14.6
0-day
51 个模型检测该样本为恶意！
重新分析
更多

1c2894353e85e78ce3f7d55ce6ef7422e5ddcc52dfa1a92bbe6808c01228e57e

b9a1e3f3bc25b19ccc08a0526a28f177.exe

分析耗时

88s

最近分析

文件大小

379.5KB
静态报毒 动态报毒 AI SCORE=80 ATTRIBUTE CONFIDENCE ELDORADO FAREIT FORMBOOK GDSDA HIGH CONFIDENCE HIGHCONFIDENCE HSHVDQ INJECT3 KRYPTIK MALICIOUS PE MALWAREX MSILPERSEUS PHPX QITA R002C0WHJ20 R348377 SUSGEN TASKUN TSCOPE UNSAFE XM0@AIEJ0BF ZEMSILF 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee Fareit-FXY!B9A1E3F3BC25 20200904 6.0.6.653
Alibaba Trojan:MSIL/Formbook.49a5a6d7 20190527 0.3.0.5
Avast Win32:MalwareX-gen [Trj] 20200905 18.4.3895.0
Tencent Msil.Trojan.Taskun.Phpx 20200905 1.0.0.1
Baidu 20190318 1.0.0.2
Kingsoft 20200905 2013.8.14.323
CrowdStrike win/malicious_confidence_90% (W) 20190702 1.0
静态指标
Queries for the computername (4 个事件)
Time & API Arguments Status Return Repeated
1619861174.230184
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619879693.498125
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619879696.701125
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619879696.701125
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
Checks if process is being debugged by a debugger (2 个事件)
Time & API Arguments Status Return Repeated
1619861119.120184
IsDebuggerPresent
failed 0 0
1619861119.120184
IsDebuggerPresent
failed 0 0
Command line console output was observed (1 个事件)
Time & API Arguments Status Return Repeated
1619879694.107125
WriteConsoleW
buffer: 成功: 成功创建计划任务 "Updates\mPzrZpr"。
console_handle: 0x00000007
success 1 0
Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 个事件)
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid
Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)
Time & API Arguments Status Return Repeated
1619861119.136184
GlobalMemoryStatusEx
success 1 0
行为判定
动态指标
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
Allocates read-write-execute memory (usually to unpack itself) (50 out of 101 个事件)
Time & API Arguments Status Return Repeated
1619861118.495184
NtAllocateVirtualMemory
process_identifier: 2128
region_size: 1245184
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x006a0000
success 0 0
1619861118.495184
NtAllocateVirtualMemory
process_identifier: 2128
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00790000
success 0 0
1619861118.933184
NtAllocateVirtualMemory
process_identifier: 2128
region_size: 393216
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x00520000
success 0 0
1619861118.933184
NtAllocateVirtualMemory
process_identifier: 2128
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00540000
success 0 0
1619861119.011184
NtProtectVirtualMemory
process_identifier: 2128
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x73e71000
success 0 0
1619861119.120184
NtAllocateVirtualMemory
process_identifier: 2128
region_size: 983040
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x006a0000
success 0 0
1619861119.120184
NtAllocateVirtualMemory
process_identifier: 2128
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00750000
success 0 0
1619861119.120184
NtAllocateVirtualMemory
process_identifier: 2128
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0052a000
success 0 0
1619861119.120184
NtProtectVirtualMemory
process_identifier: 2128
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x73e72000
success 0 0
