SmartHawk

2.5

中危

65 个模型检测该样本为恶意！

重新分析

下载样本

211f79e8a34a205606f6fe2c65a47635e776a44c9395424526b1791625df12b2

211f79e8a34a205606f6fe2c65a47635e776a44c9395424526b1791625df12b2.exe

分析耗时

15s

最近分析

407天前

文件大小

32.0KB

静态报毒动态报毒 CVE FAMILY METATYPE PLATFORM TYPE UNKNOWN WIN32 TROJAN DOWNLOADER RAZY

DACN 0.14

FACILE 1.00

IMCLNet 0.62

MFGraph 0.00

引擎	描述	特征	威胁分数	可能家族	检测耗时
DACN	基于动态分析和胶囊网络的可视化恶意软件检测	API调用、DLL以及注册表的修改情况	0.14	Unknown	0.04s
FACILE	利用改进的层次胶囊网络对二进制恶意软件图像进行识别分类	二进制图像映射为的灰度图像	1.00	Unknown	0.03s
IMCLNet	轻量化深度卷积网络模型实现恶意软件家族检测	原始二进制映射而成的可视化图像	0.62	Unknown	0.16s
MFGraph	利用静态特征构建图网络以检测恶意软件	原始二进制PE文件的静态特征节点	0.00	Unknown	0.00s

查杀引擎	查杀结果	查杀时间	查杀版本
Alibaba	VirTool:Win32/CeeInject.56125bb6	20190527	0.3.0.5
Avast	Win32:DropperX-gen [Drp]	20200608	18.4.3895.0
Baidu	Win32.Trojan.Inject.bm	20190318	1.0.0.2
CrowdStrike	win/malicious_confidence_100% (W)	20190702	1.0
Kingsoft	None	20200608	2013.8.14.323
McAfee	Downloader-BIJ.a	20200608	6.0.6.653
Tencent	Win32.Trojan-downloader.Agent.Wskb	20200608	1.0.0.1

观察到命令行控制台输出 (11 个事件)

Time & API	Arguments	Status	Return
1727110791.29675 WriteConsoleW	console_handle: 0x00000007 buffer: C:\Users\Administrator\AppData\Local\Temp>	success	1
1727110791.29675 WriteConsoleW	console_handle: 0x00000007 buffer: del	success	1
1727110791.29675 WriteConsoleW	console_handle: 0x00000007 buffer: "C:\Users\Administrator\AppData\Local\EapHost.exe" /a	success	1
1727110791.29675 WriteConsoleW	console_handle: 0x00000007 buffer: C:\Users\Administrator\AppData\Local\Temp>	success	1
1727110791.29675 WriteConsoleW	console_handle: 0x00000007 buffer: move	success	1
1727110791.29675 WriteConsoleW	console_handle: 0x00000007 buffer: "C:\Users\Administrator\AppData\Local\EapHost.exe.tmp1" "C:\Users\Administrator\AppData\Local\EapHost.exe"	success	1
1727110791.31275 WriteConsoleW	console_handle: 0x00000007 buffer: 移动了 1 个文件。	success	1
1727110791.31275 WriteConsoleW	console_handle: 0x00000007 buffer: C:\Users\Administrator\AppData\Local\Temp>	success	1
1727110791.31275 WriteConsoleW	console_handle: 0x00000007 buffer: del	success	1
1727110791.31275 WriteConsoleW	console_handle: 0x00000007 buffer: a.bat	success	1
1727110791.31275 WriteConsoleW	console_handle: 0x0000000b buffer: 找不到批处理文件。	success	1

一个或多个进程崩溃 (3 个事件)

