SmartHawk

7.4

高危

2 个模型检测该样本为恶意！

重新分析

下载样本

03827b1524f83b5d99506355151d25736de0682fdc2b8a8453cca2697ed88e26

ce3f17e024d77c642a72b4b6fa346067.exe

分析耗时

114s

最近分析

文件大小

6.4MB

静态报毒动态报毒 ADWAREFILETOUR BLADABINDI ELDORADO

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀时间	查杀版本
McAfee	20200316	6.0.6.653
Alibaba	20190527	0.3.0.5
Baidu	20190318	1.0.0.2
Avast	20200316	18.4.3895.0
Kingsoft	20200316	2013.8.14.323
Tencent	20200316	1.0.0.1
CrowdStrike	20190702	1.0

Queries for the computername (18 个事件)

Time & API	Arguments	Status	Return
1620998265.989249 GetComputerNameA	computer_name: OSKAR-PC	success	1
1620998271.192249 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620998271.817249 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620998271.848249 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620998271.989249 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620998272.020249 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620998272.083249 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620998272.161249 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620998272.239249 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620998285.801626 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620998285.848626 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620998286.973626 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620998287.458626 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620998287.911626 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620998288.411626 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620998290.989626 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620998318.629876 GetComputerNameA	computer_name: OSKAR-PC	success	1
1620998318.629876 GetComputerNameW	computer_name: OSKAR-PC	success	1

Checks if process is being debugged by a debugger (9 个事件)

Time & API	Arguments	Status	Return	Repeated
1620998252.286499 IsDebuggerPresent		failed	0	0
1620998273.223876 IsDebuggerPresent		failed	0	0
1620998273.223876 IsDebuggerPresent		failed	0	0
1620998294.692999 IsDebuggerPresent		failed	0	0
1620998294.754999 IsDebuggerPresent		failed	0	0
1620998296.442876 IsDebuggerPresent		failed	0	0
1620998296.442876 IsDebuggerPresent		failed	0	0
1620998318.614876 IsDebuggerPresent		failed	0	0
1620998318.614876 IsDebuggerPresent		failed	0	0

Uses Windows APIs to generate a cryptographic key (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620998273.989876 CryptExportKey	crypto_handle: 0x0054ad88 crypto_export_handle: 0x00000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1	0

Tries to locate where the browsers are installed (1 个事件)

file	C:\Program Files\Google\Chrome\Application\chrome.exe

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620998273.379876 GlobalMemoryStatusEx		success	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)

section	CODE
section	DATA
section	BSS

Allocates read-write-execute memory (usually to unpack itself) (50 out of 119 个事件)