1619861119.120184
NtAllocateVirtualMemory
process_identifier: 2128
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00522000
success 0 0
1619861119.276184
NtAllocateVirtualMemory
process_identifier: 2128
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00532000
success 0 0
1619861119.386184
NtAllocateVirtualMemory
process_identifier: 2128
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00595000
success 0 0
1619861119.386184
NtAllocateVirtualMemory
process_identifier: 2128
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0059b000
success 0 0
1619861119.386184
NtAllocateVirtualMemory
process_identifier: 2128
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00597000
success 0 0
1619861119.464184
NtAllocateVirtualMemory
process_identifier: 2128
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00533000
success 0 0
1619861119.558184
NtAllocateVirtualMemory
process_identifier: 2128
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00534000
success 0 0
1619861119.558184
NtAllocateVirtualMemory
process_identifier: 2128
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00535000
success 0 0
1619861119.589184
NtAllocateVirtualMemory
process_identifier: 2128
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0053c000
success 0 0
1619861119.917184
NtAllocateVirtualMemory
process_identifier: 2128
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00536000
success 0 0
1619861119.933184
NtAllocateVirtualMemory
process_identifier: 2128
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00538000
success 0 0
1619861119.995184
NtAllocateVirtualMemory
process_identifier: 2128
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x007e0000
success 0 0
1619861120.151184
NtAllocateVirtualMemory
process_identifier: 2128
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0058a000
success 0 0
1619861120.151184
NtAllocateVirtualMemory
process_identifier: 2128
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00587000
success 0 0
1619861120.261184
NtAllocateVirtualMemory
process_identifier: 2128
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00539000
success 0 0
1619861120.261184
NtAllocateVirtualMemory
process_identifier: 2128
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x007f0000
success 0 0
1619861120.370184
NtAllocateVirtualMemory
process_identifier: 2128
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00586000
success 0 0
1619861120.433184
NtAllocateVirtualMemory
process_identifier: 2128
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x007e1000
success 0 0
1619861120.433184
NtAllocateVirtualMemory
process_identifier: 2128
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x007f1000
success 0 0
1619861120.495184
NtAllocateVirtualMemory
process_identifier: 2128
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x007f2000
success 0 0
1619861120.511184
NtAllocateVirtualMemory
process_identifier: 2128
region_size: 327680
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 1056768 (MEM_RESERVE|MEM_TOP_DOWN)
base_address: 0x7ef40000
success 0 0
1619861120.511184
NtAllocateVirtualMemory
process_identifier: 2128
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x7ef40000
success 0 0
1619861120.511184
NtAllocateVirtualMemory
process_identifier: 2128
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x7ef40000
success 0 0
1619861120.511184
