SmartHawk

8.8

极危

42 个模型检测该样本为恶意！

重新分析

下载样本

b749517f2e364fe86b9ba02ca08c87ced66157ff6aea092a98d2f8c036e77583

cd3fd6a77145a0640125d7843aa82ed1.exe

分析耗时

131s

最近分析

文件大小

7.3MB

静态报毒动态报毒 AI SCORE=100 ARTEMIS CONFIDENCE DECEPTOR DECEPTPCCLEAN DUOFFER FOHMYW GT32SUPPORTGEEKS GT3GEEKS HACKTOOL HOAX HYODEPSA INSTALLER LODI MALWARE@#QZ3X1M51JORO MISLEADING OPTIMIZERPRO OPTINSTALL PCFIXER PCVARK R002C0DCQ21 SCORE SUSGEN SYSTEMOPTIMIZER SZLN UNSAFE 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
Alibaba	RiskWare:Win32/PCFixer.8e2842cf	20190527	0.3.0.5
Avast	Win32:DUOffer-A [Dcp]	20210326	21.1.5827.0
Tencent	Win32.Trojan-psw.Deceptpcclean.Szln	20210327	1.0.0.1
Baidu		20190318	1.0.0.2
Kingsoft		20210327	2017.9.26.565
McAfee	Artemis!CD3FD6A77145	20210326	6.0.6.653
CrowdStrike	win/malicious_confidence_80% (D)	20210203	1.0

Queries for the computername (46 个事件)

Time & API	Arguments	Status	Return
1620994673.20125 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620994676.57625 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620994676.59225 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620994680.52925 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620994680.52925 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620994680.65425 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620994682.85825 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620994683.65425 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620994684.24825 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620994684.77925 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620994684.93625 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620994685.23325 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620994685.95125 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620994685.95125 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620994685.95125 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620994685.95125 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620994685.95125 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620994694.545375 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620994695.076375 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620994674.076625 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620994697.81175 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620994697.95175 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620994697.96775 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620994697.96775 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620994698.85875 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620994698.87375 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620994707.60875 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620994707.62375 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620994707.63975 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620994707.65475 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620994707.65475 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620994707.68675 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620994707.73375 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620994707.82675 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620994707.82675 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620994707.84275 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620994707.85875 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620994707.87375 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620994707.87375 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620994712.87375 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620994712.88975 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620994714.56175 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620994714.74875 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620994715.43675 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620994716.20175 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620994716.27975 GetComputerNameW	computer_name: OSKAR-PC	success	1

Checks if process is being debugged by a debugger (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1620994671.420875 IsDebuggerPresent		failed	0	0
1620994690.17075 IsDebuggerPresent		failed	0	0

Command line console output was observed (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620994674.436625 WriteConsoleW	buffer: 错误: 没有找到进程 "rtc.exe"。 console_handle: 0x0000000b	success	1	0

Uses Windows APIs to generate a cryptographic key (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1620994699.04575 CryptExportKey	crypto_handle: 0x000000001b343ca0 crypto_export_handle: 0x0000000000000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1	0
1620994708.63975 CryptExportKey	crypto_handle: 0x000000001b3510c0 crypto_export_handle: 0x0000000000000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1	0

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 个事件)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

This executable is signed

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620994673.37325 GlobalMemoryStatusEx		success	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 个事件)

section

.itext

Allocates read-write-execute memory (usually to unpack itself) (50 out of 392 个事件)

