SmartHawk

2.0

低危

58 个模型检测该样本为恶意！

重新分析

下载样本

04b49e363015e5979db2b89c66a695dc4c12369c8febb678e46815674636b5e6

04b49e363015e5979db2b89c66a695dc4c12369c8febb678e46815674636b5e6.exe

分析耗时

269s

最近分析

391天前

文件大小

17.0KB

静态报毒动态报毒 CVE FAMILY METATYPE PLATFORM TYPE UNKNOWN WIN32 TROJAN ALKT

DACN 0.14

FACILE 1.00

IMCLNet 0.52

MFGraph 0.00

引擎	描述	特征	威胁分数	可能家族	检测耗时
DACN	基于动态分析和胶囊网络的可视化恶意软件检测	API调用、DLL以及注册表的修改情况	0.14	Unknown	0.11s
FACILE	利用改进的层次胶囊网络对二进制恶意软件图像进行识别分类	二进制图像映射为的灰度图像	1.00	Unknown	0.04s
IMCLNet	轻量化深度卷积网络模型实现恶意软件家族检测	原始二进制映射而成的可视化图像	0.52	Unknown	0.22s
MFGraph	利用静态特征构建图网络以检测恶意软件	原始二进制PE文件的静态特征节点	0.00	Unknown	0.00s

查杀引擎	查杀结果	查杀时间	查杀版本
Alibaba	None	20190527	0.3.0.5
Avast	Win32:Small-MHL [Trj]	20200215	18.4.3895.0
Baidu	None	20190318	1.0.0.2
CrowdStrike	win/malicious_confidence_100% (D)	20190702	1.0
Kingsoft	None	20200215	2013.8.14.323
McAfee	QLowZones-43	20200215	6.0.6.653
Tencent	Malware.Win32.Gencirc.10b3fdaa	20200215	1.0.0.1

检查系统中的内存量，这可以用于检测可用内存较少的虚拟机 (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1727545297.73425 GlobalMemoryStatusEx		success	1	0

搜索运行中的进程，可能用于识别沙箱规避、代码注入或内存转储的进程 (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1727545297.70325 Process32NextW	snapshot_handle: 0x000000b0 process_name: taskhost.exe process_identifier: 2972	success	1	0
1727545297.70325 Process32NextW	snapshot_handle: 0x000000b0 process_name: LSAS.EXE process_identifier: 2112	success	1	0

重复搜索未找到的进程，您可能希望在分析期间运行一个网络浏览器 (50 out of 107 个事件)