NtAllocateVirtualMemory
process_identifier: 2128
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x7ef48000
success 0 0
1619861120.511184
NtAllocateVirtualMemory
process_identifier: 2128
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 1056768 (MEM_RESERVE|MEM_TOP_DOWN)
base_address: 0x7ef30000
success 0 0
1619861120.511184
NtAllocateVirtualMemory
process_identifier: 2128
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x7ef30000
success 0 0
1619861120.526184
NtAllocateVirtualMemory
process_identifier: 2128
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x007e2000
success 0 0
1619861120.714184
NtAllocateVirtualMemory
process_identifier: 2128
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00541000
success 0 0
1619861120.808184
NtAllocateVirtualMemory
process_identifier: 2128
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x007f3000
success 0 0
1619861120.964184
NtAllocateVirtualMemory
process_identifier: 2128
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x007f4000
success 0 0
1619861120.964184
NtAllocateVirtualMemory
process_identifier: 2128
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0053d000
success 0 0
1619861120.964184
NtAllocateVirtualMemory
process_identifier: 2128
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x007e3000
success 0 0
1619861121.011184
NtAllocateVirtualMemory
process_identifier: 2128
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x007e4000
success 0 0
1619861121.042184
NtAllocateVirtualMemory
process_identifier: 2128
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x007e5000
success 0 0
1619861121.042184
NtAllocateVirtualMemory
process_identifier: 2128
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x007f5000
success 0 0
1619861121.042184
NtAllocateVirtualMemory
process_identifier: 2128
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0052c000
success 0 0
1619861121.042184
NtAllocateVirtualMemory
process_identifier: 2128
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00523000
success 0 0
1619861121.042184
NtAllocateVirtualMemory
process_identifier: 2128
region_size: 12288
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x007e6000
success 0 0
1619861121.058184
NtAllocateVirtualMemory
process_identifier: 2128
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x007e9000
success 0 0
1619861121.089184
NtAllocateVirtualMemory
process_identifier: 2128
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x007ea000
success 0 0
1619861121.105184
NtAllocateVirtualMemory
process_identifier: 2128
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x007eb000
success 0 0
Creates a suspicious process (2 个事件)
cmdline schtasks.exe /Create /TN "Updates\mPzrZpr" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp2E1B.tmp"
cmdline "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\mPzrZpr" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp2E1B.tmp"
Drops an executable to the user AppData folder (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\x
A process created a hidden window (1 个事件)
Time & API Arguments Status Return Repeated
1619861175.417184
ShellExecuteExW
parameters: /Create /TN "Updates\mPzrZpr" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp2E1B.tmp"
filepath: schtasks.exe
filepath_r: schtasks.exe
show_type: 0
success 1 0
Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)