Time & API	Arguments	Status
1620994671.248875 NtProtectVirtualMemory	process_identifier: 2856 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00400000	success
1620994671.248875 NtProtectVirtualMemory	process_identifier: 2856 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 69632 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00401000	success
1620994671.248875 NtProtectVirtualMemory	process_identifier: 2856 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 102400 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x0041b000	success
1620994672.42025 NtAllocateVirtualMemory	process_identifier: 2248 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00680000	success
1620994744.561375 NtAllocateVirtualMemory	process_identifier: 1424 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00000000045b0000	success
1620994687.48375 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 851968 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x0000000000ad0000	success
1620994687.48375 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0000000000b20000	success
1620994689.38975 NtProtectVirtualMemory	process_identifier: 2440 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff base_address: 0x000007fef1781000	success
1620994690.01475 NtProtectVirtualMemory	process_identifier: 2440 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff base_address: 0x000007fef19fe000	success
1620994690.01475 NtProtectVirtualMemory	process_identifier: 2440 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff base_address: 0x000007fef19fe000	success
1620994690.32675 NtProtectVirtualMemory	process_identifier: 2440 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff base_address: 0x000007fef19ff000	success
1620994690.32675 NtProtectVirtualMemory	process_identifier: 2440 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff base_address: 0x000007fef19ff000	success
1620994690.32675 NtProtectVirtualMemory	process_identifier: 2440 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff base_address: 0x000007fef19ff000	success
1620994690.34275 NtProtectVirtualMemory	process_identifier: 2440 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff base_address: 0x000007fef19ff000	success
1620994690.34275 NtProtectVirtualMemory	process_identifier: 2440 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff base_address: 0x000007fef19ff000	success
1620994690.34275 NtProtectVirtualMemory	process_identifier: 2440 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff base_address: 0x000007fef19ff000	success
1620994690.34275 NtProtectVirtualMemory	process_identifier: 2440 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff base_address: 0x000007fef19ff000	success
1620994690.34275 NtProtectVirtualMemory	process_identifier: 2440 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff base_address: 0x000007fef19ff000	success
1620994690.34275 NtProtectVirtualMemory	process_identifier: 2440 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff base_address: 0x000007fef1a00000	success
1620994690.35875 NtProtectVirtualMemory	process_identifier: 2440 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff base_address: 0x000007fef1a00000	success
1620994690.35875 NtProtectVirtualMemory	process_identifier: 2440 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff base_address: 0x000007fef1a00000	success
1620994690.35875 NtProtectVirtualMemory	process_identifier: 2440 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff base_address: 0x000007fef1a00000	success
1620994690.35875 NtProtectVirtualMemory	process_identifier: 2440 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff base_address: 0x000007fef1a00000	success
1620994690.35875 NtProtectVirtualMemory	process_identifier: 2440 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff base_address: 0x000007fef1a01000	success
1620994690.35875 NtProtectVirtualMemory	process_identifier: 2440 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff base_address: 0x000007fef1a01000	success
1620994690.35875 NtProtectVirtualMemory	process_identifier: 2440 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff base_address: 0x000007fef1a01000	success
1620994690.35875 NtProtectVirtualMemory	process_identifier: 2440 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff base_address: 0x000007fef1a01000	success
1620994690.35875 NtProtectVirtualMemory	process_identifier: 2440 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff base_address: 0x000007fef19fe000	success
1620994691.26475 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x000007ff00032000	success
1620994691.46775 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 589824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) base_address: 0x000007fffff10000	success
1620994691.48375 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x000007fffff10000	success
1620994691.48375 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x000007fffff10000	success
1620994691.48375 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) base_address: 0x000007fffff00000	success
1620994691.48375 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x000007fffff00000	success
1620994691.49875 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x000007ff000ea000	success
1620994691.52975 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x000007ff00022000	success
1620994691.74875 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x000007ff00033000	success
1620994691.74875 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x000007ff00034000	success
1620994691.82675 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x000007ff000fa000	success
1620994691.82675 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x000007ff00122000	success
1620994691.82675 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x000007ff000fd000	success
1620994691.93675 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x000007ff0003c000	success
1620994692.37375 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x000007ff00180000	success
1620994693.07675 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x000007ff00035000	success
1620994693.93675 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x000007ff00036000	success
1620994695.51475 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x000007ff00038000	success
1620994695.68675 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x000007ff00039000	success
1620994695.71775 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x000007ff001c0000	success
1620994696.15475 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x000007ff0004f000	success
1620994696.15475 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x000007ff00084000	success

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620994695.701375 GetDiskFreeSpaceExW	root_path: C:\Users\Administrator.Oskar-PC\AppData\Local\Microsoft\Windows\Explorer free_bytes_available: 19452870656 total_number_of_free_bytes: 0 total_number_of_bytes: 0	success	1	0

Creates executable files on the filesystem (6 个事件)

file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Qbit System Care for OSKAR-PC\Buy Qbit System Care.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Qbit System Care for OSKAR-PC\Qbit System Care.lnk
file	C:\Users\Public\Desktop\Qbit System Care.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Qbit System Care for OSKAR-PC\Uninstall Qbit System Care.lnk
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\is-BPFFS.tmp\_isetup\_iscrypt.dll
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\is-BPFFS.tmp\_isetup\_shfoldr.dll

