12.4
0-day
53 个模型检测该样本为恶意！
重新分析
更多

922be6acb1365bac828b5493a4ba1a5fd0d214a5273f39bfbaf932d80c9b5a75

a022225186d5cb11c605e84fa778f489.exe

分析耗时

190s

最近分析

文件大小

695.0KB
静态报毒 动态报毒 100% AI SCORE=87 AIDETECTVM ATTRIBUTE AVEMARIA AVEMARIARAT CLASSIC CONFIDENCE DOWNLOADER33 ELDORADO GDSDA GENCIRC GENERICRXAA HIGH CONFIDENCE HIGHCONFIDENCE HLXMYJ KCLOUD KRYPTIK KVM007 MALICIOUS PE MALWARE1 MALWARE@#2OVSEFRMNUSMO MHWNLEGGTUG MULTIPLUG SCORE SONBOKLI STATIC AI UNSAFE USKSB 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee GenericRXAA-AA!A022225186D5 20201211 6.0.6.653
CrowdStrike win/malicious_confidence_100% (W) 20190702 1.0
Baidu 20190318 1.0.0.2
Avast Win32:Malware-gen 20201210 21.1.5827.0
Alibaba TrojanSpy:Win32/AveMaria.8db1b030 20190527 0.3.0.5
Kingsoft Win32.Heur.KVM007.a.(kcloud) 20201211 2017.9.26.565
Tencent Malware.Win32.Gencirc.10cdd8db 20201211 1.0.0.1
静态指标
Queries for the computername (12 个事件)
Time & API Arguments Status Return Repeated
1619819447.3535
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619819447.4635
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619819447.4635
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619819447.5105
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619819457.7285
GetComputerNameA
computer_name: OSKAR-PC
success 1 0
1619819457.7285
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619819458.52575
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619819458.54175
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619819458.54175
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619819458.55675
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619819459.04175
GetComputerNameA
computer_name: OSKAR-PC
success 1 0
1619819459.04175
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
Checks if process is being debugged by a debugger (2 个事件)
Time & API Arguments Status Return Repeated
1619819449.5255
IsDebuggerPresent
failed 0 0
1619819458.63575
IsDebuggerPresent
failed 0 0
Command line console output was observed (17 个事件)
Time & API Arguments Status Return Repeated
1619819459.6815
WriteConsoleW
buffer: 无法将“Add-MpPreference”项识别为 cmdlet、函数、脚本文件或可运行程序的名称。请
console_handle: 0x00000023
success 1 0
1619819459.6815
WriteConsoleW
buffer: 检查名称的拼写，如果包括路径，请确保路径正确，然后重试。
console_handle: 0x0000002f
success 1 0
1619819459.6975
WriteConsoleW
buffer: 所在位置 行:1 字符: 17
console_handle: 0x0000003b
success 1 0
1619819459.6975
WriteConsoleW
buffer: + Add-MpPreference <<<< -ExclusionPath C:\
console_handle: 0x00000047
success 1 0
1619819459.6975
WriteConsoleW
buffer: + CategoryInfo : ObjectNotFound: (Add-MpPreference:String) [], Co
console_handle: 0x00000053
success 1 0
1619819459.6975
WriteConsoleW
buffer: mmandNotFoundException
console_handle: 0x0000005f
success 1 0
1619819459.6975
WriteConsoleW
buffer: + FullyQualifiedErrorId : CommandNotFoundException
console_handle: 0x0000006b
success 1 0
1619819459.68175
WriteConsoleW
buffer: 无法将“Add-MpPreference”项识别为 cmdlet、函数、脚本文件或可运行程序的名称。请
console_handle: 0x00000023
success 1 0
1619819459.69775
WriteConsoleW
buffer: 检查名称的拼写，如果包括路径，请确保路径正确，然后重试。
console_handle: 0x0000002f
success 1 0
1619819459.69775
WriteConsoleW
buffer: 所在位置 行:1 字符: 17
console_handle: 0x0000003b
success 1 0
1619819459.71375
WriteConsoleW
buffer: + Add-MpPreference <<<< -ExclusionPath C:\
console_handle: 0x00000047
success 1 0
1619819459.71375
WriteConsoleW
buffer: + CategoryInfo : ObjectNotFound: (Add-MpPreference:String) [], Co
console_handle: 0x00000053
success 1 0
1619819459.71375
WriteConsoleW
buffer: mmandNotFoundException
console_handle: 0x0000005f
success 1 0
1619819459.71375
WriteConsoleW
buffer: + FullyQualifiedErrorId : CommandNotFoundException
console_handle: 0x0000006b
success 1 0
1619819457.619
WriteConsoleW
buffer: Microsoft Windows [版本 6.1.7601]
console_handle: 0x00000007
success 1 0
1619819457.619
WriteConsoleW
buffer: 版权所有 (c) 2009 Microsoft Corporation。保留所有权利。
console_handle: 0x00000007
success 1 0
1619819457.619
WriteConsoleW
buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp>