Time & API	Arguments	Status
1620998252.176499 NtProtectVirtualMemory	process_identifier: 3044 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00400000	success
1620998252.176499 NtProtectVirtualMemory	process_identifier: 3044 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 45056 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00401000	success
1620998252.176499 NtProtectVirtualMemory	process_identifier: 3044 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 20480 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00410000	success
1620998252.692249 NtAllocateVirtualMemory	process_identifier: 648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x02370000	success
1620998323.692626 NtAllocateVirtualMemory	process_identifier: 1424 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x000000000a770000	success
1620998272.958876 NtAllocateVirtualMemory	process_identifier: 2712 region_size: 983040 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00600000	success
1620998272.958876 NtAllocateVirtualMemory	process_identifier: 2712 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x006b0000	success
1620998273.098876 NtAllocateVirtualMemory	process_identifier: 2712 region_size: 1900544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x01f70000	success
1620998273.098876 NtAllocateVirtualMemory	process_identifier: 2712 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x02100000	success
1620998273.145876 NtProtectVirtualMemory	process_identifier: 2712 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73c71000	success
1620998273.223876 NtAllocateVirtualMemory	process_identifier: 2712 region_size: 2031616 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x02140000	success
1620998273.223876 NtAllocateVirtualMemory	process_identifier: 2712 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x022f0000	success
1620998273.223876 NtAllocateVirtualMemory	process_identifier: 2712 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0033a000	success
1620998273.239876 NtProtectVirtualMemory	process_identifier: 2712 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73c72000	success
1620998273.239876 NtAllocateVirtualMemory	process_identifier: 2712 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00332000	success
1620998273.426876 NtAllocateVirtualMemory	process_identifier: 2712 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00352000	success
1620998273.520876 NtAllocateVirtualMemory	process_identifier: 2712 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00475000	success
1620998273.520876 NtAllocateVirtualMemory	process_identifier: 2712 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0047b000	success
1620998273.520876 NtAllocateVirtualMemory	process_identifier: 2712 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00477000	success
1620998273.661876 NtAllocateVirtualMemory	process_identifier: 2712 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00353000	success
1620998273.739876 NtAllocateVirtualMemory	process_identifier: 2712 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0035c000	success
1620998273.848876 NtAllocateVirtualMemory	process_identifier: 2712 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00354000	success
1620998273.864876 NtAllocateVirtualMemory	process_identifier: 2712 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00355000	success
1620998273.879876 NtAllocateVirtualMemory	process_identifier: 2712 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x006f0000	success
1620998273.989876 NtAllocateVirtualMemory	process_identifier: 2712 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00356000	success
1620998273.989876 NtAllocateVirtualMemory	process_identifier: 2712 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00357000	success
1620998274.239876 NtAllocateVirtualMemory	process_identifier: 2712 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00358000	success
1620998274.317876 NtAllocateVirtualMemory	process_identifier: 2712 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00359000	success
1620998274.333876 NtAllocateVirtualMemory	process_identifier: 2712 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x008e0000	success
1620998274.333876 NtAllocateVirtualMemory	process_identifier: 2712 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x008e1000	success
1620998274.364876 NtAllocateVirtualMemory	process_identifier: 2712 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00466000	success
1620998274.379876 NtAllocateVirtualMemory	process_identifier: 2712 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x006f1000	success
1620998274.395876 NtAllocateVirtualMemory	process_identifier: 2712 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0046a000	success
1620998274.395876 NtAllocateVirtualMemory	process_identifier: 2712 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00467000	success
1620998274.504876 NtAllocateVirtualMemory	process_identifier: 2712 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x006f2000	success
1620998274.567876 NtAllocateVirtualMemory	process_identifier: 2712 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x008e2000	success
1620998274.567876 NtAllocateVirtualMemory	process_identifier: 2712 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0035d000	success
1620998274.567876 NtAllocateVirtualMemory	process_identifier: 2712 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x006f3000	success
1620998294.098999 NtAllocateVirtualMemory	process_identifier: 176 region_size: 2228224 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00a90000	success
1620998294.098999 NtAllocateVirtualMemory	process_identifier: 176 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00c70000	success
1620998294.629999 NtAllocateVirtualMemory	process_identifier: 176 region_size: 1048576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00500000	success
1620998294.629999 NtAllocateVirtualMemory	process_identifier: 176 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005c0000	success
1620998294.692999 NtProtectVirtualMemory	process_identifier: 176 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73c91000	success
1620998294.692999 NtAllocateVirtualMemory	process_identifier: 176 region_size: 2228224 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x02240000	success
1620998294.692999 NtAllocateVirtualMemory	process_identifier: 176 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x02420000	success
1620998294.754999 NtAllocateVirtualMemory	process_identifier: 176 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003ca000	success
1620998294.754999 NtProtectVirtualMemory	process_identifier: 176 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73c92000	success
1620998294.754999 NtAllocateVirtualMemory	process_identifier: 176 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003c2000	success
1620998294.864999 NtAllocateVirtualMemory	process_identifier: 176 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003d2000	success
1620998294.895999 NtAllocateVirtualMemory	process_identifier: 176 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00405000	success

Checks whether any human activity is being performed by constantly checking whether the foreground window changed

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (4 个事件)

