80000002 key_handle: 0x00000138 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX options: 0	success
1619697134.292249 RegOpenKeyExA	access: 0x00020219 base_handle: 0x80000002 key_handle: 0x00000138 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX options: 0	success
1619697134.292249 RegOpenKeyExA	access: 0x00020119 base_handle: 0x80000002 key_handle: 0x00000138 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX options: 0	success
1619697134.292249 RegOpenKeyExA	access: 0x00020019 base_handle: 0x80000002 key_handle: 0x00000138 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IEData regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IEData options: 0	success
1619697134.292249 RegOpenKeyExA	access: 0x00020219 base_handle: 0x80000002 key_handle: 0x00000138 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IEData regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IEData options: 0	success
1619697134.292249 RegOpenKeyExA	access: 0x00020119 base_handle: 0x80000002 key_handle: 0x00000138 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IEData regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IEData options: 0	success
1619697134.292249 RegOpenKeyExA	access: 0x00020019 base_handle: 0x80000002 key_handle: 0x00000138 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack options: 0	success
1619697134.292249 RegOpenKeyExA	access: 0x00020219 base_handle: 0x80000002 key_handle: 0x00000138 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack options: 0	success
1619697134.292249 RegOpenKeyExA	access: 0x00020119 base_handle: 0x80000002 key_handle: 0x00000138 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack options: 0	success
1619697134.292249 RegOpenKeyExA	access: 0x00020019 base_handle: 0x80000002 key_handle: 0x00000138 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent options: 0	success
1619697134.292249 RegOpenKeyExA	access: 0x00020219 base_handle: 0x80000002 key_handle: 0x00000138 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent options: 0	success
1619697134.292249 RegOpenKeyExA	access: 0x00020119 base_handle: 0x80000002 key_handle: 0x00000138 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent options: 0	success
1619697134.292249 RegOpenKeyExA	access: 0x00020019 base_handle: 0x80000002 key_handle: 0x00000138 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WIC regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WIC options: 0	success
1619697134.292249 RegOpenKeyExA	access: 0x00020219 base_handle: 0x80000002 key_handle: 0x00000138 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WIC regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WIC options: 0	success
1619697134.292249 RegOpenKeyExA	access: 0x00020119 base_handle: 0x80000002 key_handle: 0x00000138 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WIC regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WIC options: 0	success

Terminates another process (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619686171.476626 NtTerminateProcess	status_code: 0xffffffff process_identifier: 2948 process_handle: 0x00010158	failed	0	0
1619686171.476626 NtTerminateProcess	status_code: 0xffffffff process_identifier: 2948 process_handle: 0x00010158	success	0	0

Uses Windows utilities for basic Windows functionality (1 个事件)

cmdline

C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\34936843.bat "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\90b37416f92cf65d79794c170169b116.exe"

One or more of the buffers contains an embedded PE file (1 个事件)

buffer

Buffer with sha1: 53b2bb950f52935f1b7466a1f780bdd9d3a270e9

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Allocates execute permission to another process indicative of possible code injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619686171.132626 NtAllocateVirtualMemory	process_identifier: 2948 region_size: 102400 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x0000ea2c allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496	0
1619686171.601626 NtAllocateVirtualMemory	process_identifier: 2496 region_size: 102400 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x0000fa80 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	success	0	0

Harvests credentials from local FTP client softwares (50 out of 120 个事件)