console_handle: 0x00000007
success 1 0
Uses Windows APIs to generate a cryptographic key (50 out of 128 个事件)
Time & API Arguments Status Return Repeated
1619819451.3535
CryptExportKey
crypto_handle: 0x007479e0
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619819453.2755
CryptExportKey
crypto_handle: 0x007478a0
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619819453.2755
CryptExportKey
crypto_handle: 0x007478a0
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619819453.2755
CryptExportKey
crypto_handle: 0x007478a0
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619819453.4315
CryptExportKey
crypto_handle: 0x007478a0
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619819453.4315
CryptExportKey
crypto_handle: 0x007478a0
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619819453.4315
CryptExportKey
crypto_handle: 0x007478a0
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619819453.4785
CryptExportKey
crypto_handle: 0x007478a0
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619819453.5105
CryptExportKey
crypto_handle: 0x00746de0
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619819453.5105
CryptExportKey
crypto_handle: 0x00746de0
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619819453.5725
CryptExportKey
crypto_handle: 0x00746de0
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619819453.5725
CryptExportKey
crypto_handle: 0x00746de0
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619819453.5725
CryptExportKey
crypto_handle: 0x00746de0
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619819453.5725
CryptExportKey
crypto_handle: 0x00746de0
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619819454.2135
CryptExportKey
crypto_handle: 0x00747320
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619819454.2135
CryptExportKey
crypto_handle: 0x00747320
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619819454.2135
CryptExportKey
crypto_handle: 0x00747320
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619819454.2135
CryptExportKey
crypto_handle: 0x00747320
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619819454.2135
CryptExportKey
crypto_handle: 0x00747320
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619819454.2135
CryptExportKey
crypto_handle: 0x00747320
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619819454.2285
CryptExportKey
crypto_handle: 0x00747320
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619819457.1975
CryptExportKey
crypto_handle: 0x007476e0
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619819457.1975
CryptExportKey
crypto_handle: 0x007476e0
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619819457.1975
CryptExportKey
crypto_handle: 0x007476e0
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619819457.2135
CryptExportKey
crypto_handle: 0x00747220
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619819457.3065
CryptExportKey
crypto_handle: 0x007476e0
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619819457.3065
CryptExportKey
crypto_handle: 0x007476e0
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619819457.3065
CryptExportKey
crypto_handle: 0x007476e0
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619819457.3065
CryptExportKey
crypto_handle: 0x007476e0
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619819457.3695
CryptExportKey
crypto_handle: 0x007476e0
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619819457.4005
CryptExportKey
crypto_handle: 0x007476e0
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619819457.4005
CryptExportKey
crypto_handle: 0x007476e0
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619819457.5255
CryptExportKey
crypto_handle: 0x007476e0
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619819457.5255
CryptExportKey
crypto_handle: 0x007476e0
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619819457.6035
CryptExportKey
crypto_handle: 0x00747620
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619819457.6035
CryptExportKey
crypto_handle: 0x00747620