Time & API	Arguments	Status	Return
1620998259.333249 GetDiskFreeSpaceExW	root_path: C:\Program Files (x86)\PowerMation\Poles 'n' Wires\ free_bytes_available: 8600306909957483753 total_number_of_free_bytes: 0 total_number_of_bytes: 4294967295	failed	0
1620998259.333249 GetDiskFreeSpaceExW	root_path: C:\Program Files (x86)\PowerMation\ free_bytes_available: 8600306909957483753 total_number_of_free_bytes: 0 total_number_of_bytes: 4294967295	failed	0
1620998259.333249 GetDiskFreeSpaceExW	root_path: C:\Program Files (x86)\ free_bytes_available: 19607576576 total_number_of_free_bytes: 0 total_number_of_bytes: 34252779520	success	1
1620998294.692626 GetDiskFreeSpaceExW	root_path: C:\Users\Administrator.Oskar-PC\AppData\Local\Microsoft\Windows\Explorer free_bytes_available: 19441037312 total_number_of_free_bytes: 0 total_number_of_bytes: 0	success	1

Creates executable files on the filesystem (8 个事件)

file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PowerMation\Poles 'n' Wires\User manual.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PowerMation\Poles 'n' Wires\Shortcut to data directory.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PowerMation\Poles 'n' Wires\Uninstall Poles 'n' Wires.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PowerMation\Poles 'n' Wires\Poles 'n' Wires 7.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PowerMation\Poles 'n' Wires\Migrate v6.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PowerMation\Poles 'n' Wires\Update licence file.lnk
file	C:\Users\Public\Desktop\Poles 'n' Wires 7.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PowerMation\Poles 'n' Wires\Sample import files.lnk

Creates a shortcut to an executable file (19 个事件)

file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Snipping Tool.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Calculator.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Welcome Center.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PowerMation\Poles 'n' Wires\User manual.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PowerMation\Poles 'n' Wires\Shortcut to data directory.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Paint.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PowerMation\Poles 'n' Wires\Uninstall Poles 'n' Wires.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PowerMation\Poles 'n' Wires\Poles 'n' Wires 7.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Remote Desktop Connection.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PowerMation\Poles 'n' Wires\Migrate v6.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PowerMation\Poles 'n' Wires\Update licence file.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Media Center.lnk
file	C:\Users\Public\Desktop\Poles 'n' Wires 7.lnk
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PowerMation\Poles 'n' Wires\Sample import files.lnk
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Magnify.lnk
file	C:\Users\Public\Desktop\Google Chrome.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Sticky Notes.lnk
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Windows Explorer.lnk

Drops an executable to the user AppData folder (2 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\is-L54VS.tmp\ce3f17e024d77c642a72b4b6fa346067.tmp
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\is-7SE4L.tmp\updateDB2.exe

File has been identified by 2 AntiVirus engines on VirusTotal as malicious (2 个事件)

McAfee-GW-Edition	BehavesLike.Win32.AdwareFileTour.vc
Cyren	W32/MSIL_Bladabindi.DN.gen!Eldorado

Checks for the Locally Unique Identifier on the system for a suspicious privilege (8 个事件)

Time & API	Arguments	Status	Return
1620998287.051626 LookupPrivilegeValueW	system_name: privilege_name: SeShutdownPrivilege	success	1
1620998287.239626 LookupPrivilegeValueW	system_name: privilege_name: SeShutdownPrivilege	success	1
1620998287.348626 LookupPrivilegeValueW	system_name: privilege_name: SeShutdownPrivilege	success	1
1620998287.864626 LookupPrivilegeValueW	system_name: privilege_name: SeShutdownPrivilege	success	1
1620998287.958626 LookupPrivilegeValueW	system_name: privilege_name: SeShutdownPrivilege	success	1
1620998287.989626 LookupPrivilegeValueW	system_name: privilege_name: SeShutdownPrivilege	success	1
1620998288.098626 LookupPrivilegeValueW	system_name: privilege_name: SeShutdownPrivilege	success	1
1620998288.379626 LookupPrivilegeValueW	system_name: privilege_name: SeShutdownPrivilege	success	1