Time & API	Arguments	Status
1727110789.874875 __exception__	exception.address: 0x402133 exception.instruction: xor byte ptr [ecx], al exception.instruction_r: 30 01 ff 45 fc 8b 45 fc 3b 45 10 7c ad 5f 5e 5b exception.symbol: szFile-0x210d 211f79e8a34a205606f6fe2c65a47635e776a44c9395424526b1791625df12b2+0x2133 exception.exception_code: 0xc0000005 registers.eax: 31 registers.ecx: 4214964 registers.edx: 151 registers.ebx: 256 registers.esp: 1637600 registers.ebp: 1637624 registers.esi: 1637976 registers.edi: 256 stacktrace: szFile-0x2fc6 211f79e8a34a205606f6fe2c65a47635e776a44c9395424526b1791625df12b2+0x127a @ 0x40127a BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76ee33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x775b9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x775b9ea5	success
1727110789.874875 __exception__	exception.address: 0x402133 exception.instruction: xor byte ptr [ecx], al exception.instruction_r: 30 01 ff 45 fc 8b 45 fc 3b 45 10 7c ad 5f 5e 5b exception.symbol: szFile-0x210d 211f79e8a34a205606f6fe2c65a47635e776a44c9395424526b1791625df12b2+0x2133 exception.exception_code: 0xc0000005 registers.eax: 98 registers.ecx: 4218880 registers.edx: 74 registers.ebx: 256 registers.esp: 1637600 registers.ebp: 1637624 registers.esi: 1637976 registers.edi: 256 stacktrace: szFile-0x2fc6 211f79e8a34a205606f6fe2c65a47635e776a44c9395424526b1791625df12b2+0x127a @ 0x40127a BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76ee33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x775b9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x775b9ea5	success
1727110789.874875 __exception__	exception.address: 0x402133 exception.instruction: xor byte ptr [ecx], al exception.instruction_r: 30 01 ff 45 fc 8b 45 fc 3b 45 10 7c ad 5f 5e 5b exception.symbol: szFile-0x210d 211f79e8a34a205606f6fe2c65a47635e776a44c9395424526b1791625df12b2+0x2133 exception.exception_code: 0xc0000005 registers.eax: 58 registers.ecx: 4222976 registers.edx: 238 registers.ebx: 256 registers.esp: 1637600 registers.ebp: 1637624 registers.esi: 1637976 registers.edi: 256 stacktrace: szFile-0x2fc6 211f79e8a34a205606f6fe2c65a47635e776a44c9395424526b1791625df12b2+0x127a @ 0x40127a BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76ee33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x775b9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x775b9ea5	success

分配可读-可写-可执行内存（通常用于自解压） (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1727110789.874875 NtProtectVirtualMemory	process_handle: 0xffffffff base_address: 0x00400000 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_identifier: 2600	success	0	0
1727110789.874875 NtProtectVirtualMemory	process_handle: 0xffffffff base_address: 0x72591000 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_identifier: 2600	success	0	0

在文件系统上创建可执行文件 (2 个事件)

file	C:\Users\Administrator\AppData\Local\Temp\a.bat
file	C:\Users\Administrator\AppData\Local\Temp\~dfds3.reg

将可执行文件投放到用户的 AppData 文件夹 (1 个事件)

file	C:\Users\Administrator\AppData\Local\EapHost.exe

该二进制文件可能包含加密或压缩数据，表明使用了打包工具 (2 个事件)

section

{'name': '.rsrc', 'virtual_address': '0x00005000', 'virtual_size': '0x00002cc4', 'size_of_data': '0x00003000', 'entropy': 7.740019600289757}

entropy

7.740019600289757

description

发现高熵的节

entropy

0.42857142857142855

description

此PE文件的整体熵值较高

与未执行 DNS 查询的主机进行通信 (1 个事件)

host

114.114.114.114

枚举服务，可能用于反虚拟化 (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1727110789.874875 EnumServicesStatusA	service_handle: 0x008a47a0 service_type: 48 service_status: 2	success	1	0

在 Windows 启动时自我安装以实现自动运行 (1 个事件)

reg_key

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\EapHost

reg_value

C:\Users\Administrator\AppData\Local\EapHost.exe

文件已被 VirusTotal 上 65 个反病毒引擎识别为恶意 (50 out of 65 个事件)

