SmartHawk

6.0

高危

该样本未表现出任何异常！

重新分析

下载样本

515e4c1c6839088386b2b7a059b3c1265058413b857f494aa39af3f0568c6644

da5498a1b72dff8029f4db11bf2e1a1d.exe

分析耗时

103s

最近分析

文件大小

111.6KB

静态报毒动态报毒

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀时间	查杀版本
McAfee	20210110	6.0.6.653
Alibaba	20190527	0.3.0.5
CrowdStrike	20190702	1.0
Avast	20210109	21.1.5827.0
Baidu	20190318	1.0.0.2
Kingsoft	20210110	2017.9.26.565
Tencent	20210110	1.0.0.1

Queries for the computername (3 个事件)

Time & API	Arguments	Status	Return
1620832565.124626 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620832184.080395 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620832184.377395 GetComputerNameW	computer_name: OSKAR-PC	success	1

Checks if process is being debugged by a debugger (3 个事件)

Time & API	Arguments	Status	Return	Repeated
1620832559.921249 IsDebuggerPresent		failed	0	0
1620832559.921249 IsDebuggerPresent		failed	0	0
1620832163.080395 IsDebuggerPresent		failed	0	0

Command line console output was observed (50 out of 54 个事件)

Time & API	Arguments	Status	Return
1620832563.483249 WriteConsoleA	buffer: OsParamsOsBits: X64 console_handle: 0x00000007	success	1
1620832563.530249 WriteConsoleA	buffer: OfficeParamshas32BitOffice: False console_handle: 0x00000007	success	1
1620832563.530249 WriteConsoleA	buffer: OfficeParamshas64BitOffice: False console_handle: 0x00000007	success	1
1620832563.546249 WriteConsoleA	buffer: OfficeParamsOfficeVersions Count: 0 console_handle: 0x00000007	success	1
1620832563.546249 WriteConsoleA	buffer: OfficeParamsNot compatible office version! console_handle: 0x00000007	success	1
1620832563.562249 WriteConsoleA	buffer: OfficeParamsIsSetupedOffice2007: False console_handle: 0x00000007	success	1
1620832563.562249 WriteConsoleA	buffer: OfficeParamsNeedSetupPdfXps: False console_handle: 0x00000007	success	1
1620832589.952249 WriteConsoleA	buffer: InstallerManager.CopyAddinFolderToSetupPathInstall Failed! PeAddins SrcPath is not exist. console_handle: 0x00000007	success	1
1620832589.952249 WriteConsoleA	buffer: InstallerManager.Install() allInstaller count = 2 console_handle: 0x00000007	success	1
1620832589.952249 WriteConsoleA	buffer: InstallerManager.Install PeShellExtInstaller begin.======================================== console_handle: 0x00000007	success	1
1620832589.968249 WriteConsoleA	buffer: InstallHelper.CheckFileListExistOsParams.Is64BitOs: True console_handle: 0x00000007	success	1
1620832589.968249 WriteConsoleA	buffer: InstallHelper.CheckFileListExistaddinParams.AddInDllFile: PEShellExt_x64.dll console_handle: 0x00000007	success	1
1620832589.968249 WriteConsoleA	buffer: InstallHelper.CheckFileListExistCheckFileListExist failed! "C:\Program Files (x86)\Common Files\Wondershare\PDFelement\AddIns\PEShellExt_x64.dll" is not exist console_handle: 0x00000007	success	1
1620832589.983249 WriteConsoleA	buffer: Installbase.Ready() CheckFileListExist failed! console_handle: 0x00000007	success	1
1620832589.983249 WriteConsoleA	buffer: PeShellExtInstallerReady() failed! console_handle: 0x00000007	success	1
1620832589.999249 WriteConsoleA	buffer: InstallBase.InstallStart Install PEShellExt! console_handle: 0x00000007	success	1
1620832589.999249 WriteConsoleA	buffer: InstallHelper.CheckFileListExistOsParams.Is64BitOs: True console_handle: 0x00000007	success	1
1620832589.999249 WriteConsoleA	buffer: InstallHelper.CheckFileListExistaddinParams.AddInDllFile: PEShellExt_x64.dll console_handle: 0x00000007	success	1
1620832589.999249 WriteConsoleA	buffer: InstallHelper.CheckFileListExistCheckFileListExist failed! "C:\Program Files (x86)\Common Files\Wondershare\PDFelement\AddIns\PEShellExt_x64.dll" is not exist console_handle: 0x00000007	success	1
1620832590.015249 WriteConsoleA	buffer: Installbase.Ready() CheckFileListExist failed! console_handle: 0x00000007	success	1
1620832590.030249 WriteConsoleA	buffer: InstallBase.InstallInstall Failed! Ready() is false! console_handle: 0x00000007	success	1