file	C:\Program Files (x86)\CuteFTP\sm.dat
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\CuteFTP\sm.dat
file	C:\Users\Administrator.Oskar-PC\AppData\Local\CuteFTP\sm.dat
file	C:\Program Files (x86)\GlobalSCAPE\CuteFTP\sm.dat
file	C:\ProgramData\CuteFTP\sm.dat
file	C:\ProgramData\GlobalSCAPE\CuteFTP\sm.dat
file	C:\Users\Administrator.Oskar-PC\AppData\Local\GlobalSCAPE\CuteFTP\sm.dat
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\GlobalSCAPE\CuteFTP\sm.dat
file	C:\ProgramData\GlobalSCAPE\CuteFTP Lite\sm.dat
file	C:\Users\Administrator.Oskar-PC\AppData\Local\GlobalSCAPE\CuteFTP Lite\sm.dat
file	C:\Program Files (x86)\GlobalSCAPE\CuteFTP Lite\sm.dat
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\GlobalSCAPE\CuteFTP Lite\sm.dat
file	C:\Program Files (x86)\GlobalSCAPE\CuteFTP Pro\sm.dat
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\GlobalSCAPE\CuteFTP Pro\sm.dat
file	C:\ProgramData\GlobalSCAPE\CuteFTP Pro\sm.dat
file	C:\Users\Administrator.Oskar-PC\AppData\Local\GlobalSCAPE\CuteFTP Pro\sm.dat
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\FlashFXP\3\History.dat
file	C:\Users\Administrator.Oskar-PC\AppData\Local\FlashFXP\3\History.dat
file	C:\Users\Administrator.Oskar-PC\AppData\Local\FlashFXP\4\Sites.dat
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\FlashFXP\4\Sites.dat
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\FlashFXP\4\History.dat
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\FlashFXP\4\Quick.dat
file	C:\ProgramData\FlashFXP\3\History.dat
file	C:\Users\Administrator.Oskar-PC\AppData\Local\FlashFXP\4\Quick.dat
file	C:\ProgramData\FlashFXP\4\History.dat
file	C:\ProgramData\FlashFXP\3\Sites.dat
file	C:\ProgramData\FlashFXP\4\Quick.dat
file	C:\ProgramData\FlashFXP\4\Sites.dat
file	C:\Users\Administrator.Oskar-PC\AppData\Local\FlashFXP\3\Sites.dat
file	C:\Users\Administrator.Oskar-PC\AppData\Local\FlashFXP\3\Quick.dat
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\FlashFXP\3\Quick.dat
file	C:\ProgramData\FlashFXP\3\Quick.dat
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\FlashFXP\3\Sites.dat
file	C:\Users\Administrator.Oskar-PC\AppData\Local\FlashFXP\4\History.dat
file	C:\ProgramData\GHISLER\wcx_ftp.ini
file	C:\Windows\wcx_ftp.ini
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\GHISLER\wcx_ftp.ini
file	C:\Users\Administrator.Oskar-PC\wcx_ftp.ini
file	C:\Users\Administrator.Oskar-PC\AppData\Local\GHISLER\wcx_ftp.ini
file	C:\Windows\32BitFtp.ini
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\CoffeeCup Software\SharedSettings_1_0_5.sqlite
file	C:\ProgramData\CoffeeCup Software\SharedSettings_1_0_5.ccs
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\CoffeeCup Software\SharedSettings_1_0_5.ccs
file	C:\Users\Administrator.Oskar-PC\AppData\Local\CoffeeCup Software\SharedSettings_1_0_5.ccs
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\CoffeeCup Software\SharedSettings.ccs
file	C:\Users\Administrator.Oskar-PC\AppData\Local\CoffeeCup Software\SharedSettings.ccs
file	C:\ProgramData\CoffeeCup Software\SharedSettings_1_0_5.sqlite
file	C:\ProgramData\CoffeeCup Software\SharedSettings.ccs
file	C:\Users\Administrator.Oskar-PC\AppData\Local\CoffeeCup Software\SharedSettings.sqlite
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\CoffeeCup Software\SharedSettings.sqlite

Manipulates memory of a non-child process indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2984 manipulating memory of non-child process 2948
1619686171.132626 NtAllocateVirtualMemory	process_identifier: 2948 region_size: 102400 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x0000ea2c allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496	0

Potential code injection by writing to the memory of another process (3 个事件)

Time & API	Arguments	Status	Return
1619686171.601626 WriteProcessMemory	process_identifier: 2496 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELªU_à2Pë0@{»~´X.text `.rdata0@@.dataM@J@À process_handle: 0x0000fa80 base_address: 0x00400000	success	1
1619686171.601626 WriteProcessMemory	process_identifier: 2496 buffer: aPLib v1.01 - the smaller the better :) Copyright (c) 1998-2009 by Joergen Ibsen, All Rights Reserved. More information: http://www.ibsensoftware.com/ ½·NkÁ%-öÖTìÝ¢b-oW- DhäHzS process_handle: 0x0000fa80 base_address: 0x00413000	success	1
1619686171.601626 WriteProcessMemory	process_identifier: 2496 buffer: @ process_handle: 0x0000fa80 base_address: 0x7efde008	success	1

