SmartHawk

7.4

高危

52 个模型检测该样本为恶意！

重新分析

下载样本

5a38c1770a9728871ebf9a8a4b7b9e676fe5ace9c9b4a1a5d64f8ae86044fa97

e620cb9ccee4b0460a3af37e72e57a9f.exe

分析耗时

117s

最近分析

文件大小

458.5KB

静态报毒动态报毒 AAXU AGENSLA AGENTTESLA AI SCORE=82 ATTRIBUTE AUTO CM0@AYN08WE CONFIDENCE DZTBNK ELDORADO GDSDA HIGH CONFIDENCE HIGHCONFIDENCE KCLOUD KLMZQ KRYPTIK MALWARE@#Y7GOONC56QTL PSWTROJ PWSX R066C0DIK20 RAZY REMCOS SCORE SIGGEN9 SUSGEN TORDEV TROJANPSW TROJANPWS UNSAFE ZEMSILF 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
Alibaba	TrojanPSW:MSIL/Agensla.8d363ce8	20190527	0.3.0.5
Baidu		20190318	1.0.0.2
Avast	Win32:PWSX-gen [Trj]	20201228	21.1.5827.0
Tencent	Win32.Trojan.Inject.Auto	20201229	1.0.0.1
Kingsoft	Win32.PSWTroj.Undef.(kcloud)	20201229	2017.9.26.565
McAfee	Packed-GAA!E620CB9CCEE4	20201229	6.0.6.653
CrowdStrike	win/malicious_confidence_90% (W)	20190702	1.0

Queries for the computername (6 个事件)

Time & API	Arguments	Status	Return
1619967602.55175 GetComputerNameW	computer_name: OSKAR-PC	success	1
1619967602.56775 GetComputerNameW	computer_name: OSKAR-PC	success	1
1619967602.58375 GetComputerNameW	computer_name: OSKAR-PC	success	1
1619967602.58375 GetComputerNameW	computer_name: OSKAR-PC	success	1
1619967609.00575 GetComputerNameA	computer_name: OSKAR-PC	success	1
1619967609.00575 GetComputerNameW	computer_name: OSKAR-PC	success	1

Checks if process is being debugged by a debugger (3 个事件)

Time & API	Arguments	Status	Return	Repeated
1619951380.89125 IsDebuggerPresent		failed	0	0
1619951380.89125 IsDebuggerPresent		failed	0	0
1619967603.31775 IsDebuggerPresent		failed	0	0

Uses Windows APIs to generate a cryptographic key (50 out of 64 个事件)