Queries for potentially installed applications (4 个事件)

Time & API	Arguments	Status	Return
1620998253.786249 RegOpenKeyExA	access: 0x00000001 base_handle: 0x80000001 key_handle: 0x00000000 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\{BBA6E011-4EF9-48BD-ADF1-26AB16F9E663}}_is1 regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\{BBA6E011-4EF9-48BD-ADF1-26AB16F9E663}}_is1 options: 0	failed	2
1620998253.786249 RegOpenKeyExA	access: 0x00000001 base_handle: 0x80000002 key_handle: 0x00000000 regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{BBA6E011-4EF9-48BD-ADF1-26AB16F9E663}}_is1 regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\{BBA6E011-4EF9-48BD-ADF1-26AB16F9E663}}_is1 options: 0	failed	2
1620998272.286249 RegOpenKeyExA	access: 0x00000008 base_handle: 0x80000001 key_handle: 0x00000000 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\{BBA6E011-4EF9-48BD-ADF1-26AB16F9E663}}_is1 regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\{BBA6E011-4EF9-48BD-ADF1-26AB16F9E663}}_is1 options: 0	failed	2
1620998272.286249 RegOpenKeyExA	access: 0x00000008 base_handle: 0x80000002 key_handle: 0x00000000 regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{BBA6E011-4EF9-48BD-ADF1-26AB16F9E663}}_is1 regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\{BBA6E011-4EF9-48BD-ADF1-26AB16F9E663}}_is1 options: 0	failed	2

Uses Windows utilities for basic Windows functionality (2 个事件)

cmdline	"C:\Program Files (x86)\PowerMation\Poles 'n' Wires\PnW.NET.exe"
cmdline	pnw.net.exe

Communicates with host for which no DNS query was performed (3 个事件)