1620832590.046249 WriteConsoleA	buffer: PeShellExtInstallerInstall() failed! console_handle: 0x00000007	success	1
1620832590.046249 WriteConsoleA	buffer: PeShellExtInstallerFinished() success! console_handle: 0x00000007	success	1
1620832590.093249 WriteConsoleA	buffer: InstallerManager.Install PeShellExtInstallerend.======================================== console_handle: 0x00000007	success	1
1620832590.093249 WriteConsoleA	buffer: InstallerManager.Install PeOfficeAddinInstaller begin.======================================== console_handle: 0x00000007	success	1
1620832590.124249 WriteConsoleA	buffer: PeOfficeAddinParams.AddInDllFileNo Office installed! AddInDllFile is empty! console_handle: 0x00000007	success	1
1620832590.140249 WriteConsoleA	buffer: InstallHelper.CheckFileListExistOsParams.Is64BitOs: True console_handle: 0x00000007	success	1
1620832590.155249 WriteConsoleA	buffer: PeOfficeAddinParams.AddInDllFileNo Office installed! AddInDllFile is empty! console_handle: 0x00000007	success	1
1620832590.171249 WriteConsoleA	buffer: InstallHelper.CheckFileListExistaddinParams.AddInDllFile: console_handle: 0x00000007	success	1
1620832590.202249 WriteConsoleA	buffer: InstallHelper.CheckFileListExistCheckFileListExist failed! "C:\Program Files (x86)\Common Files\Wondershare\PDFelement\AddIns" is not exist console_handle: 0x00000007	success	1
1620832590.202249 WriteConsoleA	buffer: Installbase.Ready() CheckFileListExist failed! console_handle: 0x00000007	success	1
1620832590.218249 WriteConsoleA	buffer: PeOfficeAddinInstallerReady() failed! console_handle: 0x00000007	success	1
1620832590.233249 WriteConsoleA	buffer: InstallBase.InstallStart Install PEOfficeAddIn! console_handle: 0x00000007	success	1
1620832590.343249 WriteConsoleA	buffer: PeOfficeAddinParams.AddInDllFileNo Office installed! AddInDllFile is empty! console_handle: 0x00000007	success	1
1620832590.358249 WriteConsoleA	buffer: InstallHelper.CheckFileListExistOsParams.Is64BitOs: True console_handle: 0x00000007	success	1
1620832590.374249 WriteConsoleA	buffer: PeOfficeAddinParams.AddInDllFileNo Office installed! AddInDllFile is empty! console_handle: 0x00000007	success	1
1620832590.390249 WriteConsoleA	buffer: InstallHelper.CheckFileListExistaddinParams.AddInDllFile: console_handle: 0x00000007	success	1
1620832590.405249 WriteConsoleA	buffer: InstallHelper.CheckFileListExistCheckFileListExist failed! "C:\Program Files (x86)\Common Files\Wondershare\PDFelement\AddIns" is not exist console_handle: 0x00000007	success	1
1620832590.405249 WriteConsoleA	buffer: Installbase.Ready() CheckFileListExist failed! console_handle: 0x00000007	success	1
1620832590.405249 WriteConsoleA	buffer: InstallBase.InstallInstall Failed! Ready() is false! console_handle: 0x00000007	success	1
1620832590.421249 WriteConsoleA	buffer: PeOfficeAddinInstallerInstall() failed! console_handle: 0x00000007	success	1
1620832590.421249 WriteConsoleA	buffer: PeOfficeAddinInstallerFinished() success! console_handle: 0x00000007	success	1
1620832590.437249 WriteConsoleA	buffer: InstallerManager.Install PeOfficeAddinInstallerend.======================================== console_handle: 0x00000007	success	1
1620832595.655249 WriteConsoleA	buffer: PEAddInDeployment Setup Failed console_handle: 0x00000007	success	1
1620832595.671249 WriteConsoleA	buffer: ProgramExcute failed! console_handle: 0x00000007	success	1
1620832564.405374 WriteConsoleW	buffer: Microsoft Windows [版本 6.1.7601] console_handle: 0x00000007	success	1
1620832564.405374 WriteConsoleW	buffer: 版权所有 (c) 2009 Microsoft Corporation。保留所有权利。 console_handle: 0x00000007	success	1
1620832564.421374 WriteConsoleW	buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp> console_handle: 0x00000007	success	1
1620832564.421374 WriteConsoleW	buffer: taskkill /f /im explorer.exe&exit console_handle: 0x00000007	success	1
1620832585.655626 WriteConsoleW	buffer: 成功: 已终止进程 "explorer.exe"，其 PID 为 1424。 console_handle: 0x00000007	success	1