Time & API	Arguments	Status
1727545297.70325 Process32NextW	snapshot_handle: 0x000000b0 process_name: LSAS.EXE process_identifier: 2112	failed
1727545298.82825 Process32NextW	snapshot_handle: 0x00000148 process_name: LSAS.EXE process_identifier: 2112	failed
1727545299.92125 Process32NextW	snapshot_handle: 0x00000140 process_name: LSAS.EXE process_identifier: 2112	failed
1727545301.03125 Process32NextW	snapshot_handle: 0x00000148 process_name: LSAS.EXE process_identifier: 2112	failed
1727545302.14025 Process32NextW	snapshot_handle: 0x00000140 process_name: LSAS.EXE process_identifier: 2112	failed
1727545303.23425 Process32NextW	snapshot_handle: 0x00000148 process_name: LSAS.EXE process_identifier: 2112	failed
1727545304.32825 Process32NextW	snapshot_handle: 0x00000140 process_name: LSAS.EXE process_identifier: 2112	failed
1727545305.42125 Process32NextW	snapshot_handle: 0x00000148 process_name: LSAS.EXE process_identifier: 2112	failed
1727545306.51525 Process32NextW	snapshot_handle: 0x00000140 process_name: LSAS.EXE process_identifier: 2112	failed
1727545307.60925 Process32NextW	snapshot_handle: 0x00000148 process_name: LSAS.EXE process_identifier: 2112	failed
1727545308.70325 Process32NextW	snapshot_handle: 0x00000140 process_name: LSAS.EXE process_identifier: 2112	failed
1727545309.81225 Process32NextW	snapshot_handle: 0x00000148 process_name: LSAS.EXE process_identifier: 2112	failed
1727545310.93725 Process32NextW	snapshot_handle: 0x00000140 process_name: LSAS.EXE process_identifier: 2112	failed
1727545312.03125 Process32NextW	snapshot_handle: 0x00000148 process_name: LSAS.EXE process_identifier: 2112	failed
1727545313.12425 Process32NextW	snapshot_handle: 0x00000140 process_name: LSAS.EXE process_identifier: 2112	failed
1727545314.23425 Process32NextW	snapshot_handle: 0x00000148 process_name: LSAS.EXE process_identifier: 2112	failed
1727545315.32825 Process32NextW	snapshot_handle: 0x00000140 process_name: LSAS.EXE process_identifier: 2112	failed
1727545316.43725 Process32NextW	snapshot_handle: 0x00000148 process_name: LSAS.EXE process_identifier: 2112	failed
1727545317.54625 Process32NextW	snapshot_handle: 0x00000140 process_name: LSAS.EXE process_identifier: 2112	failed
1727545318.64025 Process32NextW	snapshot_handle: 0x00000148 process_name: LSAS.EXE process_identifier: 2112	failed
1727545319.73425 Process32NextW	snapshot_handle: 0x00000140 process_name: LSAS.EXE process_identifier: 2112	failed
1727545320.84325 Process32NextW	snapshot_handle: 0x00000148 process_name: LSAS.EXE process_identifier: 2112	failed
1727545321.93725 Process32NextW	snapshot_handle: 0x00000140 process_name: LSAS.EXE process_identifier: 2112	failed
1727545323.03125 Process32NextW	snapshot_handle: 0x00000148 process_name: LSAS.EXE process_identifier: 2112	failed
1727545324.14025 Process32NextW	snapshot_handle: 0x00000140 process_name: LSAS.EXE process_identifier: 2112	failed
1727545325.23425 Process32NextW	snapshot_handle: 0x00000148 process_name: LSAS.EXE process_identifier: 2112	failed
1727545326.32825 Process32NextW	snapshot_handle: 0x00000140 process_name: LSAS.EXE process_identifier: 2112	failed
1727545327.43725 Process32NextW	snapshot_handle: 0x00000148 process_name: LSAS.EXE process_identifier: 2112	failed
1727545328.53125 Process32NextW	snapshot_handle: 0x00000140 process_name: LSAS.EXE process_identifier: 2112	failed
1727545329.64025 Process32NextW	snapshot_handle: 0x00000148 process_name: LSAS.EXE process_identifier: 2112	failed
1727545330.73425 Process32NextW	snapshot_handle: 0x00000140 process_name: LSAS.EXE process_identifier: 2112	failed
1727545331.84325 Process32NextW	snapshot_handle: 0x00000148 process_name: LSAS.EXE process_identifier: 2112	failed
1727545332.93725 Process32NextW	snapshot_handle: 0x00000140 process_name: LSAS.EXE process_identifier: 2112	failed
1727545334.04625 Process32NextW	snapshot_handle: 0x00000148 process_name: LSAS.EXE process_identifier: 2112	failed
1727545335.14025 Process32NextW	snapshot_handle: 0x00000140 process_name: LSAS.EXE process_identifier: 2112	failed
1727545336.23425 Process32NextW	snapshot_handle: 0x00000148 process_name: LSAS.EXE process_identifier: 2112	failed
1727545337.32825 Process32NextW	snapshot_handle: 0x00000140 process_name: LSAS.EXE process_identifier: 2112	failed
1727545338.43725 Process32NextW	snapshot_handle: 0x00000148 process_name: LSAS.EXE process_identifier: 2112	failed
1727545339.53125 Process32NextW	snapshot_handle: 0x00000140 process_name: LSAS.EXE process_identifier: 2112	failed
1727545340.62425 Process32NextW	snapshot_handle: 0x00000148 process_name: LSAS.EXE process_identifier: 2112	failed
1727545341.71825 Process32NextW	snapshot_handle: 0x00000140 process_name: LSAS.EXE process_identifier: 2112	failed
1727545342.82825 Process32NextW	snapshot_handle: 0x00000148 process_name: LSAS.EXE process_identifier: 2112	failed
1727545343.92125 Process32NextW	snapshot_handle: 0x00000140 process_name: LSAS.EXE process_identifier: 2112	failed
1727545345.03125 Process32NextW	snapshot_handle: 0x00000148 process_name: LSAS.EXE process_identifier: 2112	failed
1727545346.12425 Process32NextW	snapshot_handle: 0x00000140 process_name: LSAS.EXE process_identifier: 2112	failed
1727545347.21825 Process32NextW	snapshot_handle: 0x00000148 process_name: LSAS.EXE process_identifier: 2112	failed
1727545348.31225 Process32NextW	snapshot_handle: 0x00000140 process_name: LSAS.EXE process_identifier: 2112	failed
1727545349.40625 Process32NextW	snapshot_handle: 0x00000148 process_name: LSAS.EXE process_identifier: 2112	failed
1727545350.49925 Process32NextW	snapshot_handle: 0x00000140 process_name: LSAS.EXE process_identifier: 2112	failed
1727545351.60925 Process32NextW	snapshot_handle: 0x00000148 process_name: LSAS.EXE process_identifier: 2112	failed