Time & API	Arguments	Status	Return
1619967604.70875 CryptExportKey	crypto_handle: 0x00268098 crypto_export_handle: 0x00000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619967606.86475 CryptExportKey	crypto_handle: 0x00267f58 crypto_export_handle: 0x00000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619967606.86475 CryptExportKey	crypto_handle: 0x00267f58 crypto_export_handle: 0x00000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619967606.86475 CryptExportKey	crypto_handle: 0x00267f58 crypto_export_handle: 0x00000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619967607.05175 CryptExportKey	crypto_handle: 0x00267f58 crypto_export_handle: 0x00000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619967607.05175 CryptExportKey	crypto_handle: 0x00267f58 crypto_export_handle: 0x00000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619967607.05175 CryptExportKey	crypto_handle: 0x00267f58 crypto_export_handle: 0x00000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619967607.09875 CryptExportKey	crypto_handle: 0x00267f58 crypto_export_handle: 0x00000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619967607.13075 CryptExportKey	crypto_handle: 0x00267498 crypto_export_handle: 0x00000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619967607.13075 CryptExportKey	crypto_handle: 0x00267498 crypto_export_handle: 0x00000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619967607.19275 CryptExportKey	crypto_handle: 0x00267498 crypto_export_handle: 0x00000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619967607.19275 CryptExportKey	crypto_handle: 0x00267498 crypto_export_handle: 0x00000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619967607.19275 CryptExportKey	crypto_handle: 0x00267498 crypto_export_handle: 0x00000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619967607.19275 CryptExportKey	crypto_handle: 0x00267498 crypto_export_handle: 0x00000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619967608.00575 CryptExportKey	crypto_handle: 0x002679d8 crypto_export_handle: 0x00000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619967608.00575 CryptExportKey	crypto_handle: 0x002679d8 crypto_export_handle: 0x00000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619967608.00575 CryptExportKey	crypto_handle: 0x002679d8 crypto_export_handle: 0x00000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619967608.02075 CryptExportKey	crypto_handle: 0x002679d8 crypto_export_handle: 0x00000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619967608.02075 CryptExportKey	crypto_handle: 0x002679d8 crypto_export_handle: 0x00000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619967608.02075 CryptExportKey	crypto_handle: 0x002679d8 crypto_export_handle: 0x00000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619967608.03675 CryptExportKey	crypto_handle: 0x002679d8 crypto_export_handle: 0x00000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619967608.70875 CryptExportKey	crypto_handle: 0x00267d98 crypto_export_handle: 0x00000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619967608.70875 CryptExportKey	crypto_handle: 0x00267d98 crypto_export_handle: 0x00000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619967608.70875 CryptExportKey	crypto_handle: 0x00267d98 crypto_export_handle: 0x00000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619967608.72375 CryptExportKey	crypto_handle: 0x002678d8 crypto_export_handle: 0x00000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619967608.72375 CryptExportKey	crypto_handle: 0x00267d98 crypto_export_handle: 0x00000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619967608.72375 CryptExportKey	crypto_handle: 0x00267d98 crypto_export_handle: 0x00000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619967608.72375 CryptExportKey	crypto_handle: 0x00267d98 crypto_export_handle: 0x00000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619967608.72375 CryptExportKey	crypto_handle: 0x00267d98 crypto_export_handle: 0x00000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619967608.73975 CryptExportKey	crypto_handle: 0x00267d98 crypto_export_handle: 0x00000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619967608.75575 CryptExportKey	crypto_handle: 0x00267d98 crypto_export_handle: 0x00000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619967608.75575 CryptExportKey	crypto_handle: 0x00267d98 crypto_export_handle: 0x00000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619967608.81775 CryptExportKey	crypto_handle: 0x00267d98 crypto_export_handle: 0x00000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619967608.81775 CryptExportKey	crypto_handle: 0x00267d98 crypto_export_handle: 0x00000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619967608.86475 CryptExportKey	crypto_handle: 0x00267cd8 crypto_export_handle: 0x00000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619967608.86475 CryptExportKey	crypto_handle: 0x00267cd8 crypto_export_handle: 0x00000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619967608.86475 CryptExportKey	crypto_handle: 0x00267cd8 crypto_export_handle: 0x00000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619967608.86475 CryptExportKey	crypto_handle: 0x00267cd8 crypto_export_handle: 0x00000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619967608.86475 CryptExportKey	crypto_handle: 0x00267cd8 crypto_export_handle: 0x00000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619967608.86475 CryptExportKey	crypto_handle: 0x00267cd8 crypto_export_handle: 0x00000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619967608.89575 CryptExportKey	crypto_handle: 0x00267cd8 crypto_export_handle: 0x00000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619967608.94275 CryptExportKey	crypto_handle: 0x00267358 crypto_export_handle: 0x00000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619967608.94275 CryptExportKey	crypto_handle: 0x00267358 crypto_export_handle: 0x00000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619967609.38075 CryptExportKey	crypto_handle: 0x00267358 crypto_export_handle: 0x00000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619967609.38075 CryptExportKey	crypto_handle: 0x00267358 crypto_export_handle: 0x00000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619967609.38075 CryptExportKey	crypto_handle: 0x00267358 crypto_export_handle: 0x00000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619967609.38075 CryptExportKey	crypto_handle: 0x00267358 crypto_export_handle: 0x00000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619967609.38075 CryptExportKey	crypto_handle: 0x00267358 crypto_export_handle: 0x00000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619967609.41175 CryptExportKey	crypto_handle: 0x00267358 crypto_export_handle: 0x00000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619967609.41175 CryptExportKey	crypto_handle: 0x00267358 crypto_export_handle: 0x00000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619951381.21925 GlobalMemoryStatusEx		success	1	0

Allocates read-write-execute memory (usually to unpack itself) (50 out of 194 个事件)