Time & API Arguments Status Return Repeated
1619879698.029125
GetAdaptersAddresses
flags: 0
family: 0
failed 111 0
The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)
entropy 7.907475942682332 section {'size_of_data': '0x0005e200', 'virtual_address': '0x00002000', 'entropy': 7.907475942682332, 'name': '.text', 'virtual_size': '0x0005e1f0'} description A section with a high entropy has been found
entropy 0.9934036939313984 description Overall entropy of this PE file is high
Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 个事件)
Time & API Arguments Status Return Repeated
1619861178.370184
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
Uses Windows utilities for basic Windows functionality (2 个事件)
cmdline schtasks.exe /Create /TN "Updates\mPzrZpr" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp2E1B.tmp"
cmdline "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\mPzrZpr" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp2E1B.tmp"
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
Allocates execute permission to another process indicative of possible code injection (1 个事件)
Time & API Arguments Status Return Repeated
1619861178.105184
NtAllocateVirtualMemory
process_identifier: 2056
region_size: 131072
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x00000438
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
success 0 0
Checks the version of Bios, possibly for anti-virtualization (2 个事件)
registry HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion
registry HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion
Detects virtualization software with SCSI Disk Identifier trick(s) (1 个事件)
registry HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0
Deletes executed files from disk (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp2E1B.tmp
Potential code injection by writing to the memory of another process (4 个事件)
Time & API Arguments Status Return Repeated
1619861178.105184
WriteProcessMemory
process_identifier: 2056
buffer: MZPÿÿ¸@º´ Í!¸LÍ!This program must be run under Win32 $7PEL^B*àŽ ˜$„¦°@@Оà\CODE°–˜ `DATAl°œ@ÀBSSÅÀ¤À.idatažÐ¤@À.reloc\à¬@PÄ@P
process_handle: 0x00000438
base_address: 0x00400000
success 1 0
1619861178.105184
WriteProcessMemory
process_identifier: 2056
buffer: @2‹À@@@\@ì @l$@ËÌÈÉ×ÏÈÍÎÛØÚÙÊÜÝÞßàáãäå@Error‹ÀRuntime error at 00000000‹À0123456789ABCDEFÿÿÿÿàO@‹À‹À@@J7<äºÏ¿}ªiFîµä[Jú-EœÝ]³QçëqØ'ÓØ'ÓØ'ÖØ'ÔØ7nØ$ÓsØ$ÓsØqØ$ÔØ'ÓØ'sØ$ÔØqØ$ÓØnsØÔØXØqØ$ÓØÓØ'ÖØ$ÓsØ'nsØ'ÔØ$ÓsØ4ØIÓØ7sØ7ÖØ$nsØ$ÓsØÔØ'ØØsØXØ$ÓØ'ÖØqØ'Ö؄§~ ‹€QT#?*f³Ì3n ¾&ڕ ýŠÎ4 ÈýRk¸€“Kw4ßð¥ë]<+ åëßph홼LE‹$ëúúKž¶õŠFèï! M£’óáq¥ž‘øÊaHæ™e€þIA0Tw/ôÛä"0ýxÝȸP¨zl÷[¸¤ê“º¢«ƒo!W s>{²•¿ßm“€ë˜0.H»m„ÛHӚÒCa!Au¬ŽV†¼£zÔõõã«í%$ýú‰tbÆœzÁŸ¢¨n¹s~i¿)dڋ²sÄvŸ/0äu­Ef–Ë匹 úÖ,‡<p-®. ù˜ýÀí‰üJ‘º-ù(SÛ±UÙwoX߆ÛG=:/€µU³«F˜ $ã»ÁiI¨1^ç“zXT§Š@?vä¦ÃOÍG×F| C¦1ôt²•v=2ÞR›†(a¬(j!%| ²íyXEÐêàÚOÓ'^2Ö©Ç9±ãü1Àæ¡*"³ÔÁÄ÷a)üwK²zQÀ>çrë;µ»¸q¢¥ÍÏÓ-Qr‰pªAPgæ„å 垯ËPÇ:ǘ b«Tº[,¢ax >2’¥!„T0Õ«Šô ñBªðd +þì• ¹áÆ«X%¥Œ4“ìCCÚ1¶ OÄY¬•+ᇤ5“¸‹xšMþ2ÝOt`×^Tg¬‰×tޜϰ LšŒuW Ù`ɨŒ"¶ìpuäK½ÌÉzÙ\‘´»Çsr¼?NI7ƒòœû´¼ð,YË¿ÍÂùÃåù„꽤Š­D00'Æ…HÕÝÕ§ÔÂîaûÌr¥®Â{h#ÄKÄNšèqxÀú2½„ìíÆR¯'ÎCL”l´¾£<:ƒ‡Bë« \ó.öj!Á¦Œ Ï#õ ”›YýâSEs_€Ìe×°R%Ù =«æÒÅ'Ò'Œ|­PQ¢x­­º—œ \͋…Áýõ†]­U‹Y¶sç*°ÈÙv,Yu®Åuö›—³eq†&ñ£Šgd 4å«s£Ù»ç†í›­žPš–¼Öòža¾$‚qVœójz(SÁÛ£}‚éC:̈ §3@G©Ÿ—Œu/Q¦¥3v6˜C¿à3u ~vízH£ÍŽL79àoî²¥Ca0BoŽ4EMÅþÉ9*š±ŸxDÐaÂZnø”ƨnªN4}jCoˆA…7o¦DTÉÐ6mçø=Š´3(á[Ûf35èa׀Ó6‰íTŽÒK8ªßK$ÇAÇAôÆApÇA¤ÆA„ÇA@ÇAhÇAlÆA,ÇA¼ÆAÇA°ÆAÆAÄÆA´°A”ÇAÇAˆÇA(ÈA\ÇAüÆA4ÇA|ÆAŒÆAìÆA ÇA<ÇA¸°AèÆA¤ÇA°°AÀÆAŒÇA¸ÆAdÆA°ÇAðÆA ÇA´ÆA(ÇAÈÇAØ°A¼°A˜ÆA ÇAÇAÇAœÆA ÆA8ÇA¬ÆAPÇA¬ÇAˆÆALÇAøÆAÌÆADÇA`ÇA¬°A ÈA¨ÇA˜ÇAÇAÈÆA€ÆAœÇA”ÆA0ÇAhÆAHÇA´ÇA