Creates a shortcut to an executable file (6 个事件)

file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Qbit System Care for OSKAR-PC\Buy Qbit System Care.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Qbit System Care for OSKAR-PC\Qbit System Care.lnk
file	C:\Users\Public\Desktop\Qbit System Care.lnk
file	C:\Users\Public\Desktop\Google Chrome.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Qbit System Care for OSKAR-PC\Uninstall Qbit System Care.lnk
file	C:\Program Files\Qbit System Care for OSKAR-PC\Buy Qbit System Care.lnk

Executes one or more WMI queries (1 个事件)

wmi	SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "rtc.exe")

A process created a hidden window (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620994673.56125 ShellExecuteExW	parameters: /f /im "rtc.exe" filepath: taskkill.exe filepath_r: taskkill.exe show_type: 0	success	1	0

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1620994674.076625 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1	0
1620994716.46775 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1	0

Queries for potentially installed applications (10 个事件)

Time & API	Arguments	Status	Return
1620994676.57625 RegOpenKeyExW	access: 0x00000101 base_handle: 0x80000001 key_handle: 0x00000000 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\{D9FB05BA-016B-4400-8EB1-660016062BF7}_is1 regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\{D9FB05BA-016B-4400-8EB1-660016062BF7}_is1 options: 0	failed	2
1620994676.57625 RegOpenKeyExW	access: 0x00000101 base_handle: 0x80000002 key_handle: 0x00000000 regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{D9FB05BA-016B-4400-8EB1-660016062BF7}_is1 regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\{D9FB05BA-016B-4400-8EB1-660016062BF7}_is1 options: 0	failed	2
1620994676.59225 RegOpenKeyExW	access: 0x00000101 base_handle: 0x80000002 key_handle: 0x00000000 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Avast regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Avast options: 0	failed	2
1620994676.59225 RegOpenKeyExW	access: 0x00000101 base_handle: 0x80000002 key_handle: 0x00000000 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Avast Antivirus regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Avast Antivirus options: 0	failed	2
1620994676.59225 RegOpenKeyExW	access: 0x00000101 base_handle: 0x80000002 key_handle: 0x00000000 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4CB91122-AA85-4431-953C-BEFAEC86DA97}_is1 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4CB91122-AA85-4431-953C-BEFAEC86DA97}_is1 options: 0	failed	2
1620994676.59225 RegOpenKeyExW	access: 0x00000101 base_handle: 0x80000002 key_handle: 0x00000000 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Avast Antivirus regkey_r: SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Avast Antivirus options: 0	failed	2
1620994676.59225 RegOpenKeyExW	access: 0x00000101 base_handle: 0x80000002 key_handle: 0x00000000 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Avast regkey_r: SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Avast options: 0	failed	2
1620994676.59225 RegOpenKeyExW	access: 0x00000101 base_handle: 0x80000002 key_handle: 0x00000000 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AVG Antivirus regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AVG Antivirus options: 0	failed	2
1620994685.98325 RegOpenKeyExW	access: 0x00000108 base_handle: 0x80000001 key_handle: 0x00000000 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\{D9FB05BA-016B-4400-8EB1-660016062BF7}_is1 regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\{D9FB05BA-016B-4400-8EB1-660016062BF7}_is1 options: 0	failed	2
1620994685.98325 RegOpenKeyExW	access: 0x00000108 base_handle: 0x80000002 key_handle: 0x00000000 regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{D9FB05BA-016B-4400-8EB1-660016062BF7}_is1 regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\{D9FB05BA-016B-4400-8EB1-660016062BF7}_is1 options: 0	failed	2

Uses Windows utilities for basic Windows functionality (2 个事件)

cmdline	"C:\Windows\System32\taskkill.exe" /f /im "rtc.exe"
cmdline	taskkill.exe /f /im "rtc.exe"

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Attempts to identify installed AV products by registry key (6 个事件)

registry	HKEY_LOCAL_MACHINE\SOFTWARE\AVG\Antivirus
registry	HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\AVG\Antivirus
registry	HKEY_LOCAL_MACHINE\SOFTWARE\AVG\AV\Dir
registry	HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\AVG\AV\Dir
registry	HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast\Version
registry	HKEY_LOCAL_MACHINE\SOFTWARE\AVAST Software\Avast

A process performed obfuscation on information about the computer or sent it to a remote location indicative of CnC Traffic/Preperations. (20 个事件)