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619819457.6035
CryptExportKey
crypto_handle: 0x00747620
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619819457.6195
CryptExportKey
crypto_handle: 0x00747620
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619819457.6195
CryptExportKey
crypto_handle: 0x00747620
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619819457.6195
CryptExportKey
crypto_handle: 0x00747620
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619819457.6355
CryptExportKey
crypto_handle: 0x00747620
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619819457.6815
CryptExportKey
crypto_handle: 0x00746ca0
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619819457.6815
CryptExportKey
crypto_handle: 0x00746ca0
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619819458.5255
CryptExportKey
crypto_handle: 0x00746ca0
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619819458.5255
CryptExportKey
crypto_handle: 0x00746ca0
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619819458.5255
CryptExportKey
crypto_handle: 0x00746ca0
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619819458.5255
CryptExportKey
crypto_handle: 0x00746ca0
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619819458.5255
CryptExportKey
crypto_handle: 0x00746ca0
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619819458.5565
CryptExportKey
crypto_handle: 0x00746ca0
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619819458.5565
CryptExportKey
crypto_handle: 0x00746ca0
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
This executable has a PDB path (1 个事件)
pdb_path C:\Users\W7H64\Desktop\VCSamples-master\VC2010Samples\ATL\Controls\Polygon\polygunu.pdb
Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)
Time & API Arguments Status Return Repeated
1619819436.963625
GlobalMemoryStatusEx
success 1 0
行为判定
动态指标
HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 个事件)
suspicious_features POST method with no referer header suspicious_request POST https://update.googleapis.com/service/update2?cup2key=10:2107161622&cup2hreq=e0c096292b2dacbb3c98e51de304ec6d8f893a0648b214fcd6dff41bca64a1f3
Performs some HTTP requests (4 个事件)
request HEAD http://redirector.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe
request HEAD http://r1---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?cms_redirect=yes&mh=ms&mip=202.100.214.100&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619790502&mv=m&mvi=1&pl=23&shardbypass=yes
request HEAD http://r3---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=e6f614b5df76ecc3&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619790258&mv=m
request POST https://update.googleapis.com/service/update2?cup2key=10:2107161622&cup2hreq=e0c096292b2dacbb3c98e51de304ec6d8f893a0648b214fcd6dff41bca64a1f3
Sends data using the HTTP POST Method (1 个事件)
request POST https://update.googleapis.com/service/update2?cup2key=10:2107161622&cup2hreq=e0c096292b2dacbb3c98e51de304ec6d8f893a0648b214fcd6dff41bca64a1f3
Allocates read-write-execute memory (usually to unpack itself) (50 out of 284 个事件)
Time & API Arguments Status Return Repeated
1619819423.900625
NtAllocateVirtualMemory
process_identifier: 2668
region_size: 1048576
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00390000
success 0 0
1619819060.638896
NtAllocateVirtualMemory
process_identifier: 1424
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00000000041b0000
success 0 0
1619819439.713125
NtAllocateVirtualMemory
process_identifier: 2308
region_size: 1048576
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00800000
success 0 0
1619819456.963125
NtAllocateVirtualMemory
process_identifier: 2308
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x034b0000
success 0 0
1619819448.2755
NtAllocateVirtualMemory
process_identifier: 912
region_size: 1966080
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x03100000
success 0 0
1619819448.2755
NtAllocateVirtualMemory
process_identifier: 912
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x032a0000