host	113.108.239.196
host	172.217.24.14
host	203.208.41.65

Creates or sets a registry key to a long series of bytes, possibly to store a binary or malware config (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620998265.723249 RegSetValueExW	key_handle: 0x000001e4 value: C:\Program Files (x86)\PowerMation\Poles 'n' Wires\ACCCSagLibrary.dllC:\Program Files (x86)\PowerMation\Poles 'n' Wires\batchtipload.dllC:\Program Files (x86)\PowerMation\Poles 'n' Wires\ChangeLicenceType.exeC:\Program Files (x86)\PowerMation\Poles 'n' Wires\clsCTConn.dllC:\Program Files (x86)\PowerMation\Poles 'n' Wires\clsDXF.dllC:\Program Files (x86)\PowerMation\Poles 'n' Wires\clsNetworkClient.dllC:\Program Files (x86)\PowerMation\Poles 'n' Wires\clsPlanView.dllC:\Program Files (x86)\PowerMation\Poles 'n' Wires\clsPnWObject.dllC:\Program Files (x86)\PowerMation\Poles 'n' Wires\clsPoleStrength.dllC:\Program Files (x86)\PowerMation\Poles 'n' Wires\clsProfileCommon.dllC:\Program Files (x86)\PowerMation\Poles 'n' Wires\clsStartup.dllC:\Program Files (x86)\PowerMation\Poles 'n' Wires\clsstrtable3.dllC:\Program Files (x86)\PowerMation\Poles 'n' Wires\clsTiploadObject.dllC:\Program Files (x86)\PowerMation\Poles 'n' Wires\CondSepDLL.dllC:\Program Files (x86)\PowerMation\Poles 'n' Wires\CSV2XLS.dllC:\Program Files (x86)\PowerMation\Poles 'n' Wires\CustomControls.dllC:\Program Files (x86)\PowerMation\Poles 'n' Wires\DatabaseUI_WPF.exeC:\Program Files (x86)\PowerMation\Poles 'n' Wires\DBPasswd.exeC:\Program Files (x86)\PowerMation\Poles 'n' Wires\DBpassword.exeC:\Program Files (x86)\PowerMation\Poles 'n' Wires\ExcelWrapper.dllC:\Program Files (x86)\PowerMation\Poles 'n' Wires\filever.exeC:\Program Files (x86)\PowerMation\Poles 'n' Wires\HtmlRenderer.dllC:\Program Files (x86)\PowerMation\Poles 'n' Wires\Ice.dllC:\Program Files (x86)\PowerMation\Poles 'n' Wires\ICSharpCode.SharpZipLib.dllC:\Program Files (x86)\PowerMation\Poles 'n' Wires\importfromsag10.exeC:\Program Files (x86)\PowerMation\Poles 'n' Wires\import_DBI.dllC:\Program Files (x86)\PowerMation\Poles 'n' Wires\import_DXF.dllC:\Program Files (x86)\PowerMation\Poles 'n' Wires\import_ENE.dllC:\Program Files (x86)\PowerMation\Poles 'n' Wires\import_ENE_excel.dllC:\Program Files (x86)\PowerMation\Poles 'n' Wires\import_ENE_excel_constr.dllC:\Program Files (x86)\PowerMation\Poles 'n' Wires\import_npoles.dllC:\Program Files (x86)\PowerMation\Poles 'n' Wires\import_txt_chlevel.dllC:\Program Files (x86)\PowerMation\Poles 'n' Wires\licenceupdate.exeC:\Program Files (x86)\PowerMation\Poles 'n' Wires\licencing.dllC:\Program Files (x86)\PowerMation\Poles 'n' Wires\licencingWPF.dllC:\Program Files (x86)\PowerMation\Poles 'n' Wires\LiteCAD.dllC:\Program Files (x86)\PowerMation\Poles 'n' Wires\loader.exeC:\Program Files (x86)\PowerMation\Poles 'n' Wires\LoadMESform.dllC:\Program Files (x86)\PowerMation\Poles 'n' Wires\mdb2xml.exeC:\Program Files (x86)\PowerMation\Poles 'n' Wires\MEScalc.dllC:\Program Files (x86)\PowerMation\Poles 'n' Wires\Microsoft.VisualBasic.PowerPacks.dllC:\Program Files (x86)\PowerMation\Poles 'n' Wires\Microsoft.VisualBasic.PowerPacks.Vs.dllC:\Program Files (x86)\PowerMation\Poles 'n' Wires\MigraDoc.DocumentObjectModel.dllC:\Program Files (x86)\PowerMation\Poles 'n' Wires\MigraDoc.Rendering.dllC:\Program Files (x86)\PowerMation\Poles 'n' Wires\MigraDoc.RtfRendering.dllC:\Program Files (x86)\PowerMation\Poles 'n' Wires\MRU_WPF.dllC:\Program Files (x86)\PowerMation\Poles 'n' Wires\NPOI.dllC:\Program Files (x86)\PowerMation\Poles 'n' Wires\NPOI.OOXML.dllC:\Program Files (x86)\PowerMation\Poles 'n' Wires\NPOI.OpenXml4Net.dllC:\Program Files (x86)\PowerMation\Poles 'n' Wires\NPOI.OpenXmlFormats.dllC:\Program Files (x86)\PowerMation\Poles 'n' Wires\OptionsWPF.dllC:\Program Files (x86)\PowerMation\Poles 'n' Wires\PdfSharp-WPF.dllC:\Program Files (x86)\PowerMation\Poles 'n' Wires\PdfSharp.Charting.dllC:\Program Files (x86)\PowerMation\Poles 'n' Wires\PdfSharp.dllC:\Program Files (x86)\PowerMation\Poles 'n' Wires\PdfSharp.Xps.dllC:\Program Files (x86)\PowerMation\Poles 'n' Wires\PnW.NET.exeC:\Program Files (x86)\PowerMation\Poles 'n' Wires\PnWaddon_2stays.dllC:\Program Files (x86)\PowerMation\Poles 'n' Wires\PnWAPI.dllC:\Program Files (x86)\PowerMation\Poles 'n' Wires\PNWCommon.dllC:\Program Files (x86)\PowerMation\Poles 'n' Wires\PnWCommon2.dllC:\Program Files (x86)\PowerMation\Poles 'n' Wires\PnWModel.dllC:\Program Files (x86)\PowerMation\Poles 'n' Wires\PNWReports.dllC:\Program Files (x86)\PowerMation\Poles 'n' Wires\pnwreports2.dllC:\Program Files (x86)\PowerMation\Poles 'n' Wires\PoleStrength.exeC:\Program Files (x86)\PowerMation\Poles 'n' Wires\Profile.dllC:\Program Files (x86)\PowerMation\Poles 'n' Wires\SagCalcOneInstalation.exeC:\Program Files (x86)\PowerMation\Poles 'n' Wires\SessionProtocolInfo.exeC:\Program Files (x86)\PowerMation\Poles 'n' Wires\SetDefColours.exeC:\Program Files (x86)\PowerMation\Poles 'n' Wires\ShowMsg.dllC:\Program Files (x86)\PowerMation\Poles 'n' Wires\SRF.dllC:\Program Files (x86)\PowerMation\Poles 'n' Wires\stringing tables.dllC:\Program Files (x86)\PowerMation\Poles 'n' Wires\Styles.dllC:\Program Files (x86)\PowerMation\Poles 'n' Wires\System.Windows.Controls.Input.Toolkit.dllC:\Program Files (x86)\PowerMation\Poles 'n' Wires\System.Windows.Controls.Layout.Toolkit.dllC:\Program Files (x86)\PowerMation\Poles 'n' Wires\TensionTable.dllC:\Program Files (x86)\PowerMation\Poles 'n' Wires\TiploadModel.dllC:\Program Files (x86)\PowerMation\Poles 'n' Wires\TipLoadModele.dllC:\Program Files (x86)\PowerMation\Poles 'n' Wires\TiploadModuleWPF.exeC:\Program Files (x86)\PowerMation\Poles 'n' Wires\updateDB2.exeC:\Program Files (x86)\PowerMation\Poles 'n' Wires\WPFColorPickerLib.dllC:\Program Files (x86)\PowerMation\Poles 'n' Wires\WPFcommon.dllC:\Program Files (x86)\PowerMation\Poles 'n' Wires\WPFCustom.dllC:\Program Files (x86)\PowerMation\Poles 'n' Wires\WPFTextBoxAutoComplete.dllC:\Program Files (x86)\PowerMation\Poles 'n' Wires\WPFToolkit.dllC:\Program Files (x86)\PowerMation\Poles 'n' Wires\XProtocol.dllC:\Users\ADMINI~1.OSK\AppData\Local\Temp\is-7SE4L.tmp\updateDB2.exe regkey_r: RegFiles0000 reg_type: 7 (REG_MULTI_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000\RegFiles0000	success	0	0