ALYac	Trojan.Injector
APEX	Malicious
AVG	Win32:DropperX-gen [Drp]
Acronis	suspicious
Ad-Aware	Gen:Variant.Razy.448218
AhnLab-V3	Backdoor/Win32.CSon.R885
Alibaba	VirTool:Win32/CeeInject.56125bb6
Antiy-AVL	Trojan[Downloader]/Win32.Rubinurd.b
Arcabit	Trojan.Razy.D6D6DA
Avast	Win32:DropperX-gen [Drp]
Avira	TR/Dropper.Gen
Baidu	Win32.Trojan.Inject.bm
BitDefender	Gen:Variant.Razy.448218
BitDefenderTheta	AI:Packer.54A3CF691F
CAT-QuickHeal	Trojan.Mauvaise.SL1
ClamAV	Win.Trojan.Rubinurd-67
Comodo	TrojWare.Win32.Toga.B@6vx8t0
CrowdStrike	win/malicious_confidence_100% (W)
Cybereason	malicious.d70664
Cylance	Unsafe
Cyren	W32/A-1a76837c!Eldorado
DrWeb	Win32.HLLW.Autoruner.27746
ESET-NOD32	Win32/TrojanDownloader.Agent.PTT
Emsisoft	Gen:Variant.Razy.448218 (B)
Endgame	malicious (high confidence)
F-Prot	W32/A-1a76837c!Eldorado
F-Secure	Trojan.TR/Dropper.Gen
FireEye	Generic.mg.db5d730d70664283
Fortinet	W32/Injector.BFSU!tr
GData	Win32.Trojan.Agent.ASM
Ikarus	Trojan-Downloader.SuspectCRC
Invincea	heuristic
Jiangmin	TrojanDownloader.Small.akba
K7AntiVirus	Trojan-Downloader ( 0040f54b1 )
K7GW	Trojan-Downloader ( 000918cf1 )
Kaspersky	HEUR:Trojan.Win32.Miancha.gen
Lionic	Trojan.Win32.Generic.lk0q
MAX	malware (ai score=81)
Malwarebytes	Backdoor.Simbot
MaxSecure	Trojan.Downloader.Rubinurd.bf
McAfee	Downloader-BIJ.a
McAfee-GW-Edition	BehavesLike.Win32.Backdoor.nm
MicroWorld-eScan	Gen:Variant.Razy.448218
Microsoft	VirTool:Win32/CeeInject.gen!DU
NANO-Antivirus	Trojan.Win32.Autoruner.bbwavd
Paloalto	generic.ml
Panda	Trj/Genetic.gen
Qihoo-360	Win32/Dropper.Dapato.A
Rising	Dropper.Generic!8.35E (TFE:dGZlOgUzB9g24BWYcQ)
SUPERAntiSpyware	Backdoor.Bot/Variant

288x288

224x224

192x192

160x160

128x128

96x96

64x64

32x32

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2010-09-07 10:27:10

PE Imphash

f54bab47f74e370cf85ce98d899e8149

Sections

Name	Virtual Address	Virtual Size	Size of Raw Data	Entropy
.text	0x00001000	0x00001755	0x00002000	5.8542436662489425
.rdata	0x00003000	0x000005a5	0x00001000	2.233959569513802
.data	0x00004000	0x00000593	0x00001000	1.1476625760781263
.rsrc	0x00005000	0x00002cc4	0x00003000	7.740019600289757

Resources

Name	Offset	Size	Language	Sub-language	File type
RT_RCDATA	0x000050b4	0x00002800	LANG_ENGLISH	SUBLANG_ENGLISH_US	None
RT_VERSION	0x000078b4	0x00000410	LANG_ENGLISH	SUBLANG_ENGLISH_US	None

Imports

Library KERNEL32.dll:

• 0x40301c ExitProcess

• 0x403020 ReadFile

• 0x403024 HeapAlloc

• 0x403028 GetProcessHeap

• 0x40302c GetFileSize

• 0x403030 CopyFileA

• 0x403034 GetModuleFileNameA

• 0x403038 LeaveCriticalSection

• 0x40303c GetProcAddress

• 0x403040 EnterCriticalSection

• 0x403044 VirtualProtect

• 0x403048 InitializeCriticalSection

• 0x40304c GetModuleHandleA

• 0x403050 LockResource

• 0x403054 LoadResource

• 0x403058 SetFilePointer

• 0x40305c FindResourceA

• 0x403060 GetLastError

• 0x403064 MoveFileA

• 0x403068 DeleteFileA

• 0x40306c lstrcmpiA

• 0x403070 GetLongPathNameA

• 0x403074 ExpandEnvironmentStringsA

• 0x403078 GetTickCount

• 0x40307c OutputDebugStringA

• 0x403080 lstrlenA

• 0x403084 TerminateProcess

• 0x403088 VirtualAllocEx

• 0x40308c HeapFree

• 0x403090 VirtualAlloc

• 0x403094 Sleep

• 0x403098 lstrcpyA

• 0x40309c lstrcatA

• 0x4030a0 CreateFileA

• 0x4030a4 WriteFile

• 0x4030a8 CloseHandle

• 0x4030ac SizeofResource

• 0x4030b0 WinExec

Library USER32.dll:

• 0x4030c4 wsprintfA

• 0x4030c8 MessageBoxA

Library ADVAPI32.dll:

• 0x403000 CloseServiceHandle

• 0x403004 CryptGenRandom

• 0x403008 CryptReleaseContext

• 0x40300c EnumServicesStatusA

• 0x403010 OpenSCManagerA

• 0x403014 CryptAcquireContextA

Library SHLWAPI.dll:

• 0x4030b8 PathRemoveFileSpecA

• 0x4030bc StrChrA

Exports

Ordinal	Address	Name
1	0x404240	szFile

L!This program cannot be run in DOS mode.
.rdata
@.data
3fj@3Yu
tESPh
SVWj@3Y3j?fY3f^
EPEPhL@@
MSQEuPV
YYPV5X0@
ESPuW=0@
ESPuh$
ESPuh/
ESPuhl
;t$uuh
jfhL@@
_^3[UQQe
H<EHC@
X^UQQV5
WEWP}}
;t'EPEPEPh
3?;3j u
A(;r3_^[
`8!5L8
dLth+vUk
8pz6!=I
-h;@n1TM,,
eY);;e7[cv_4w?]
SE_GZX
;C"9lyN
!T@xvN
i'W;|%C)m
[xX;o|{(ja&
tz3YYT,~
U]7or?
X~m+2h
NcVR\DO
aE:9BF
$#yKgB
r=?Ra'}_9
C%]yl`
EWdx\C?
|_^[]UE
'RP$?HV>2w
6Q*$g !H=Wb
e4GNE  a+o
0V*c%{
z7%;^w
ys/0C[
~+MDe8u
%QKoy0yFC
R_27 k|
Ev%?9TfOS
EE~cSVu
3fj@3Yj@fY3fj@3Yu
]f]@~)M
GEQ@9E|
3tESPPPPu
uRFGHt
t+t'NW8u
;uH_^Q=
r)$h%@
DDDDDDDDDDDDDD
WinExec
CloseHandle
WriteFile
CreateFileA
lstrcatA
lstrcpyA
SetFilePointer
ExitProcess
ReadFile
HeapAlloc
GetProcessHeap
GetFileSize
CopyFileA
GetModuleFileNameA
LeaveCriticalSection
GetProcAddress
EnterCriticalSection
VirtualProtect
InitializeCriticalSection
GetModuleHandleA
LockResource
LoadResource
SizeofResource
FindResourceA
GetLastError
MoveFileA
DeleteFileA
lstrcmpiA
GetLongPathNameA
ExpandEnvironmentStringsA
GetTickCount
OutputDebugStringA
lstrlenA
TerminateProcess
VirtualAllocEx
HeapFree
VirtualAlloc
KERNEL32.dll
wsprintfA
MessageBoxA
USER32.dll
CryptReleaseContext
CryptGenRandom
CryptAcquireContextA
CloseServiceHandle
EnumServicesStatusA
OpenSCManagerA
ADVAPI32.dll
StrChrA
PathRemoveFileSpecA
SHLWAPI.dll
roudanx.exe
szFile
del "%s" /a
move "%s" "%s"
del %%0
rwbinru/dyd
RT_RCDATA
EndUpdateResourceA
UpdateResourceA
BeginUpdateResourceA
kernel32
szFile
ResumeThread
SetThreadContext
WriteProcessMemory
VirtualProtectEx
VirtualQueryEx
ReadProcessMemory
GetThreadContext
CreateProcessA
ZwUnmapViewOfSection
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
WinHttp
Are you sure?
regedit.exe /s 
~dfds3.reg
%tmp%\
Windows Registry Editor Version 5.00
"%s"="%s"
\cWvca'
cv`pO]K
=Y#r,VgO
;a:/H<A z`
'`v TD
(HT5.jWU
cZ*WL1A_N"f5&
|EImo0H
'l=\i
d&%@7O'
VjZFL/H"
%WKAd`
F.#+2n?v
F&=TUhu(&!]l
9uAa&q
+QH::G
|Z[d0!
=Za_z0
&z=Ts}
b,/%B Iy}DzOkz5#R;
;>ZjeT
?]#/Rh'6b8w
MPFATkJ%
a4F]?Q6^q
<O%x>fd
/(P\Ir
g{{%-`t
7XE0P"
#xGD)Z
^`PvLupr
Qu8"NnUQ(
QFU/7uVN/
![Fc@E}}03
H'Q">/o@Z
nK`vO.IB
4K^x^&Y]'<
|!PiFe8
*oGne,q
-VflTD_%
m6y).;}
!JqKz*#m
hhBOzbV3cg|*
3.,du6?07{,)5
II->Ew5<
m7^>=#|b
 nm\f_rFZ8G&
tF*0 "S
TcIF{Le0Bj
MN.06Y+#*Pv"3uu
H04:m?m
 uT@4}xe
HUcBt.^@N7
5D2p(
CFLD0WA
 29stc
t{VHT|L,
u.!m+\$FA#n
UtU#2~Z^(E>
ps>q:~"
M&TcTQN
d4D2mb
.&}ToQ-<_t
`,bEO2R,#z\i[
o(OA40o
sKEs8_
U&Om}%(vq
kWx]_p/C
n)/Dwu
f;")hjPBg
RTGs,Er
1\BT_8(
kzg oW
(T`*{-4bCi`po\wbv0GYun}p
X;nBM76y
>? Qz{ZBi4
!ng9=Eu`
](^ri6?m
~z^8SGEJK
yowOs0yW;
1S%*O@/
zI4_][R
:?4Hyk
<AU$J&
S2:Geh%j5h
Yqm[8VG2?T
WC-]k1b
%fT:-7C
)v7,X0
S~T~g[S"3Oi1
@oz#;~
s'6DlE8X
9`b:\gOD
[{@i^*
0/o?0{  {l:
=MIQma}'U
vv;bjl
,1Rm?1k*h F"b9
ut C=jKnl
/43cW2h~$jp
hQ&3Tq|R`
I1uk]}
TidFzd'\8&1s
PDKt% x5<
(~1q|X.L
2Q`S;u
I?Ngq?9
jr,ZlE
(ui,T_
SF#?<5
eE#)R4
{yFE!s
==^dO/[R
`DCtYr
^g6Jsx
WS]<'V,x
}mxeSc]lQ
j0n{`M5
%f]qgA
}cn@XS
>5faN^
Xf\b252h
[{biWAg
Dl%*Nj0m
T,w^v"j+2T
/#DANz
wWxD] 
MA>3cP
Oth6ejP(2l5
VI?F-j2qoFU+
S7gg]i
'?Gm<* bsUD
L3V(8E
P)-ON#
W"y9ap"Q}'
$]T9hWy
%[wQb
-!M`Cz
(XK[.WsCicsW#
ldF|N#W
g} `[,+k
bz,b#5Ld
#!'"%}pKn
P8WNZB0z|t
@nweK4
0$;P-?]U`
!cm36Fs,[kNjV
wB wDgJ
p5?k77g?}>
k%|)RpJG
3UG`BM
Fc(=5[~'
)QmR H
Ad6<Jikq
}~G4a!
hQmmIk
i|Q5~qFJ
?Zm$.,*MPB
pec),CffB
SNPZj(
L\dH'a
\4"8yKM
,0No<#
t^7IWUb
#x=0V?? bGI^iJ8Uk
5)R?-r:6a(K(a'p8
u;"*mS
P1lps$j
PnX!:#='[*<
4**p~y
3=Y'X{
B&#Q8X_
T,ZQGs5
I~^}zSC4Qca
5:he5zMI@T
[GrR6xS7d
:PzS97
^uo=y9HG
>\Moo3Q!k
(lvPtLE
x"/w74;b?Ir>^
{u|GW1p'0
cq/(DYM
+r?~1?J17%n4
5$1:k"
Q<L=Z?}
-Yk#<%B$
$e\.`8
PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPAD
RT_RCDATA
VS_VERSION_INFO
StringFileInfo
040904b0
CompanyName
Adobe Systems, Inc.
FileDescription
Adobe? Flash? Player Installer/Uninstaller 10.1 r53
FileVersion
10,1,53,64
InternalName
Adobe? Flash? Player Installer/Uninstaller 10.1
LegalCopyright
Copyright ? 1996-2010 Adobe, Inc.
LegalTrademarks
Adobe? Flash? Player
OriginalFilename
FlashUtil.exe
ProductName
Flash? Player Installer/Uninstaller
ProductVersion
10,1,53,64
VarFileInfo
Translation