success 0 0
1619819449.4475
NtProtectVirtualMemory
process_identifier: 912
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x72431000
success 0 0
1619819449.5255
NtAllocateVirtualMemory
process_identifier: 912
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0285a000
success 0 0
1619819449.5255
NtProtectVirtualMemory
process_identifier: 912
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x72432000
success 0 0
1619819449.5255
NtAllocateVirtualMemory
process_identifier: 912
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02852000
success 0 0
1619819449.7445
NtAllocateVirtualMemory
process_identifier: 912
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02862000
success 0 0
1619819449.7915
NtAllocateVirtualMemory
process_identifier: 912
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x032a1000
success 0 0
1619819449.8855
NtAllocateVirtualMemory
process_identifier: 912
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x032a2000
success 0 0
1619819449.9945
NtAllocateVirtualMemory
process_identifier: 912
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x028ca000
success 0 0
1619819450.3535
NtAllocateVirtualMemory
process_identifier: 912
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02863000
success 0 0
1619819450.9475
NtAllocateVirtualMemory
process_identifier: 912
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02864000
success 0 0
1619819450.9475
NtAllocateVirtualMemory
process_identifier: 912
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x028eb000
success 0 0
1619819450.9475
NtAllocateVirtualMemory
process_identifier: 912
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x028e7000
success 0 0
1619819451.1355
NtAllocateVirtualMemory
process_identifier: 912
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0285b000
success 0 0
1619819451.2605
NtAllocateVirtualMemory
process_identifier: 912
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x028c2000
success 0 0
1619819451.2915
NtAllocateVirtualMemory
process_identifier: 912
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x028e5000
success 0 0
1619819452.0725
NtAllocateVirtualMemory
process_identifier: 912
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02865000
success 0 0
1619819453.1975
NtAllocateVirtualMemory
process_identifier: 912
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x028cc000
success 0 0
1619819453.4785
NtAllocateVirtualMemory
process_identifier: 912
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x028c3000
success 0 0
1619819453.5105
NtAllocateVirtualMemory
process_identifier: 912
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x03190000
success 0 0
1619819454.1035
NtAllocateVirtualMemory
process_identifier: 912
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02866000
success 0 0
1619819454.2135
NtAllocateVirtualMemory
process_identifier: 912
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x028ec000
success 0 0
1619819455.8065
NtAllocateVirtualMemory
process_identifier: 912
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x028c4000
success 0 0
1619819455.8065
NtAllocateVirtualMemory
process_identifier: 912
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x028c5000
success 0 0
1619819455.8065
NtAllocateVirtualMemory
process_identifier: 912
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x028c6000
success 0 0
1619819455.8065
NtAllocateVirtualMemory
process_identifier: 912
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x028c7000
success 0 0
1619819455.8065
NtAllocateVirtualMemory
process_identifier: 912
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x028c8000
success 0 0
1619819455.8065
NtAllocateVirtualMemory
process_identifier: 912
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x028c9000
success 0 0
1619819455.8065
NtAllocateVirtualMemory
process_identifier: 912
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x03230000
success 0 0
1619819455.8065
NtAllocateVirtualMemory
process_identifier: 912
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x03231000