process_handle: 0x00000438
base_address: 0x0041b000
success 1 0
1619861178.105184
WriteProcessMemory
process_identifier: 2056
buffer: ,ÒÜÐ ÔHÑXÔXјÔhÑàÔxÑÕ€Ñ8ՐѺÖðÑ*× Òp× Ò:ÒRÒjÒ‚ÒžÒ¬Ò¼ÒÈÒÖÒæÒÓÓ$Ó:ÓPÓbÓtӊӜӮӼÓÊÓÖÓòÓþÓÔ,Ô>ÔLÔfÔzÔŠÔ¦Ô¶ÔÌÔîÔÕ Õ.ÕFÕRÕZÕfÕxÕˆÕ˜Õ¦Õ¶ÕÆÕØÕìÕÖÖ.ÖBÖPÖ`ÖrÖ~֌֚֮ÖÄÖÔÖäÖðÖ× ×6×B×V×^×z׊×kernel32.dllDeleteCriticalSectionLeaveCriticalSectionEnterCriticalSectionInitializeCriticalSectionVirtualFreeVirtualAllocLocalFreeLocalAllocGetTickCountQueryPerformanceCounterGetVersionGetCurrentThreadIdWideCharToMultiByteMultiByteToWideCharGetThreadLocaleGetStartupInfoAGetModuleFileNameAGetLocaleInfoAGetCommandLineAFreeLibraryExitProcessWriteFileUnhandledExceptionFilterRtlUnwindRaiseExceptionGetStdHandleuser32.dllGetKeyboardTypeMessageBoxACharNextAadvapi32.dllRegQueryValueExARegOpenKeyExARegCloseKeyoleaut32.dllSysFreeStringSysReAllocStringLenSysAllocStringLenkernel32.dllGetModuleHandleAadvapi32.dllRegOpenKeyExARegEnumKeyAFreeSidkernel32.dllWriteFileSleepLocalFreeLoadLibraryExWLoadLibraryAGlobalUnlockGlobalLockGetTickCountGetSystemInfoGetProcAddressGetModuleHandleAGetModuleFileNameAGetFileAttributesWGetCurrentProcessIdGetCurrentProcessFreeLibraryFindNextFileWFindFirstFileWFindCloseExitProcessDeleteFileWCreateDirectoryWCopyFileWgdi32.dllSelectObjectDeleteObjectDeleteDCCreateCompatibleDCCreateCompatibleBitmapBitBltuser32.dllReleaseDCGetSystemMetricsGetDCCharToOemBuffAole32.dllOleInitializeCoCreateInstance
process_handle: 0x00000438
base_address: 0x0041d000
success 1 0
1619861178.105184
WriteProcessMemory
process_identifier: 2056
buffer: @
process_handle: 0x00000438
base_address: 0x7efde008
success 1 0
Code injection by writing an executable or DLL to the memory of another process (1 个事件)
Time & API Arguments Status Return Repeated
1619861178.105184
WriteProcessMemory
process_identifier: 2056
buffer: MZPÿÿ¸@º´ Í!¸LÍ!This program must be run under Win32 $7PEL^B*àŽ ˜$„¦°@@Оà\CODE°–˜ `DATAl°œ@ÀBSSÅÀ¤À.idatažÐ¤@À.reloc\à¬@PÄ@P
process_handle: 0x00000438
base_address: 0x00400000
success 1 0
Sets or modifies WPAD proxy autoconfiguration file for traffic interception (8 个事件)
Time & API Arguments Status Return Repeated
1619879700.685125
RegSetValueExA
key_handle: 0x000003a4
value: 1
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason
success 0 0
1619879700.685125
RegSetValueExA
key_handle: 0x000003a4
value: пáõ™>×
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime
success 0 0
1619879700.685125
RegSetValueExA
key_handle: 0x000003a4
value: 3
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision
success 0 0
1619879700.685125
RegSetValueExW
key_handle: 0x000003a4
value: 网络 2
regkey_r: WpadNetworkName
reg_type: 1 (REG_SZ)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName
success 0 0
1619879700.685125
RegSetValueExA
key_handle: 0x000003bc
value: 1
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason
success 0 0
1619879700.685125
RegSetValueExA
key_handle: 0x000003bc
value: пáõ™>×
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime
success 0 0
1619879700.685125
RegSetValueExA
key_handle: 0x000003bc
value: 3
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision
success 0 0
1619879700.716125
RegSetValueExW
key_handle: 0x000003a0
value: {40112ABE-63B3-43C3-BE93-1440EE3AF106}
regkey_r: WpadLastNetwork
reg_type: 1 (REG_SZ)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadLastNetwork
success 0 0
Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)
Process injection Process 2128 called NtSetContextThread to modify thread in remote process 2056
Time & API Arguments Status Return Repeated
1619861178.105184
NtSetContextThread
thread_handle: 0x0000043c
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4302468
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2056
success 0 0
Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)
Process injection Process 2128 resumed a thread in remote process 2056
Time & API Arguments Status Return Repeated
1619861178.355184
NtResumeThread
thread_handle: 0x0000043c
suspend_count: 1
process_identifier: 2056
success 0 0
Detects VirtualBox through the presence of a registry key (1 个事件)
registry HKEY_LOCAL_MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions
Detects VMWare through the presence of a registry key (1 个事件)
registry HKEY_LOCAL_MACHINE\SOFTWARE\VMware, Inc.\VMware Tools
Detects the presence of Wine emulator (1 个事件)
Time & API Arguments Status Return Repeated
1619861173.964184
LdrGetProcedureAddress
ordinal: 0
module: KERNEL32
module_address: 0x76340000
function_address: 0x0040c6bc
function_name: wine_get_unix_file_name
failed 3221225785 0
Executed a process and injected code into it, probably while unpacking (19 个事件)
Time & API Arguments Status Return Repeated
1619861119.120184
NtResumeThread
thread_handle: 0x000000d8
suspend_count: 1
process_identifier: 2128
success 0 0
1619861119.120184
NtResumeThread
thread_handle: 0x00000120
suspend_count: 1
process_identifier: 2128
success 0 0
1619861119.151184
NtResumeThread
thread_handle: 0x00000124
suspend_count: 1
process_identifier: 2128
success 0 0
1619861173.980184
NtResumeThread
thread_handle: 0x00000258
suspend_count: 1
process_identifier: 2128
success 0 0
1619861174.120184
NtResumeThread
thread_handle: 0x000002e0
suspend_count: 1
process_identifier: 2128
success 0 0
1619861175.417184
CreateProcessInternalW
thread_identifier: 2412
thread_handle: 0x00000448
process_identifier: 1060
current_directory: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp
filepath: C:\Windows\System32\schtasks.exe
track: 1
command_line: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\mPzrZpr" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp2E1B.tmp"
filepath_r: C:\Windows\System32\schtasks.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
process_handle: 0x00000480
inherit_handles: 0
success 1 0
1619861178.089184
CreateProcessInternalW
thread_identifier: 2296
thread_handle: 0x0000043c
process_identifier: 2056
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\b9a1e3f3bc25b19ccc08a0526a28f177.exe
track: 1
command_line:
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\b9a1e3f3bc25b19ccc08a0526a28f177.exe
stack_pivoted: 0
creation_flags: 134217732 (CREATE_NO_WINDOW|CREATE_SUSPENDED)
process_handle: 0x00000438
inherit_handles: 0
success 1 0
1619861178.105184
NtGetContextThread
thread_handle: 0x0000043c
success 0 0
1619861178.105184
NtAllocateVirtualMemory
process_identifier: 2056
region_size: 131072
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x00000438