与未执行 DNS 查询的主机进行通信 (2 个事件)

host	114.114.114.114
host	8.8.8.8

在 Windows 启动时自我安装以实现自动运行 (50 out of 436 个事件)

reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Print Spooler	reg_value	C:\Windows\system32\SPOOL.EXE
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\LocalSecurityAuthoritySubsystem	reg_value	C:\Windows\LSAS.EXE
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger	reg_value	0
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger	reg_value	0
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Print Spooler	reg_value	C:\Windows\system32\SPOOL.EXE
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\LocalSecurityAuthoritySubsystem	reg_value	C:\Windows\LSAS.EXE
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger	reg_value	0
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger	reg_value	0
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Print Spooler	reg_value	C:\Windows\system32\SPOOL.EXE
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\LocalSecurityAuthoritySubsystem	reg_value	C:\Windows\LSAS.EXE
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger	reg_value	0
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger	reg_value	0
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Print Spooler	reg_value	C:\Windows\system32\SPOOL.EXE
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\LocalSecurityAuthoritySubsystem	reg_value	C:\Windows\LSAS.EXE
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger	reg_value	0
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger	reg_value	0
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Print Spooler	reg_value	C:\Windows\system32\SPOOL.EXE
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\LocalSecurityAuthoritySubsystem	reg_value	C:\Windows\LSAS.EXE
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger	reg_value	0
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger	reg_value	0
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Print Spooler	reg_value	C:\Windows\system32\SPOOL.EXE
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\LocalSecurityAuthoritySubsystem	reg_value	C:\Windows\LSAS.EXE
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger	reg_value	0
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger	reg_value	0
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Print Spooler	reg_value	C:\Windows\system32\SPOOL.EXE
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\LocalSecurityAuthoritySubsystem	reg_value	C:\Windows\LSAS.EXE
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger	reg_value	0
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger	reg_value	0
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Print Spooler	reg_value	C:\Windows\system32\SPOOL.EXE
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\LocalSecurityAuthoritySubsystem	reg_value	C:\Windows\LSAS.EXE
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger	reg_value	0
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger	reg_value	0
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Print Spooler	reg_value	C:\Windows\system32\SPOOL.EXE
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\LocalSecurityAuthoritySubsystem	reg_value	C:\Windows\LSAS.EXE
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger	reg_value	0
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger	reg_value	0
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Print Spooler	reg_value	C:\Windows\system32\SPOOL.EXE
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\LocalSecurityAuthoritySubsystem	reg_value	C:\Windows\LSAS.EXE
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger	reg_value	0
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger	reg_value	0
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Print Spooler	reg_value	C:\Windows\system32\SPOOL.EXE
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\LocalSecurityAuthoritySubsystem	reg_value	C:\Windows\LSAS.EXE
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger	reg_value	0
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger	reg_value	0
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Print Spooler	reg_value	C:\Windows\system32\SPOOL.EXE
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\LocalSecurityAuthoritySubsystem	reg_value	C:\Windows\LSAS.EXE
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger	reg_value	0
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger	reg_value	0
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Print Spooler	reg_value	C:\Windows\system32\SPOOL.EXE
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\LocalSecurityAuthoritySubsystem	reg_value	C:\Windows\LSAS.EXE

尝试修改浏览器安全设置 (50 out of 107 个事件)

registry	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1805
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1004
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2200
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\2105
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2101
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1A05
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\180A
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\2300
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2104
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1A02
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1608
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1208
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1A03
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1608
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\Flags
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1209
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2102
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1A06
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1A03
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1200
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\Flags
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1201
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2105
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1609
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1201
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1804
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\180A
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1805
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1400
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1209
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1200
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1809
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2104
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2301
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1A03
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1A06
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1407
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1605
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1208
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\2101
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2105
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1A05
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1405
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2000
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1609
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\2102
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\120A
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1605
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\120A
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1407