Code injection by writing an executable or DLL to the memory of another process (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619686171.601626 WriteProcessMemory	process_identifier: 2496 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELªU_à2Pë0@{»~´X.text `.rdata0@@.dataM@J@À process_handle: 0x0000fa80 base_address: 0x00400000	success	1	0

Collects information about installed applications (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619697134.277249 RegQueryValueExA	key_handle: 0x00000138 value: Google Chrome regkey_r: DisplayName reg_type: 1 (REG_SZ) regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName	success	0	0

Harvests credentials from local email clients (7 个事件)

registry	HKEY_CURRENT_USER\Software\Microsoft\Internet Account Manager\Accounts
registry	HKEY_CURRENT_USER\Software\Microsoft\Windows Mail\Salt
registry	HKEY_CURRENT_USER\Software\Microsoft\Windows Live Mail
registry	HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook
registry	HKEY_CURRENT_USER\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts
registry	HKEY_LOCAL_MACHINE\Software\RimArts\B2\Settings
registry	HKEY_CURRENT_USER\Software\Poco Systems Inc

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2984 called NtSetContextThread to modify thread in remote process 2496
1619686171.601626 NtSetContextThread	thread_handle: 0x00010158 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4260331 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 2496	success	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2984 resumed a thread in remote process 2496
1619686171.867626 NtResumeThread	thread_handle: 0x00010158 suspend_count: 1 process_identifier: 2496	success	0	0

Executed a process and injected code into it, probably while unpacking (18 个事件)

Time & API	Arguments	Status	Return
1619686135.117626 NtResumeThread	thread_handle: 0x000000d0 suspend_count: 1 process_identifier: 2984	success	0
1619686135.226626 NtResumeThread	thread_handle: 0x00000158 suspend_count: 1 process_identifier: 2984	success	0
1619686170.992626 NtResumeThread	thread_handle: 0x00003c64 suspend_count: 1 process_identifier: 2984	success	0
1619686171.007626 NtResumeThread	thread_handle: 0x00009398 suspend_count: 1 process_identifier: 2984	success	0
1619686171.117626 CreateProcessInternalW	thread_identifier: 2960 thread_handle: 0x0000f114 process_identifier: 2948 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\90b37416f92cf65d79794c170169b116.exe track: 1 command_line: "{path}" filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\90b37416f92cf65d79794c170169b116.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x0000ea2c inherit_handles: 0	success	1
1619686171.132626 NtGetContextThread	thread_handle: 0x0000f114	success	0
1619686171.132626 NtAllocateVirtualMemory	process_identifier: 2948 region_size: 102400 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x0000ea2c allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496
1619686171.601626 CreateProcessInternalW	thread_identifier: 2668 thread_handle: 0x00010158 process_identifier: 2496 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\90b37416f92cf65d79794c170169b116.exe track: 1 command_line: "{path}" filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\90b37416f92cf65d79794c170169b116.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x0000fa80 inherit_handles: 0	success	1
1619686171.601626 NtGetContextThread	thread_handle: 0x00010158	success	0
1619686171.601626 NtAllocateVirtualMemory	process_identifier: 2496 region_size: 102400 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x0000fa80 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	success	0
1619686171.601626 WriteProcessMemory	process_identifier: 2496 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELªU_à2Pë0@{»~´X.text `.rdata0@@.dataM@J@À process_handle: 0x0000fa80 base_address: 0x00400000	success	1
1619686171.601626 WriteProcessMemory	process_identifier: 2496 buffer: process_handle: 0x0000fa80 base_address: 0x00401000	success	1
1619686171.601626 WriteProcessMemory	process_identifier: 2496 buffer: aPLib v1.01 - the smaller the better :) Copyright (c) 1998-2009 by Joergen Ibsen, All Rights Reserved. More information: http://www.ibsensoftware.com/ ½·NkÁ%-öÖTìÝ¢b-oW- DhäHzS process_handle: 0x0000fa80 base_address: 0x00413000	success	1
1619686171.601626 WriteProcessMemory	process_identifier: 2496 buffer: process_handle: 0x0000fa80 base_address: 0x00414000	success	1
1619686171.601626 WriteProcessMemory	process_identifier: 2496 buffer: @ process_handle: 0x0000fa80 base_address: 0x7efde008	success	1
1619686171.601626 NtSetContextThread	thread_handle: 0x00010158 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4260331 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 2496	success	0
1619686171.867626 NtResumeThread	thread_handle: 0x00010158 suspend_count: 1 process_identifier: 2496	success	0
1619697144.652249 CreateProcessInternalW	thread_identifier: 1416 thread_handle: 0x000002a0 process_identifier: 952 current_directory: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp filepath: track: 1 command_line: "C:\Users\ADMINI~1.OSK\AppData\Local\Temp\34936843.bat" "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\90b37416f92cf65d79794c170169b116.exe" filepath_r: stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) process_handle: 0x000002f4 inherit_handles: 0	success	1