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
success 0 0
1619861178.105184
WriteProcessMemory
process_identifier: 2056
buffer: MZPÿÿ¸@º´ Í!¸LÍ!This program must be run under Win32 $7PEL^B*àŽ ˜$„¦°@@Оà\CODE°–˜ `DATAl°œ@ÀBSSÅÀ¤À.idatažÐ¤@À.reloc\à¬@PÄ@P
process_handle: 0x00000438
base_address: 0x00400000
success 1 0
1619861178.105184
WriteProcessMemory
process_identifier: 2056
buffer:
process_handle: 0x00000438
base_address: 0x00401000
success 1 0
1619861178.105184
WriteProcessMemory
process_identifier: 2056
buffer: @2‹À@@@\@ì @l$@ËÌÈÉ×ÏÈÍÎÛØÚÙÊÜÝÞßàáãäå@Error‹ÀRuntime error at 00000000‹À0123456789ABCDEFÿÿÿÿàO@‹À‹À@@J7<äºÏ¿}ªiFîµä[Jú-EœÝ]³QçëqØ'ÓØ'ÓØ'ÖØ'ÔØ7nØ$ÓsØ$ÓsØqØ$ÔØ'ÓØ'sØ$ÔØqØ$ÓØnsØÔØXØqØ$ÓØÓØ'ÖØ$ÓsØ'nsØ'ÔØ$ÓsØ4ØIÓØ7sØ7ÖØ$nsØ$ÓsØÔØ'ØØsØXØ$ÓØ'ÖØqØ'Ö؄§~ ‹€QT#?*f³Ì3n ¾&ڕ ýŠÎ4 ÈýRk¸€“Kw4ßð¥ë]<+ åëßph홼LE‹$ëúúKž¶õŠFèï! M£’óáq¥ž‘øÊaHæ™e€þIA0Tw/ôÛä"0ýxÝȸP¨zl÷[¸¤ê“º¢«ƒo!W s>{²•¿ßm“€ë˜0.H»m„ÛHӚÒCa!Au¬ŽV†¼£zÔõõã«í%$ýú‰tbÆœzÁŸ¢¨n¹s~i¿)dڋ²sÄvŸ/0äu­Ef–Ë匹 úÖ,‡<p-®. ù˜ýÀí‰üJ‘º-ù(SÛ±UÙwoX߆ÛG=:/€µU³«F˜ $ã»ÁiI¨1^ç“zXT§Š@?vä¦ÃOÍG×F| C¦1ôt²•v=2ÞR›†(a¬(j!%| ²íyXEÐêàÚOÓ'^2Ö©Ç9±ãü1Àæ¡*"³ÔÁÄ÷a)üwK²zQÀ>çrë;µ»¸q¢¥ÍÏÓ-Qr‰pªAPgæ„å 垯ËPÇ:ǘ b«Tº[,¢ax >2’¥!„T0Õ«Šô ñBªðd +þì• ¹áÆ«X%¥Œ4“ìCCÚ1¶ OÄY¬•+ᇤ5“¸‹xšMþ2ÝOt`×^Tg¬‰×tޜϰ LšŒuW Ù`ɨŒ"¶ìpuäK½ÌÉzÙ\‘´»Çsr¼?NI7ƒòœû´¼ð,YË¿ÍÂùÃåù„꽤Š­D00'Æ…HÕÝÕ§ÔÂîaûÌr¥®Â{h#ÄKÄNšèqxÀú2½„ìíÆR¯'ÎCL”l´¾£<:ƒ‡Bë« \ó.öj!Á¦Œ Ï#õ ”›YýâSEs_€Ìe×°R%Ù =«æÒÅ'Ò'Œ|­PQ¢x­­º—œ \͋…Áýõ†]­U‹Y¶sç*°ÈÙv,Yu®Åuö›—³eq†&ñ£Šgd 4å«s£Ù»ç†í›­žPš–¼Öòža¾$‚qVœójz(SÁÛ£}‚éC:̈ §3@G©Ÿ—Œu/Q¦¥3v6˜C¿à3u ~vízH£ÍŽL79àoî²¥Ca0BoŽ4EMÅþÉ9*š±ŸxDÐaÂZnø”ƨnªN4}jCoˆA…7o¦DTÉÐ6mçø=Š´3(á[Ûf35èa׀Ó6‰íTŽÒK8ªßK$ÇAÇAôÆApÇA¤ÆA„ÇA@ÇAhÇAlÆA,ÇA¼ÆAÇA°ÆAÆAÄÆA´°A”ÇAÇAˆÇA(ÈA\ÇAüÆA4ÇA|ÆAŒÆAìÆA ÇA<ÇA¸°AèÆA¤ÇA°°AÀÆAŒÇA¸ÆAdÆA°ÇAðÆA ÇA´ÆA(ÇAÈÇAØ°A¼°A˜ÆA ÇAÇAÇAœÆA ÆA8ÇA¬ÆAPÇA¬ÇAˆÆALÇAøÆAÌÆADÇA`ÇA¬°A ÈA¨ÇA˜ÇAÇAÈÆA€ÆAœÇA”ÆA0ÇAhÆAHÇA´ÇA
process_handle: 0x00000438
base_address: 0x0041b000
success 1 0
1619861178.105184
WriteProcessMemory
process_identifier: 2056
buffer: ,ÒÜÐ ÔHÑXÔXјÔhÑàÔxÑÕ€Ñ8ՐѺÖðÑ*× Òp× Ò:ÒRÒjÒ‚ÒžÒ¬Ò¼ÒÈÒÖÒæÒÓÓ$Ó:ÓPÓbÓtӊӜӮӼÓÊÓÖÓòÓþÓÔ,Ô>ÔLÔfÔzÔŠÔ¦Ô¶ÔÌÔîÔÕ Õ.ÕFÕRÕZÕfÕxÕˆÕ˜Õ¦Õ¶ÕÆÕØÕìÕÖÖ.ÖBÖPÖ`ÖrÖ~֌֚֮ÖÄÖÔÖäÖðÖ× ×6×B×V×^×z׊×kernel32.dllDeleteCriticalSectionLeaveCriticalSectionEnterCriticalSectionInitializeCriticalSectionVirtualFreeVirtualAllocLocalFreeLocalAllocGetTickCountQueryPerformanceCounterGetVersionGetCurrentThreadIdWideCharToMultiByteMultiByteToWideCharGetThreadLocaleGetStartupInfoAGetModuleFileNameAGetLocaleInfoAGetCommandLineAFreeLibraryExitProcessWriteFileUnhandledExceptionFilterRtlUnwindRaiseExceptionGetStdHandleuser32.dllGetKeyboardTypeMessageBoxACharNextAadvapi32.dllRegQueryValueExARegOpenKeyExARegCloseKeyoleaut32.dllSysFreeStringSysReAllocStringLenSysAllocStringLenkernel32.dllGetModuleHandleAadvapi32.dllRegOpenKeyExARegEnumKeyAFreeSidkernel32.dllWriteFileSleepLocalFreeLoadLibraryExWLoadLibraryAGlobalUnlockGlobalLockGetTickCountGetSystemInfoGetProcAddressGetModuleHandleAGetModuleFileNameAGetFileAttributesWGetCurrentProcessIdGetCurrentProcessFreeLibraryFindNextFileWFindFirstFileWFindCloseExitProcessDeleteFileWCreateDirectoryWCopyFileWgdi32.dllSelectObjectDeleteObjectDeleteDCCreateCompatibleDCCreateCompatibleBitmapBitBltuser32.dllReleaseDCGetSystemMetricsGetDCCharToOemBuffAole32.dllOleInitializeCoCreateInstance
process_handle: 0x00000438
base_address: 0x0041d000
success 1 0
1619861178.105184
WriteProcessMemory