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 个事件)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

This executable is signed

This executable has a PDB path (1 个事件)

pdb_path

e:\JENKINS_HOME\workspace\PDFelement\Src\PDFElement\Depends\PEAddInDeployment\obj\x86\Release\PEAddInDeployment.pdb

Tries to locate where the browsers are installed (1 个事件)

file	C:\Program Files\Google\Chrome\Application\

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620832559.983249 GlobalMemoryStatusEx		success	1	0

Allocates read-write-execute memory (usually to unpack itself) (42 个事件)

Time & API	Arguments	Status
1620832559.046249 NtAllocateVirtualMemory	process_identifier: 2856 region_size: 917504 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x005d0000	success
1620832559.046249 NtAllocateVirtualMemory	process_identifier: 2856 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00670000	success
1620832559.530249 NtAllocateVirtualMemory	process_identifier: 2856 region_size: 1966080 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00af0000	success
1620832559.530249 NtAllocateVirtualMemory	process_identifier: 2856 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00c90000	success
1620832559.749249 NtProtectVirtualMemory	process_identifier: 2856 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73e71000	success
1620832559.921249 NtAllocateVirtualMemory	process_identifier: 2856 region_size: 1572864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00af0000	success
1620832559.921249 NtAllocateVirtualMemory	process_identifier: 2856 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00c30000	success
1620832559.937249 NtAllocateVirtualMemory	process_identifier: 2856 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0045a000	success
1620832559.937249 NtProtectVirtualMemory	process_identifier: 2856 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73e72000	success
1620832559.937249 NtAllocateVirtualMemory	process_identifier: 2856 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00452000	success
1620832560.452249 NtAllocateVirtualMemory	process_identifier: 2856 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00462000	success
1620832560.671249 NtAllocateVirtualMemory	process_identifier: 2856 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00485000	success
1620832560.687249 NtAllocateVirtualMemory	process_identifier: 2856 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0048b000	success
1620832560.687249 NtAllocateVirtualMemory	process_identifier: 2856 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00487000	success
1620832560.968249 NtAllocateVirtualMemory	process_identifier: 2856 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00463000	success
1620832561.062249 NtAllocateVirtualMemory	process_identifier: 2856 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0046c000	success
1620832561.202249 NtAllocateVirtualMemory	process_identifier: 2856 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00464000	success
1620832561.218249 NtAllocateVirtualMemory	process_identifier: 2856 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x006c0000	success
1620832561.671249 NtAllocateVirtualMemory	process_identifier: 2856 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00465000	success
1620832562.874249 NtAllocateVirtualMemory	process_identifier: 2856 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00466000	success
1620832563.108249 NtAllocateVirtualMemory	process_identifier: 2856 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00467000	success
1620832563.233249 NtAllocateVirtualMemory	process_identifier: 2856 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x006c1000	success
1620832563.280249 NtAllocateVirtualMemory	process_identifier: 2856 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00468000	success
1620832563.327249 NtAllocateVirtualMemory	process_identifier: 2856 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00469000	success
1620832563.327249 NtAllocateVirtualMemory	process_identifier: 2856 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00740000	success
1620832563.327249 NtAllocateVirtualMemory	process_identifier: 2856 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00741000	success
1620832563.327249 NtAllocateVirtualMemory	process_identifier: 2856 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0046d000	success
1620832563.343249 NtAllocateVirtualMemory	process_identifier: 2856 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x006c2000	success
1620832563.343249 NtAllocateVirtualMemory	process_identifier: 2856 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00742000	success
1620832563.343249 NtAllocateVirtualMemory	process_identifier: 2856 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00476000	success
1620832563.343249 NtAllocateVirtualMemory	process_identifier: 2856 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0047a000	success
1620832563.343249 NtAllocateVirtualMemory	process_identifier: 2856 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00477000	success
1620832563.358249 NtAllocateVirtualMemory	process_identifier: 2856 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x006c3000	success
1620832563.421249 NtAllocateVirtualMemory	process_identifier: 2856 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x006c4000	success
1620832563.437249 NtAllocateVirtualMemory	process_identifier: 2856 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00743000	success
1620832563.437249 NtAllocateVirtualMemory	process_identifier: 2856 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x006c5000	success
1620832563.562249 NtAllocateVirtualMemory	process_identifier: 2856 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x006c6000	success
1620832563.749249 NtAllocateVirtualMemory	process_identifier: 2856 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0045c000	success
1620832563.749249 NtAllocateVirtualMemory	process_identifier: 2856 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00744000	success
1620832563.749249 NtAllocateVirtualMemory	process_identifier: 2856 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x006c7000	success
1620832589.937249 NtAllocateVirtualMemory	process_identifier: 2856 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x006c8000	success
1620832590.046249 NtAllocateVirtualMemory	process_identifier: 2856 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x006c9000	success