Time & API	Arguments	Status	Return
1620994697.51475 CryptHashData	buffer: ÿÿÿÿ>FILE:///C:/PROGRAM FILES/QBIT SYSTEM CARE FOR OSKAR-PC/RTC.EXE flags: 0 hash_handle: 0x000000000076e300	success	1
1620994697.51475 CryptHashData	buffer: ÿÿÿÿ>FILE:///C:/PROGRAM FILES/QBIT SYSTEM CARE FOR OSKAR-PC/RTC.EXE flags: 0 hash_handle: 0x000000000076e300	success	1
1620994697.51475 CryptHashData	buffer: ÿÿÿÿ>FILE:///C:/PROGRAM FILES/QBIT SYSTEM CARE FOR OSKAR-PC/RTC.EXE flags: 0 hash_handle: 0x000000000076e300	success	1
1620994697.51475 CryptHashData	buffer: ÿÿÿÿ>FILE:///C:/PROGRAM FILES/QBIT SYSTEM CARE FOR OSKAR-PC/RTC.EXE flags: 0 hash_handle: 0x000000000076e300	success	1
1620994697.51475 CryptHashData	buffer: ÿÿÿÿ>FILE:///C:/PROGRAM FILES/QBIT SYSTEM CARE FOR OSKAR-PC/RTC.EXE flags: 0 hash_handle: 0x000000000076e300	success	1
1620994697.51475 CryptHashData	buffer: ÿÿÿÿ>FILE:///C:/PROGRAM FILES/QBIT SYSTEM CARE FOR OSKAR-PC/RTC.EXE flags: 0 hash_handle: 0x000000000076e300	success	1
1620994697.51475 CryptHashData	buffer: ÿÿÿÿ>FILE:///C:/PROGRAM FILES/QBIT SYSTEM CARE FOR OSKAR-PC/RTC.EXE flags: 0 hash_handle: 0x000000000076e300	success	1
1620994697.51475 CryptHashData	buffer: ÿÿÿÿ>FILE:///C:/PROGRAM FILES/QBIT SYSTEM CARE FOR OSKAR-PC/RTC.EXE flags: 0 hash_handle: 0x000000000076e300	success	1
1620994697.51475 CryptHashData	buffer: ÿÿÿÿ>FILE:///C:/PROGRAM FILES/QBIT SYSTEM CARE FOR OSKAR-PC/RTC.EXE flags: 0 hash_handle: 0x000000000076e300	success	1
1620994697.51475 CryptHashData	buffer: ÿÿÿÿ>FILE:///C:/PROGRAM FILES/QBIT SYSTEM CARE FOR OSKAR-PC/RTC.EXE flags: 0 hash_handle: 0x000000000076e300	success	1
1620994697.51475 CryptHashData	buffer: ÿÿÿÿ>FILE:///C:/PROGRAM FILES/QBIT SYSTEM CARE FOR OSKAR-PC/RTC.EXE flags: 0 hash_handle: 0x000000000076e300	success	1
1620994697.51475 CryptHashData	buffer: ÿÿÿÿ>FILE:///C:/PROGRAM FILES/QBIT SYSTEM CARE FOR OSKAR-PC/RTC.EXE flags: 0 hash_handle: 0x000000000076e300	success	1
1620994697.51475 CryptHashData	buffer: ÿÿÿÿ>FILE:///C:/PROGRAM FILES/QBIT SYSTEM CARE FOR OSKAR-PC/RTC.EXE flags: 0 hash_handle: 0x000000000076e300	success	1
1620994697.51475 CryptHashData	buffer: ÿÿÿÿ>FILE:///C:/PROGRAM FILES/QBIT SYSTEM CARE FOR OSKAR-PC/RTC.EXE flags: 0 hash_handle: 0x000000000076e300	success	1
1620994697.51475 CryptHashData	buffer: ÿÿÿÿ>FILE:///C:/PROGRAM FILES/QBIT SYSTEM CARE FOR OSKAR-PC/RTC.EXE flags: 0 hash_handle: 0x000000000076e300	success	1
1620994697.51475 CryptHashData	buffer: ÿÿÿÿ>FILE:///C:/PROGRAM FILES/QBIT SYSTEM CARE FOR OSKAR-PC/RTC.EXE flags: 0 hash_handle: 0x000000000076e300	success	1
1620994697.51475 CryptHashData	buffer: ÿÿÿÿ>FILE:///C:/PROGRAM FILES/QBIT SYSTEM CARE FOR OSKAR-PC/RTC.EXE flags: 0 hash_handle: 0x000000000076e300	success	1
1620994697.51475 CryptHashData	buffer: ÿÿÿÿ>FILE:///C:/PROGRAM FILES/QBIT SYSTEM CARE FOR OSKAR-PC/RTC.EXE flags: 0 hash_handle: 0x000000000076e300	success	1
1620994697.51475 CryptHashData	buffer: ÿÿÿÿ>FILE:///C:/PROGRAM FILES/QBIT SYSTEM CARE FOR OSKAR-PC/RTC.EXE flags: 0 hash_handle: 0x000000000076e300	success	1
1620994697.51475 CryptHashData	buffer: ÿÿÿÿ>FILE:///C:/PROGRAM FILES/QBIT SYSTEM CARE FOR OSKAR-PC/RTC.EXE flags: 0 hash_handle: 0x000000000076e300	success	1