process_identifier: 2056
buffer:
process_handle: 0x00000438
base_address: 0x0041e000
success 1 0
1619861178.105184
WriteProcessMemory
process_identifier: 2056
buffer: @
process_handle: 0x00000438
base_address: 0x7efde008
success 1 0
1619861178.105184
NtSetContextThread
thread_handle: 0x0000043c
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4302468
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2056
success 0 0
1619861178.355184
NtResumeThread
thread_handle: 0x0000043c
suspend_count: 1
process_identifier: 2056
success 0 0
1619861178.355184
NtResumeThread
thread_handle: 0x0000045c
suspend_count: 1
process_identifier: 2128
success 0 0
1619879696.685125
NtResumeThread
thread_handle: 0x000000e8
suspend_count: 1
process_identifier: 2056
success 0 0
File has been identified by 51 AntiVirus engines on VirusTotal as malicious (50 out of 51 个事件)
Elastic malicious (high confidence)
DrWeb Trojan.Inject3.51964
MicroWorld-eScan Gen:Variant.Ser.MSILPerseus.5422
FireEye Gen:Variant.Ser.MSILPerseus.5422
CAT-QuickHeal Trojan.MSIL
McAfee Fareit-FXY!B9A1E3F3BC25
Cylance Unsafe
Zillya Trojan.Kryptik.Win32.2391103
Sangfor Malware
K7AntiVirus Trojan ( 0056cba51 )
Alibaba Trojan:MSIL/Formbook.49a5a6d7
K7GW Trojan ( 0056cba51 )
Cybereason malicious.dbe7c8
Arcabit Trojan.Ser.MSILPerseus.D152E
Invincea Mal/Generic-S
BitDefenderTheta Gen:NN.ZemsilF.34216.xm0@aiEj0bf
Cyren W32/MSIL_Kryptik.BMC.gen!Eldorado
Symantec ML.Attribute.HighConfidence
TrendMicro-HouseCall TROJ_GEN.R002C0WHJ20
Paloalto generic.ml
Kaspersky HEUR:Trojan.MSIL.Taskun.gen
BitDefender Gen:Variant.Ser.MSILPerseus.5422
NANO-Antivirus Trojan.Win32.Taskun.hshvdq
AegisLab Trojan.MSIL.Taskun.4!c
Avast Win32:MalwareX-gen [Trj]
Tencent Msil.Trojan.Taskun.Phpx
Ad-Aware Gen:Variant.Ser.MSILPerseus.5422
VIPRE Trojan.Win32.Generic!BT
TrendMicro TROJ_GEN.R002C0WHJ20
Sophos Mal/Generic-S
Ikarus Trojan.MSIL.Crypt
Jiangmin Trojan.MSIL.qita
MaxSecure Trojan.Malware.300983.susgen
Antiy-AVL Trojan/MSIL.Taskun
Microsoft Trojan:MSIL/Formbook.MK!MTB
ViRobot Trojan.Win32.Z.Kryptik.388608.AM
ZoneAlarm HEUR:Trojan.MSIL.Taskun.gen
GData Gen:Variant.Ser.MSILPerseus.5422
AhnLab-V3 Trojan/Win32.Kryptik.R348377
VBA32 TScope.Trojan.MSIL
ALYac Gen:Variant.Ser.MSILPerseus.5422
MAX malware (ai score=80)
Malwarebytes Trojan.MalPack.PNG.Generic
APEX Malicious
ESET-NOD32 a variant of MSIL/Kryptik.XJO
SentinelOne DFI - Malicious PE
Fortinet MSIL/Kryptik.XJO!tr
AVG Win32:MalwareX-gen [Trj]
Panda Trj/GdSda.A
CrowdStrike win/malicious_confidence_90% (W)
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2050-11-04 20:35:28

Imports

Library mscoree.dll:
• 0x402000 _CorExeMain

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 50534 114.114.114.114 53
192.168.56.101 51378 114.114.114.114 53
192.168.56.101 51963 114.114.114.114 53
192.168.56.101 53657 114.114.114.114 53
192.168.56.101 56539 114.114.114.114 53
192.168.56.101 65004 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 49235 224.0.0.252 5355
192.168.56.101 51808 224.0.0.252 5355
192.168.56.101 53237 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 60123 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 50535 239.255.255.250 3702
192.168.56.101 56540 239.255.255.250 3702
192.168.56.101 56807 239.255.255.250 1900
192.168.56.101 58707 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.