success 0 0
1619819455.8065
NtAllocateVirtualMemory
process_identifier: 912
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x03232000
success 0 0
1619819455.8065
NtAllocateVirtualMemory
process_identifier: 912
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x03233000
success 0 0
1619819455.8065
NtAllocateVirtualMemory
process_identifier: 912
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x03234000
success 0 0
1619819455.8065
NtAllocateVirtualMemory
process_identifier: 912
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x03235000
success 0 0
1619819455.8065
NtAllocateVirtualMemory
process_identifier: 912
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x03236000
success 0 0
1619819455.8065
NtAllocateVirtualMemory
process_identifier: 912
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x03237000
success 0 0
1619819455.8065
NtAllocateVirtualMemory
process_identifier: 912
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x03238000
success 0 0
1619819455.8065
NtAllocateVirtualMemory
process_identifier: 912
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x03239000
success 0 0
1619819455.8065
NtAllocateVirtualMemory
process_identifier: 912
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0323a000
success 0 0
1619819455.8065
NtAllocateVirtualMemory
process_identifier: 912
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0323b000
success 0 0
1619819455.8065
NtAllocateVirtualMemory
process_identifier: 912
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0323c000
success 0 0
1619819455.8065
NtAllocateVirtualMemory
process_identifier: 912
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0323d000
success 0 0
1619819455.8065
NtAllocateVirtualMemory
process_identifier: 912
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0323e000
success 0 0
1619819455.8065
NtAllocateVirtualMemory
process_identifier: 912
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0323f000
success 0 0
1619819455.8065
NtAllocateVirtualMemory
process_identifier: 912
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x03240000
success 0 0
Checks whether any human activity is being performed by constantly checking whether the foreground window changed
A process attempted to delay the analysis task. (2 个事件)
description cmd.exe tried to sleep 120 seconds, actually delayed analysis time by 120 seconds
description images.exe tried to sleep 133 seconds, actually delayed analysis time by 133 seconds
Creates executable files on the filesystem (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat
Creates a shortcut to an executable file (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk
Creates a suspicious process (2 个事件)
cmdline powershell Add-MpPreference -ExclusionPath C:\
cmdline C:\Windows\System32\cmd.exe
A process created a hidden window (1 个事件)
Time & API Arguments Status Return Repeated
1619819457.291125
CreateProcessInternalW
thread_identifier: 2168
thread_handle: 0x000001f0
process_identifier: 2248
current_directory:
filepath: C:\Windows\System32\cmd.exe
track: 1
command_line:
filepath_r: C:\Windows\System32\cmd.exe
stack_pivoted: 0
creation_flags: 134217728 (CREATE_NO_WINDOW)
process_handle: 0x000001e8
inherit_handles: 0
success 1 0
The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)
entropy 7.4826630529526295 section {'size_of_data': '0x0002c400', 'virtual_address': '0x0004c000', 'entropy': 7.4826630529526295, 'name': '.data', 'virtual_size': '0x0002d59c'} description A section with a high entropy has been found
entropy 0.25504322766570603 description Overall entropy of this PE file is high
Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 个事件)
Time & API Arguments Status Return Repeated
1619819451.1195
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1619819458.66675
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
网络通信
Communicates with host for which no DNS query was performed (2 个事件)
host 172.217.24.14
host 185.244.29.130
Creates an Alternate Data Stream (ADS) (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat:start