File has been identified by 52 AntiVirus engines on VirusTotal as malicious (50 out of 52 个事件)

Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Bulz.11840
FireEye	Generic.mg.90b37416f92cf65d
CAT-QuickHeal	Trojan.YakbeexMSIL.ZZ4
McAfee	PWS-FCSU!90B37416F92C
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
Sangfor	Malware
K7AntiVirus	Trojan ( 0056ac491 )
BitDefender	Gen:Variant.Bulz.11840
K7GW	Trojan ( 0056ac491 )
Cybereason	malicious.6f92cf
Cyren	W32/MSIL_Kryptik.BIW.gen!Eldorado
Symantec	Trojan.Gen.MBT
APEX	Malicious
Avast	Win32:PWSX-gen [Trj]
Kaspersky	HEUR:Backdoor.MSIL.Androm.gen
Alibaba	Backdoor:MSIL/Androm.215fd957
NANO-Antivirus	Trojan.Win32.Androm.hpptma
Ad-Aware	Gen:Variant.Bulz.11840
Sophos	Mal/Generic-S
Comodo	Malware@#315bs1625n2oy
F-Secure	Trojan.TR/Kryptik.ucbiy
DrWeb	Trojan.PWS.Stealer.23680
TrendMicro	Backdoor.MSIL.ANDROM.THIAHBO
McAfee-GW-Edition	BehavesLike.Win32.Generic.dc
Emsisoft	Gen:Variant.Bulz.11840 (B)
SentinelOne	Static AI - Suspicious PE
Avira	TR/Kryptik.ucbiy
Antiy-AVL	Trojan[Backdoor]/MSIL.Androm
Kingsoft	Win32.Hack.Undef.(kcloud)
Microsoft	Backdoor:MSIL/Androm.KB
Gridinsoft	Trojan.Win32.Kryptik.oa!s1
Arcabit	Trojan.Bulz.D2E40
ZoneAlarm	HEUR:Backdoor.MSIL.Androm.gen
GData	Gen:Variant.Bulz.11840
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.Kryptik.C4171248
BitDefenderTheta	Gen:NN.ZemsilF.34700.7m0@aqF4Njf
ALYac	Gen:Variant.Bulz.11840
MAX	malware (ai score=85)
VBA32	TScope.Trojan.MSIL
Malwarebytes	Trojan.MalPack
Panda	Trj/GdSda.A
Zoner	Trojan.Win32.97361
ESET-NOD32	a variant of MSIL/Kryptik.WXF
TrendMicro-HouseCall	Backdoor.MSIL.ANDROM.THIAHBO
Fortinet	MSIL/Kryptik.WXF!tr
MaxSecure	Trojan.Malware.300983.susgen
AVG	Win32:PWSX-gen [Trj]

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-07-29 08:06:39

Imports

Library mscoree.dll:

• 0x402000 _CorExeMain

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	50002	114.114.114.114	53
192.168.56.101	57874	114.114.114.114	53
192.168.56.101	62318	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	49235	224.0.0.252	5355
192.168.56.101	50534	224.0.0.252	5355
192.168.56.101	51378	224.0.0.252	5355
192.168.56.101	51808	224.0.0.252	5355
192.168.56.101	51963	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	57756	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	63429	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	50003	239.255.255.250	3702
192.168.56.101	50005	239.255.255.250	3702
192.168.56.101	50537	239.255.255.250	1900
192.168.56.101	51809	239.255.255.250	3702
192.168.56.101	58707	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.