文件已被 VirusTotal 上 58 个反病毒引擎识别为恶意 (50 out of 58 个事件)

ALYac	Trojan.Agent.ALKT
APEX	Malicious
AVG	Win32:Small-MHL [Trj]
Acronis	suspicious
Ad-Aware	Trojan.Agent.ALKT
AhnLab-V3	Trojan/Win32.Agent.C57026
Antiy-AVL	Trojan/Win32.Small.yag
Arcabit	Trojan.Agent.ALKT
Avast	Win32:Small-MHL [Trj]
Avira	TR/ATRAPS.Gen
BitDefender	Trojan.Agent.ALKT
BitDefenderTheta	AI:Packer.E5B590851F
CAT-QuickHeal	Trojan.Mauvaise.SL1
CMC	Trojan.Win32.Small!O
ClamAV	Win.Malware.Alkt-6915258-0
Comodo	TrojWare.Win32.Small.YBE@m3lz7
CrowdStrike	win/malicious_confidence_100% (D)
Cybereason	malicious.7b7163
Cylance	Unsafe
Cyren	W32/Heuristic-257!Eldorado
DrWeb	Trojan.LowZones.2000
ESET-NOD32	a variant of Win32/Oberal.A
Emsisoft	Trojan.Agent.ALKT (B)
Endgame	malicious (high confidence)
F-Prot	W32/Heuristic-257!Eldorado
F-Secure	Trojan.TR/ATRAPS.Gen
FireEye	Generic.mg.aa68f637b7163634
Fortinet	W32/Small.YBE!tr
GData	Trojan.Agent.ALKT
Ikarus	Trojan.Win32.Small
Invincea	heuristic
Jiangmin	Trojan/Small.eyw
K7AntiVirus	Trojan ( 005450941 )
K7GW	Trojan ( 005450941 )
Kaspersky	Trojan.Win32.Small.yag
MAX	malware (ai score=88)
Malwarebytes	Trojan.Small
MaxSecure	Trojan.Malware.300983.susgen
McAfee	QLowZones-43
McAfee-GW-Edition	BehavesLike.Win32.QLowZones.lt
MicroWorld-eScan	Trojan.Agent.ALKT
Microsoft	TrojanSpy:Win32/Agent.BX
Panda	Generic Malware
Qihoo-360	HEUR/QVM20.1.4227.Malware.Gen
Rising	Worm.Nuj!8.2AD (TFE:dGZlOgUAx2xBazeaWQ)
SUPERAntiSpyware	Trojan.Agent/Generic
Sangfor	Malware
SentinelOne	DFI - Suspicious PE
Sophos	Troj/QLowZon-FG
Symantec	Trojan Horse

288x288

224x224

192x192

160x160

128x128

96x96

64x64

32x32

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2008-09-25 21:20:36

PE Imphash

1e4c0da5737da53aff5e6e0ab7de1efa

Sections

Name	Virtual Address	Virtual Size	Size of Raw Data	Entropy
.text	0x00001000	0x00000d72	0x00000e00	5.61269029391417
.rdata	0x00002000	0x000002b4	0x00000400	3.557205271669792
.data	0x00003000	0x0000384f	0x00002800	4.376183701073933
.rsrc	0x00007000	0x00000470	0x00000600	2.05011805735382

Resources

Name	Offset	Size	Language	Sub-language	File type
RT_ICON	0x000070f0	0x000002e8	LANG_ENGLISH	SUBLANG_ENGLISH_US	None
RT_MENU	0x000073f0	0x00000080	LANG_ENGLISH	SUBLANG_ENGLISH_US	None
RT_GROUP_ICON	0x000073d8	0x00000014	LANG_ENGLISH	SUBLANG_ENGLISH_US	None

Imports

Library kernel32.dll:

• 0x402014 GetLastError

• 0x402018 GetModuleFileNameA

• 0x40201c GetSystemDirectoryA

• 0x402020 GetWindowsDirectoryA

• 0x402024 ExitProcess

• 0x402028 OpenMutexA

• 0x40202c Process32First

• 0x402030 Process32Next

• 0x402034 Sleep

• 0x402038 CreateToolhelp32Snapshot

• 0x40203c CreateMutexA

• 0x402040 CopyFileA

• 0x402044 OpenFile

• 0x402048 CloseHandle

• 0x40204c FindClose

• 0x402050 FindFirstFileA

Library advapi32.dll:

• 0x402000 RegOpenKeyExA

• 0x402004 RegCreateKeyA

• 0x402008 RegCloseKey

• 0x40200c RegSetValueExA

Library shell32.dll:

• 0x402058 SHGetSpecialFolderPathA

• 0x40205c ShellExecuteA

L!This program cannot be run in DOS mode.
%}%}%},:n%}^
o%}e#{%}Rich%}
`.rdata
@.data
j&hG]@
bn,zAqUhOd@
b8hKc@
F2EPVEu
USVWUu
CloseHandle
CopyFileA
CreateMutexA
CreateToolhelp32Snapshot
ExitProcess
GetLastError
GetModuleFileNameA
GetSystemDirectoryA
GetWindowsDirectoryA
OpenFile
OpenMutexA
Process32First
Process32Next
kernel32.dll
RegCloseKey
RegCreateKeyA
RegOpenKeyExA
RegSetValueExA
advapi32.dll
SHGetSpecialFolderPathA
ShellExecuteA
shell32.dll
FindClose
FindFirstFileA
1A2466363E2F723629700A05054F490C187C26000D520B164F215432321D4E090A16017C3010151500271F76071B1D491C1B7C2C07184952070E544B3A0B54100C4E20536E651B4E08163D427C7324353420
1A2466363E2F7236296D0C0A1E4353060D54373E074E000A57347C2D100652080B15244501160E080B1539550C356E2047332065686C2C20686B206B5B6E206454617514585347165E20533417415651555C
1A2466363E2F7236296D0C0A1E4353060D54373E074E000A57340020312863181713174E073302151620044E3E20034114100023000049002C1345081C1A490B0B0008501A0C1B4E1E3961721036555F5727
1A2466363E2F7236296D0C0A1E4353060D54373E074E000A57347C2D100652080B15244501160E080B15224E160C1C4E160100360C185849070C533733014E01167C737C6E651B4E1E3961721036555F5727
1A2466363E2F7236296D0C0A1E4353060D54373E074E000A57347C2D100652080B15244501160E080B15224E160C1C4E160100360C185849070C533733014E01167C747C6E651B4E1E3961721036555F5727
1A2466363E2F7236296D0C0A1E4353060D54373E074E000A57347C2D100652080B15244501160E080B15224E160C1C4E160100360C185849070C533733014E01167C777C6E651B4E1E3961721036555F5727
1A2466363E2F7236296D0C0A1E4353060D54373E074E000A57347C2D100652080B15244501160E080B15224E160C1C4E160100360C185849070C53372501430F014F304E313F1B4E08163D427C73555F5727
1A2466363E2F7236296D0C0A1E4353060D54373E074E000A57347C2D100652080B15244501160E080B15224E160C1C4E160100360C185849070C536B696E2064652047206E6574206D656172207365676765
13044E071A3D451000520C1D1579500E19410F0C2A4F0A002047206EF56D826D85BA332073656767F9
1A2466363E2F7236296D0C0A1E4353060D543720005401174E22544E200C50010A1317522F28060E0B152D45031D1B5216364F0B1D1E434C356B536B696E2064652047206E6574206D656172207365676765
0F2E61363C3C652C396F26282061612A2369252C316C2B266B036F392B28206D656172207365676765
200E5812050152165B451D0C6C2C67696B206B690E86C565A09A616E6574206D296530207BFFFA6705
1A2466363E2F7236296D0C0A1E4353060D543720005401174E22544E200C50010A1317522F360204103B02541B356E2032452065686C2C20686B206B5B6E206454617514585347165E20533417415651555C
1A2466363E2F7236296D0C0A1E4353060D543720005401174E22544E200C50010A1317522F2B0210451E024E060619532F752065686C2C20686B206B5B6E206454617514585347165E20533417415651555C
1A2466363E2F7236296D0C0A1E4353060D54373E074E000A57347C2D100652080B15244501160E080B15224E160C1C4E160100360C185849070C5337696E206465204720EE40E9208D1EFA72800EFE67071A
0D0253030B0245201043101B0558593A0E541F0000471726482243056574206D656172207365676765
0D0253030B02453A185017061A494433044E0E2A0645070E2047206EF56D826D85BA332073656767F9
1A0E43171B07540A2A682E2521734F0707596B690E86C565A09A616E6574206D296530207BFFFA6705
1A2466363E2F7236296D0C0A1E4353060D54373E074E000A57347C2D100652080B15244501160E080B151B4F0E000D4916067C20111C404F1B0E52373B1B4E6465204720EE40AA208D1EBD72800EB967071A
1A0446161E0F521629700A05054F490C187C26000D520B164F2154322C1A5408170F175453201F170926194510353C450001520C0A18454F07187C6B696E2064652047206E6574206D656172207365676765
3D0A53090409525D1058006935EB80698B5BF0690E5FFF65803ABB6E015474081D1548209AA2C76715
3B0E47070D07545D10580069E5EB80698B5BF069CE5DFF65E052BA6EC5F5BE6D65617220D2A2C76765
0D0E42170E09450175205F696CEC80696B3E2A69AEE8C4652347206E6174206D6561722073A5C76785
0F0741051A6E20730D545F696CEC80696B3E2A69AEE8C4652347206E6174206D6561722073A5C76785
190450171923470175205F696CEC80696B3E2A69AEE8C4652347206E6174206D6561722073A5C76785
1538702D26220E362D6565696CECC1696B3E2A69B6E885652347206E6174206D6561722073A5866785
1919490C1D4E73031A4F090C1E2C67696B206B690E868665A09A616E6574206D296530207BFFB96705
1A3B6F2D2540652B300045494C0C00494B004B494E0044450067004E4554004D454152005345474745694B0042494E0053550045494C0C00494B004B494E0044450067004E4554004D454152005345474745694B0042496E2073752065696C2C20696B206B696E2064652047206E6574206D656172207365676765
150F4914110F501A46124B0D004020696B206B690E868665A09A616E6574206D296530207BFFB96705
152773233A40652B30205F691DEBC1698B5BB769652064656328440B015474081D15482072AD866765
05044303053D451000520C1D156D551D034F19001A5937104234591D11114D6D656172207365676765
0704700D191B503E144E040E094145071F206B690E868665A09A616E6574206D296530207BFFB96705
795E135A5F2A15414019502F5E1C175A5B645E5D5B66525C1872652C5D441654542347113552515E5545354647463635383033416B423645795A15565E5A104B4464545C581412595C132A5C2D1752521172
053873253C2F723746176569CDEBC1690B5FB7694E33BF65E052FB6EC5F5FF6D65617220CAA2866765
05387337392A1344752065696CECC1696B3E2A69B6E885652347206E6174206D6561722073A5866785
05386D52595F20730D545F6985EB80691B51F7690E5FFF65803ABB6E015474081D15482073A5C76715
 !"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
 0@P`p
wwwwwwwwwwwww
wwwwwwwwwwwww
wwwwwwwwwwwww
wwwwwwwwwwwww
&About