Allocates execute permission to another process indicative of possible code injection (2 个事件)
Time & API Arguments Status Return Repeated
1619819458.291125
NtAllocateVirtualMemory
process_identifier: 2248
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x000001f4
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00390000
success 0 0
1619819458.291125
NtProtectVirtualMemory
process_identifier: 2248
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x000001f4
base_address: 0x00390000
success 0 0
Installs itself for autorun at Windows startup (3 个事件)
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Images reg_value C:\ProgramData\images.exe
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat:start
Potential code injection by writing to the memory of another process (2 个事件)
Time & API Arguments Status Return Repeated
1619819458.291125
WriteProcessMemory
process_identifier: 2248
buffer: U‹ì‹U‹E‹È…Òt ÆAƒêu÷]ÃU‹ìd¡0ƒì‹@ SVW‹x 駋G03ö‹_,‹?‰Eø‹B<‰}ô‹Dx‰Eð…À„…Áë3ɅÛt-‹}ø¾ÁÎ €<a‰Uø| ‹ÂƒÀàðëuøA;ËrߋUü‹}ô‹Eð‹L3ۋD ‰Mì…Ét<‹3ÿʃÀ‰Mø‹Ñ‰EèŠ ÁÏ ¾ÁøB„Éuñ‹Uü‰}ø‹Eø‹}ôÆ;Et ‹EèC;]ìrċW‰Uü…Ò…Kÿÿÿ3À_^[É‹uð‹D$X· ‹Dˆ‹ÂëÝU‹ìì¼‹ESVW‹XhLw&‰M ‰]¸èèþÿÿ‹ðÇEÄkern3ÀÇEÈel32ˆEЈEލEÄPÇEÌ.dllÇEàntdlÇEäl.dlfÇEèlÇEÔuserÇEØ32.dfÇEÜllfÇEø1fÇEü2ÿ֍EàPÿ֍EÔPÿÖhX¤SåèyþÿÿhyÌ?†‰EèlþÿÿhEƒV‰Eôè_þÿÿhDð5à‰EÀèRþÿÿhP‰E¤èEþÿÿhƖ‡R‰Eœè8þÿÿh_xTî‰Eðè+þÿÿhÚöÚO‰E˜èþÿÿ‹øhÆp‰}´èþÿÿh­ž_»‹ðèþÿÿh-W®[‰E¼èöýÿÿ‰E¬3ÀPh€jPPh€S‰E¨ÿ×j‰EìPÿ֋]‹ø‰}°jh0WjÿӋð…ötîjE¨PW‹}ìVWÿU¼WÿUð€>M‹]¸t jEøPPjÿUÀÆE hà.ÿU¤3À}ˆ«jDj«««…DÿÿÿPèTýÿÿƒÄ ÿu jhÿÿÿUœ‰E¼…ÀuOEˆP…DÿÿÿP3ÀPPPPPPPSÿUô…À…¯PPjPPh@S‰E¸ÿU´‹øjƒÿÿtE¸ë^EüPPjÿUÀ鄃eìMìQPÿU˜}ìtoEˆP…DÿÿÿP3ÀPPPPPPPSÿUô…ÀuOPPjPPh@S‰EÿU´‹øjƒÿÿt*EPÿu°VWÿU¬WÿUðEˆP…DÿÿÿP3ÀPPPPPPPSÿUôë EüPPjÿUÀÆE ÿu¼ÿUð€} „åþÿÿ_^[ÉÃì[‘d‰=K
process_handle: 0x000001f4
base_address: 0x00390000
success 1 0
1619819458.291125
WriteProcessMemory
process_identifier: 2248
buffer:  C:\ProgramData\images.exeŒ÷Gè€|è$øG$øGP,w|,wîfL…¬øGK$€igÿÿÿÿÿÌ÷G°øG¨ÿGà^‘w2æšðþÿÿÿ|,w 5wè
process_handle: 0x000001f4
base_address: 0x003a0000
success 1 0
Attempts to remove evidence of file being downloaded from the Internet (1 个事件)
file C:\ProgramData\images.exe:Zone.Identifier
File has been identified by 53 AntiVirus engines on VirusTotal as malicious (50 out of 53 个事件)
Bkav W32.AIDetectVM.malware1
Elastic malicious (high confidence)
MicroWorld-eScan Gen:Variant.Crypt.81
FireEye Generic.mg.a022225186d5cb11
McAfee GenericRXAA-AA!A022225186D5
Cylance Unsafe
VIPRE Trojan.Win32.Generic!BT
AegisLab Trojan.Win32.AveMaria.l!c
Sangfor Malware
K7AntiVirus Riskware ( 0040eff71 )
BitDefender Gen:Variant.Crypt.81
K7GW Riskware ( 0040eff71 )
CrowdStrike win/malicious_confidence_100% (W)
Cyren W32/Kryptik.BKJ.gen!Eldorado
Symantec ML.Attribute.HighConfidence
APEX Malicious
Avast Win32:Malware-gen
Kaspersky Trojan-Spy.Win32.AveMaria.dhd
Alibaba TrojanSpy:Win32/AveMaria.8db1b030
NANO-Antivirus Trojan.Win32.Dwn.hlxmyj
Rising Trojan.Kryptik!1.C527 (CLASSIC)
Ad-Aware Gen:Variant.Crypt.81
Emsisoft Gen:Variant.Crypt.81 (B)
Comodo Malware@#2ovsefrmnusmo
F-Secure Trojan.TR/Agent.usksb
DrWeb Trojan.DownLoader33.57623
Zillya Trojan.AveMaria.Win32.556
McAfee-GW-Edition BehavesLike.Win32.MultiPlug.jh
Sophos Mal/Generic-S
Jiangmin TrojanSpy.AveMaria.jj
Webroot W32.AveMaria
Avira TR/Agent.usksb
MAX malware (ai score=87)
Antiy-AVL Trojan[Spy]/Win32.AveMaria
Kingsoft Win32.Heur.KVM007.a.(kcloud)
Microsoft Trojan:Win32/Avemariarat.VU!MTB
Gridinsoft Trojan.Win32.Agent.oa
Arcabit Trojan.Crypt.81
ZoneAlarm Trojan-Spy.Win32.AveMaria.dhd
GData Gen:Variant.Crypt.81
Cynet Malicious (score: 100)
ALYac Gen:Variant.Crypt.81
VBA32 Trojan.Sonbokli
Panda Trj/GdSda.A
ESET-NOD32 Win32/Agent.TJS
Tencent Malware.Win32.Gencirc.10cdd8db
Yandex Trojan.Agent!mHwNLeGgtug
SentinelOne Static AI - Malicious PE
Fortinet W32/Agent.TJS!tr
AVG Win32:Malware-gen
Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (4 个事件)
dead_host 172.217.160.110:443
dead_host 172.217.27.142:443
dead_host 172.217.24.14:443
dead_host 185.244.29.130:5200
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2020-06-20 14:30:26