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 个事件)

dead_host

192.168.56.101:49192

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:

• 0x40e0b4 DeleteCriticalSection

• 0x40e0b8 LeaveCriticalSection

• 0x40e0bc EnterCriticalSection

• 0x40e0c0 InitializeCriticalSection

• 0x40e0c4 VirtualFree

• 0x40e0c8 VirtualAlloc

• 0x40e0cc LocalFree

• 0x40e0d0 LocalAlloc

• 0x40e0d4 WideCharToMultiByte

• 0x40e0d8 TlsSetValue

• 0x40e0dc TlsGetValue

• 0x40e0e0 MultiByteToWideChar

• 0x40e0e4 GetModuleHandleA

• 0x40e0e8 GetLastError

• 0x40e0ec GetCommandLineA

• 0x40e0f0 WriteFile

• 0x40e0f4 SetFilePointer

• 0x40e0f8 SetEndOfFile

• 0x40e0fc RtlUnwind

• 0x40e100 ReadFile

• 0x40e104 RaiseException

• 0x40e108 GetStdHandle

• 0x40e10c GetFileSize

• 0x40e110 GetSystemTime

• 0x40e114 GetFileType

• 0x40e118 ExitProcess

• 0x40e11c CreateFileA

• 0x40e120 CloseHandle

Library user32.dll:

• 0x40e128 MessageBoxA

Library oleaut32.dll:

• 0x40e130 VariantChangeTypeEx

• 0x40e134 VariantCopyInd

• 0x40e138 VariantClear

• 0x40e13c SysStringLen

• 0x40e140 SysAllocStringLen

Library advapi32.dll:

• 0x40e148 RegQueryValueExA

• 0x40e14c RegOpenKeyExA

• 0x40e150 RegCloseKey

• 0x40e154 OpenProcessToken

• 0x40e158 LookupPrivilegeValueA

Library kernel32.dll:

• 0x40e160 WriteFile

• 0x40e164 VirtualQuery

• 0x40e168 VirtualProtect

• 0x40e16c VirtualFree

• 0x40e170 VirtualAlloc

• 0x40e174 Sleep

• 0x40e178 SizeofResource

• 0x40e17c SetLastError

• 0x40e180 SetFilePointer

• 0x40e184 SetErrorMode

• 0x40e188 SetEndOfFile

• 0x40e18c RemoveDirectoryA

• 0x40e190 ReadFile

• 0x40e194 LockResource

• 0x40e198 LoadResource

• 0x40e19c LoadLibraryA

• 0x40e1a0 IsDBCSLeadByte

• 0x40e1a4 GetWindowsDirectoryA

• 0x40e1a8 GetVersionExA

• 0x40e1ac GetVersion

• 0x40e1b0 GetUserDefaultLangID

• 0x40e1b4 GetSystemInfo

• 0x40e1b8 GetSystemDirectoryA

• 0x40e1bc GetSystemDefaultLCID

• 0x40e1c0 GetProcAddress

• 0x40e1c4 GetModuleHandleA

• 0x40e1c8 GetModuleFileNameA

• 0x40e1cc GetLocaleInfoA

• 0x40e1d0 GetLastError

• 0x40e1d4 GetFullPathNameA

• 0x40e1d8 GetFileSize

• 0x40e1dc GetFileAttributesA

• 0x40e1e0 GetExitCodeProcess

• 0x40e1e4 GetEnvironmentVariableA

• 0x40e1e8 GetCurrentProcess

• 0x40e1ec GetCommandLineA

• 0x40e1f0 GetACP

• 0x40e1f4 InterlockedExchange

• 0x40e1f8 FormatMessageA

• 0x40e1fc FindResourceA

• 0x40e200 DeleteFileA

• 0x40e204 CreateProcessA

• 0x40e208 CreateFileA

• 0x40e20c CreateDirectoryA

• 0x40e210 CloseHandle

Library user32.dll:

• 0x40e218 TranslateMessage

• 0x40e21c SetWindowLongA

• 0x40e220 PeekMessageA

• 0x40e224 MsgWaitForMultipleObjects

• 0x40e228 MessageBoxA

• 0x40e22c LoadStringA

• 0x40e230 ExitWindowsEx

• 0x40e234 DispatchMessageA

• 0x40e238 DestroyWindow

• 0x40e23c CreateWindowExA

• 0x40e240 CallWindowProcA

• 0x40e244 CharPrevA

Library comctl32.dll:

• 0x40e24c InitCommonControls

Library advapi32.dll:

• 0x40e254 AdjustTokenPrivileges

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
clients2.google.com	CNAME clients.l.google.com A 216.58.200.238	216.58.200.238
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	51378	114.114.114.114	53
192.168.56.101	51808	114.114.114.114	53
192.168.56.101	53657	114.114.114.114	53
192.168.56.101	55368	114.114.114.114	53
192.168.56.101	57874	114.114.114.114	53
192.168.56.101	62318	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	51963	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	57756	224.0.0.252	5355
192.168.56.101	58367	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	63429	224.0.0.252	5355
192.168.56.101	65004	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	55369	239.255.255.250	3702
192.168.56.101	57875	239.255.255.250	3702
192.168.56.101	57877	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.