Process Tree

04b49e363015e5979db2b89c66a695dc4c12369c8febb678e46815674636b5e6.exe (2600) "C:\Users\Administrator\AppData\Local\Temp\04b49e363015e5979db2b89c66a695dc4c12369c8febb678e46815674636b5e6.exe"
- LSAS.EXE (2112) "C:\Windows\LSAS.EXE"

04b49e363015e5979db2b89c66a695dc4c12369c8febb678e46815674636b5e6.exe, PID: 2600, Parent PID: 3044

default registry file network process services synchronisation iexplore office pdf

LSAS.EXE, PID: 2112, Parent PID: 2600

default registry file network process services synchronisation iexplore office pdf

Hosts

IP
114.114.114.114
8.8.8.8

DNS

Name	Response	Post-Analysis Lookup
dns.msftncsi.com	A 131.107.255.255 A 131.107.255.255	131.107.255.255
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	53179	224.0.0.252	5355
192.168.56.101	49642	224.0.0.252	5355
192.168.56.101	137	192.168.56.255	137
192.168.56.101	61714	114.114.114.114	53
192.168.56.101	61714	8.8.8.8	53
192.168.56.101	56933	8.8.8.8	53
192.168.56.101	138	192.168.56.255	138
192.168.56.101	58485	114.114.114.114	53
192.168.56.101	57665	114.114.114.114	53

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.