Imports

Library KERNEL32.dll:
• 0x441004 GetLastError
• 0x441008 RaiseException
• 0x44100c DecodePointer
• 0x441014 GetCurrentProcess
• 0x441018 Sleep
• 0x44101c FreeConsole
• 0x441020 VirtualAllocEx
• 0x441024 CreateFileW
• 0x441028 SetFilePointerEx
• 0x44102c GetConsoleMode
• 0x441030 GetConsoleCP
• 0x441034 FlushFileBuffers
• 0x441038 GetStringTypeW
• 0x44103c SetStdHandle
• 0x441040 OutputDebugStringA
• 0x441048 GetFileType
• 0x44104c GetProcessHeap
• 0x441050 EnumSystemLocalesW
• 0x441054 GetUserDefaultLCID
• 0x441058 IsDebuggerPresent
• 0x44105c OutputDebugStringW
• 0x441068 CloseHandle
• 0x441070 SetEvent
• 0x441074 ResetEvent
• 0x44107c CreateEventW
• 0x441080 GetModuleHandleW
• 0x441084 GetProcAddress
• 0x441090 GetStartupInfoW
• 0x44109c GetCurrentProcessId
• 0x4410a0 GetCurrentThreadId
• 0x4410a8 InitializeSListHead
• 0x4410ac TerminateProcess
• 0x4410b0 RtlUnwind
• 0x4410bc SetLastError
• 0x4410c0 EncodePointer
• 0x4410c4 TlsAlloc
• 0x4410c8 TlsGetValue
• 0x4410cc TlsSetValue
• 0x4410d0 TlsFree
• 0x4410d4 FreeLibrary
• 0x4410d8 LoadLibraryExW
• 0x4410dc ExitProcess
• 0x4410e0 GetModuleHandleExW
• 0x4410e4 GetModuleFileNameA
• 0x4410e8 GetModuleFileNameW
• 0x4410ec MultiByteToWideChar
• 0x4410f0 WideCharToMultiByte
• 0x4410f4 GetStdHandle
• 0x4410f8 WriteFile
• 0x4410fc GetCommandLineA
• 0x441100 GetCommandLineW
• 0x441104 GetACP
• 0x441108 HeapFree
• 0x44110c GetCurrentThread
• 0x441110 HeapSize
• 0x441114 HeapReAlloc
• 0x441118 HeapAlloc
• 0x44111c FindClose
• 0x441120 FindFirstFileExA
• 0x441124 FindFirstFileExW
• 0x441128 FindNextFileA
• 0x44112c FindNextFileW
• 0x441130 IsValidCodePage
• 0x441134 GetOEMCP
• 0x441138 GetCPInfo
• 0x44114c GetDateFormatW
• 0x441150 GetTimeFormatW
• 0x441154 CompareStringW
• 0x441158 LCMapStringW
• 0x44115c GetLocaleInfoW
• 0x441160 IsValidLocale
• 0x441164 WriteConsoleW
Library USER32.dll:
• 0x441180 LoadStringW
• 0x441184 UnregisterClassW
• 0x441188 InvalidateRect
Library ole32.dll:
• 0x441190 CoTaskMemFree
• 0x441194 ProgIDFromCLSID
Library OLEAUT32.dll:
• 0x44116c SysFreeString
• 0x441170 VariantClear
• 0x441174 CreateErrorInfo
• 0x441178 SetErrorInfo

Hosts

No hosts contacted.

TCP

Source Source Port Destination Destination Port
192.168.56.101 49208 113.108.239.194 r1---sn-j5o7dn7e.gvt1.com 80
192.168.56.101 49209 113.108.239.196 r3---sn-j5o7dn7e.gvt1.com 80
192.168.56.101 49204 203.208.40.98 update.googleapis.com 443
192.168.56.101 49207 203.208.41.65 redirector.gvt1.com 80

UDP

Source Source Port Destination Destination Port
192.168.56.101 49235 114.114.114.114 53
192.168.56.101 53500 114.114.114.114 53
192.168.56.101 53657 114.114.114.114 53
192.168.56.101 55368 114.114.114.114 53
192.168.56.101 56743 114.114.114.114 53
192.168.56.101 58070 114.114.114.114 53
192.168.56.101 60088 114.114.114.114 53
192.168.56.101 60123 114.114.114.114 53
192.168.56.101 60215 114.114.114.114 53
192.168.56.101 62912 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 50002 224.0.0.252 5355
192.168.56.101 50534 224.0.0.252 5355
192.168.56.101 51808 224.0.0.252 5355
192.168.56.101 51963 224.0.0.252 5355
192.168.56.101 53210 224.0.0.252 5355
192.168.56.101 54991 224.0.0.252 5355
192.168.56.101 56539 224.0.0.252 5355

HTTP & HTTPS Requests

URI Data
http://redirector.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe 
HEAD /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: redirector.gvt1.com
http://r3---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=e6f614b5df76ecc3&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619790258&mv=m 
HEAD /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=e6f614b5df76ecc3&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619790258&mv=m HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: r3---sn-j5o7dn7e.gvt1.com
http://r1---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?cms_redirect=yes&mh=ms&mip=202.100.214.100&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619790502&mv=m&mvi=1&pl=23&shardbypass=yes 
HEAD /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?cms_redirect=yes&mh=ms&mip=202.100.214.100&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619790502&mv=m&mvi=1&pl=23&shardbypass=yes HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: r1---sn-j5o7dn7e.gvt1.com

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.