Process Tree

211f79e8a34a205606f6fe2c65a47635e776a44c9395424526b1791625df12b2.exe (2600) "C:\Users\Administrator\AppData\Local\Temp\211f79e8a34a205606f6fe2c65a47635e776a44c9395424526b1791625df12b2.exe"
- regedit.exe (2224) regedit.exe /s C:\Users\ADMINI~1\AppData\Local\Temp\~dfds3.reg
- cmd.exe (600) cmd /c a.bat

211f79e8a34a205606f6fe2c65a47635e776a44c9395424526b1791625df12b2.exe, PID: 2600, Parent PID: 3044

default registry file network process services synchronisation iexplore office pdf

regedit.exe, PID: 2224, Parent PID: 2600

default registry file network process services synchronisation iexplore office pdf

cmd.exe, PID: 600, Parent PID: 2600

default registry file network process services synchronisation iexplore office pdf

Hosts

IP
114.114.114.114

DNS

Name	Response	Post-Analysis Lookup
dns.msftncsi.com

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	53179	224.0.0.252	5355
192.168.56.101	49642	224.0.0.252	5355
192.168.56.101	137	192.168.56.255	137
192.168.56.101	61714	114.114.114.114	53

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Name	7ae6de6004aea66e_a.bat
Filepath	C:\Users\Administrator\AppData\Local\Temp\a.bat
Size	1.0KB
Processes	2600 (211f79e8a34a205606f6fe2c65a47635e776a44c9395424526b1791625df12b2.exe) 600 (cmd.exe)
Type	ASCII text, with CRLF line terminators
MD5	`e987938d2038c30b19f10fdaf07c4420`
SHA1	`d43f0325704cb36810d3b8b362170528328d5caf`
SHA256	`7ae6de6004aea66ea6f0758739e9f8a84befe37320a54df3188dc2ef93ba4318`
CRC32	`9211828F`
ssdeep	`None`
Yara	None matched
VirusTotal	Search for analysis

Name	211f79e8a34a2056_EapHost.exe
Filepath	C:\Users\Administrator\AppData\Local\EapHost.exe
Size	32.0KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`db5d730d7066428389162f883e3e32b2`
SHA1	`d7ee8257a112b849ae4018cf9eae8e80240e39d9`
SHA256	`211f79e8a34a205606f6fe2c65a47635e776a44c9395424526b1791625df12b2`
CRC32	`DEAEBE04`
ssdeep	`None`
Yara	None matched
VirusTotal	Search for analysis

Name	71e60f9eddccdb38_eaphost.exe
Filepath	c:\users\administrator\appdata\local\eaphost.exe
Size	32.0KB
Processes	2600 (211f79e8a34a205606f6fe2c65a47635e776a44c9395424526b1791625df12b2.exe) 600 (cmd.exe)
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`f80a993d3263a64fb288d6ba11a04933`
SHA1	`813fdbed24df3db0918c25fb38c9d75080769551`
SHA256	`71e60f9eddccdb386cf46f5bb75b4c6b089e180e7ee79de3145b4a192dd8de76`
CRC32	`F1922FC9`
ssdeep	`None`
Yara	None matched
VirusTotal	Search for analysis

Sorry! No dropped buffers.