Detects VirtualBox through the presence of a file (1 个事件)

file	c:\Windows\System32\VBoxTray.exe

File has been identified by 42 AntiVirus engines on VirusTotal as malicious (42 个事件)

DrWeb	Program.Unwanted.3897
MicroWorld-eScan	Application.Deceptor.MF
ALYac	Application.Deceptor.MF
Cylance	Unsafe
Sangfor	PUP.Win32.GT3Geeks.avi
K7AntiVirus	Adware ( 005494271 )
Alibaba	RiskWare:Win32/PCFixer.8e2842cf
K7GW	Adware ( 005494271 )
Cybereason	malicious.77145a
Symantec	Trojan.Gen.2
ESET-NOD32	a variant of Win32/GT32SupportGeeks.U potentially unwanted
Avast	Win32:DUOffer-A [Dcp]
Kaspersky	Hoax.Win32.DeceptPCClean.crw
BitDefender	Application.Deceptor.MF
NANO-Antivirus	Riskware.Win32.DeceptPCClean.fohmyw
Tencent	Win32.Trojan-psw.Deceptpcclean.Szln
Ad-Aware	Application.Deceptor.MF
Emsisoft	Application.OptInstall (A)
Comodo	Malware@#qz3x1m51joro
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	TROJ_GEN.R002C0DCQ21
McAfee-GW-Edition	Artemis!PUP
FireEye	Application.Deceptor.MF
Sophos	Mal/Generic-S
Avira	PUA/GT3Geeks.avi
Microsoft	Misleading:Win32/Lodi
Gridinsoft	PUP.SystemOptimizer.sb!c
Arcabit	Application.Deceptor.MF
AegisLab	Hacktool.Win32.DeceptPCClean.3!c
GData	Application.Deceptor.MF
Cynet	Malicious (score: 85)
AhnLab-V3	PUP/Win32.Installer.C3111500
McAfee	Artemis!CD3FD6A77145
MAX	malware (ai score=100)
Malwarebytes	PUP.Optional.PCVARK
MaxSecure	Trojan.Malware.74161428.susgen
Fortinet	Riskware/PCFixer
Webroot	W32.Adware.Gen
AVG	Win32:DUOffer-A [Dcp]
Panda	PUP/OptimizerPro
CrowdStrike	win/malicious_confidence_80% (D)
Qihoo-360	Win32/Adware.DeceptPCClean.HyoDEpsA

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2016-01-15 16:22:50

Imports

Library oleaut32.dll:

• 0x4192fc SysFreeString

• 0x419300 SysReAllocStringLen

• 0x419304 SysAllocStringLen

Library advapi32.dll:

• 0x41930c RegQueryValueExW

• 0x419310 RegOpenKeyExW

• 0x419314 RegCloseKey

Library user32.dll:

• 0x41931c GetKeyboardType

• 0x419320 LoadStringW

• 0x419324 MessageBoxA

• 0x419328 CharNextW

Library kernel32.dll:

• 0x419330 GetACP

• 0x419334 Sleep

• 0x419338 VirtualFree

• 0x41933c VirtualAlloc

• 0x419340 GetSystemInfo

• 0x419344 GetTickCount

• 0x419348 QueryPerformanceCounter

• 0x41934c GetVersion

• 0x419350 GetCurrentThreadId

• 0x419354 VirtualQuery

• 0x419358 WideCharToMultiByte

• 0x41935c MultiByteToWideChar

• 0x419360 lstrlenW

• 0x419364 lstrcpynW

• 0x419368 LoadLibraryExW

• 0x41936c GetThreadLocale

• 0x419370 GetStartupInfoA

• 0x419374 GetProcAddress

• 0x419378 GetModuleHandleW

• 0x41937c GetModuleFileNameW

• 0x419380 GetLocaleInfoW

• 0x419384 GetCommandLineW

• 0x419388 FreeLibrary

• 0x41938c FindFirstFileW

• 0x419390 FindClose

• 0x419394 ExitProcess

• 0x419398 WriteFile

• 0x41939c UnhandledExceptionFilter

• 0x4193a0 RtlUnwind

• 0x4193a4 RaiseException

• 0x4193a8 GetStdHandle

• 0x4193ac CloseHandle

Library kernel32.dll:

• 0x4193b4 TlsSetValue

• 0x4193b8 TlsGetValue

• 0x4193bc LocalAlloc

• 0x4193c0 GetModuleHandleW

Library user32.dll:

• 0x4193c8 CreateWindowExW

• 0x4193cc TranslateMessage

• 0x4193d0 SetWindowLongW

• 0x4193d4 PeekMessageW

• 0x4193d8 MsgWaitForMultipleObjects

• 0x4193dc MessageBoxW

• 0x4193e0 LoadStringW

• 0x4193e4 GetSystemMetrics

• 0x4193e8 ExitWindowsEx

• 0x4193ec DispatchMessageW

• 0x4193f0 DestroyWindow

• 0x4193f4 CharUpperBuffW

• 0x4193f8 CallWindowProcW

Library kernel32.dll:

• 0x419400 WriteFile

• 0x419404 WideCharToMultiByte

• 0x419408 WaitForSingleObject

• 0x41940c VirtualQuery

• 0x419410 VirtualProtect

• 0x419414 VirtualFree

• 0x419418 VirtualAlloc

• 0x41941c SizeofResource

• 0x419420 SignalObjectAndWait

• 0x419424 SetLastError

• 0x419428 SetFilePointer

• 0x41942c SetEvent

• 0x419430 SetErrorMode

• 0x419434 SetEndOfFile

• 0x419438 ResetEvent

• 0x41943c RemoveDirectoryW

• 0x419440 ReadFile

• 0x419444 MultiByteToWideChar

• 0x419448 LockResource

• 0x41944c LoadResource

• 0x419450 LoadLibraryW

• 0x419454 GetWindowsDirectoryW

• 0x419458 GetVersionExW

• 0x41945c GetUserDefaultLangID

• 0x419460 GetThreadLocale

• 0x419464 GetSystemInfo

• 0x419468 GetStdHandle

• 0x41946c GetProcAddress

• 0x419470 GetModuleHandleW

• 0x419474 GetModuleFileNameW

• 0x419478 GetLocaleInfoW

• 0x41947c GetLastError

• 0x419480 GetFullPathNameW

• 0x419484 GetFileSize

• 0x419488 GetFileAttributesW

• 0x41948c GetExitCodeProcess

• 0x419490 GetEnvironmentVariableW

• 0x419494 GetDiskFreeSpaceW

• 0x419498 GetCurrentProcess

• 0x41949c GetCommandLineW

• 0x4194a0 GetCPInfo

• 0x4194a4 InterlockedExchange

• 0x4194a8 InterlockedCompareExchange

• 0x4194ac FreeLibrary

• 0x4194b0 FormatMessageW

• 0x4194b4 FindResourceW

• 0x4194b8 EnumCalendarInfoW

• 0x4194bc DeleteFileW

• 0x4194c0 CreateProcessW

• 0x4194c4 CreateFileW

• 0x4194c8 CreateEventW

• 0x4194cc CreateDirectoryW

• 0x4194d0 CloseHandle

Library advapi32.dll:

• 0x4194d8 RegQueryValueExW

• 0x4194dc RegOpenKeyExW

• 0x4194e0 RegCloseKey

• 0x4194e4 OpenProcessToken

• 0x4194e8 LookupPrivilegeValueW

Library comctl32.dll:

• 0x4194f0 InitCommonControls

Library kernel32.dll:

• 0x4194f8 Sleep

Library advapi32.dll:

• 0x419500 AdjustTokenPrivileges

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	50534	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	58367	114.114.114.114	53
192.168.56.101	65004	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	55368	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	56807	239.255.255.250	1900
192.168.56.101	58368	239.255.255.250	3702
192.168.56.101	58370	239.255.255.250	3702
192.168.56.101	58707	239.255.255.250	3702
192.168.56.101	62192	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.