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620832198.299395 GetDiskFreeSpaceExW	root_path: C:\Users\Administrator.Oskar-PC\AppData\Local\Microsoft\Windows\Explorer free_bytes_available: 19372920832 total_number_of_free_bytes: 0 total_number_of_bytes: 0	success	1	0

Creates a shortcut to an executable file (3 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk
file	C:\Users\Public\Desktop\Google Chrome.lnk
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Windows Explorer.lnk

Executes one or more WMI queries (1 个事件)

wmi	SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "explorer.exe")

A process created a hidden window (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1620832564.077249 CreateProcessInternalW	thread_identifier: 2528 thread_handle: 0x00000234 process_identifier: 2288 current_directory: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp filepath: track: 1 command_line: "cmd" filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) process_handle: 0x00000244 inherit_handles: 1	success	1	0
1620832591.687249 CreateProcessInternalW	thread_identifier: 2168 thread_handle: 0x00000230 process_identifier: 1244 current_directory: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp filepath: track: 1 command_line: "cmd" filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) process_handle: 0x00000254 inherit_handles: 1	success	1	0

Checks for the Locally Unique Identifier on the system for a suspicious privilege (12 个事件)

Time & API	Arguments	Status	Return
1620832563.812249 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1
1620832565.124626 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1
1620832186.174395 LookupPrivilegeValueW	system_name: privilege_name: SeShutdownPrivilege	success	1
1620832186.377395 LookupPrivilegeValueW	system_name: privilege_name: SeShutdownPrivilege	success	1
1620832187.158395 LookupPrivilegeValueW	system_name: privilege_name: SeShutdownPrivilege	success	1
1620832187.471395 LookupPrivilegeValueW	system_name: privilege_name: SeShutdownPrivilege	success	1
1620832187.736395 LookupPrivilegeValueW	system_name: privilege_name: SeShutdownPrivilege	success	1
1620832188.424395 LookupPrivilegeValueW	system_name: privilege_name: SeShutdownPrivilege	success	1
1620832188.690395 LookupPrivilegeValueW	system_name: privilege_name: SeShutdownPrivilege	success	1
1620832189.049395 LookupPrivilegeValueW	system_name: privilege_name: SeShutdownPrivilege	success	1
1620832189.768395 LookupPrivilegeValueW	system_name: privilege_name: SeShutdownPrivilege	success	1
1620832190.065395 LookupPrivilegeValueW	system_name: privilege_name: SeShutdownPrivilege	success	1

Terminates another process (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1620832585.640626 NtTerminateProcess	status_code: 0x00000001 process_identifier: 1424 process_handle: 0x00000184	failed	0	0
1620832585.640626 NtTerminateProcess	status_code: 0x00000001 process_identifier: 1424 process_handle: 0x00000184	success	0	0

Uses Windows utilities for basic Windows functionality (1 个事件)

cmdline

taskkill /f /im explorer.exe

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Created a process named as a common system process (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620832592.187249 CreateProcessInternalW	thread_identifier: 1512 thread_handle: 0x00000080 process_identifier: 1524 current_directory: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp filepath: C:\Windows\explorer.exe track: 1 command_line: C:\Windows\explorer.exe filepath_r: C:\Windows\explorer.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) process_handle: 0x00000084 inherit_handles: 1	success	1	0

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-08-25 11:32:23

Imports

Library mscoree.dll:

• 0x402000 _CorExeMain

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	50534	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	58367	114.114.114.114	53
192.168.56.101	65004	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	55368	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	56540	239.255.255.250	3702
192.168.56.101	58368	239.255.255.250	3702
192.168.56.101	58707	239.255.255.250	3702
192.168.56.101	62196	239.255.255.250	1900

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.