Time & API	Arguments	Status
1619951378.60925 NtAllocateVirtualMemory	process_identifier: 1880 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00230000	success
1619951378.60925 NtAllocateVirtualMemory	process_identifier: 1880 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00240000	success
1619951379.07825 NtAllocateVirtualMemory	process_identifier: 1880 region_size: 1310720 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x007b0000	success
1619951379.07825 NtAllocateVirtualMemory	process_identifier: 1880 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x008b0000	success
1619951379.59425 NtProtectVirtualMemory	process_identifier: 1880 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73b91000	success
1619951380.89125 NtAllocateVirtualMemory	process_identifier: 1880 region_size: 1703936 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x02160000	success
1619951380.89125 NtAllocateVirtualMemory	process_identifier: 1880 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x022c0000	success
1619951380.89125 NtAllocateVirtualMemory	process_identifier: 1880 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003fa000	success
1619951380.92225 NtProtectVirtualMemory	process_identifier: 1880 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73b92000	success
1619951380.92225 NtAllocateVirtualMemory	process_identifier: 1880 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003f2000	success
1619951383.07825 NtAllocateVirtualMemory	process_identifier: 1880 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00402000	success
1619951383.21925 NtAllocateVirtualMemory	process_identifier: 1880 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00425000	success
1619951383.21925 NtAllocateVirtualMemory	process_identifier: 1880 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0042b000	success
1619951383.21925 NtAllocateVirtualMemory	process_identifier: 1880 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00427000	success
1619951383.42225 NtAllocateVirtualMemory	process_identifier: 1880 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00403000	success
1619951383.43725 NtAllocateVirtualMemory	process_identifier: 1880 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0040c000	success
1619951384.04725 NtAllocateVirtualMemory	process_identifier: 1880 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00404000	success
1619951384.04725 NtAllocateVirtualMemory	process_identifier: 1880 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00406000	success
1619951384.81225 NtAllocateVirtualMemory	process_identifier: 1880 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00407000	success
1619951384.85925 NtAllocateVirtualMemory	process_identifier: 1880 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x007b0000	success
1619951385.15625 NtAllocateVirtualMemory	process_identifier: 1880 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0041a000	success
1619951385.15625 NtAllocateVirtualMemory	process_identifier: 1880 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00417000	success
1619951385.35925 NtAllocateVirtualMemory	process_identifier: 1880 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00408000	success
1619951385.40625 NtAllocateVirtualMemory	process_identifier: 1880 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00409000	success
1619951385.45325 NtAllocateVirtualMemory	process_identifier: 1880 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00416000	success
1619951385.56225 NtAllocateVirtualMemory	process_identifier: 1880 region_size: 24576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x007b1000	success
1619951386.12525 NtAllocateVirtualMemory	process_identifier: 1880 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x007b7000	success
1619951386.12525 NtAllocateVirtualMemory	process_identifier: 1880 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00820000	success
1619951386.15625 NtAllocateVirtualMemory	process_identifier: 1880 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00821000	success
1619951386.17225 NtAllocateVirtualMemory	process_identifier: 1880 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00822000	success
1619951386.18725 NtAllocateVirtualMemory	process_identifier: 1880 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x022c1000	success
1619951386.20325 NtAllocateVirtualMemory	process_identifier: 1880 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x022c2000	success
1619951386.21925 NtAllocateVirtualMemory	process_identifier: 1880 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x022c3000	success
1619951386.21925 NtAllocateVirtualMemory	process_identifier: 1880 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x022c4000	success
1619951386.21925 NtAllocateVirtualMemory	process_identifier: 1880 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x022c5000	success
1619951386.21925 NtAllocateVirtualMemory	process_identifier: 1880 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x022c6000	success
1619951386.21925 NtAllocateVirtualMemory	process_identifier: 1880 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x022c9000	success
1619951386.21925 NtAllocateVirtualMemory	process_identifier: 1880 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x022cc000	success
1619951386.28125 NtAllocateVirtualMemory	process_identifier: 1880 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x007b8000	success
1619951386.28125 NtAllocateVirtualMemory	process_identifier: 1880 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x022cf000	success
1619951386.28125 NtAllocateVirtualMemory	process_identifier: 1880 region_size: 69632 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x022d3000	success
1619951386.29725 NtAllocateVirtualMemory	process_identifier: 1880 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x007b9000	success
1619951386.51625 NtAllocateVirtualMemory	process_identifier: 1880 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x007ba000	success
1619951386.53125 NtAllocateVirtualMemory	process_identifier: 1880 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00823000	success
1619951386.54725 NtAllocateVirtualMemory	process_identifier: 1880 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x007bb000	success
1619951386.56225 NtAllocateVirtualMemory	process_identifier: 1880 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x008b1000	success
1619951426.57825 NtAllocateVirtualMemory	process_identifier: 1880 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x008b2000	success
1619951426.57825 NtAllocateVirtualMemory	process_identifier: 1880 region_size: 69632 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x008b6000	success
1619951426.59425 NtAllocateVirtualMemory	process_identifier: 1880 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0040d000	success
1619951426.60925 NtAllocateVirtualMemory	process_identifier: 1880 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00824000	success

Creates a shortcut to an executable file (1 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (1 个事件)

cmdline

"powershell" Get-MpPreference -verbose

A process created a hidden window (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619951427.04725 CreateProcessInternalW	thread_identifier: 1664 thread_handle: 0x00000244 process_identifier: 2308 current_directory: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp filepath: track: 1 command_line: "powershell" Get-MpPreference -verbose filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) process_handle: 0x00000250 inherit_handles: 1	success	1	0

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

7.567988297445684

section

{'size_of_data': '0x00072000', 'virtual_address': '0x00002000', 'entropy': 7.567988297445684, 'name': '.text', 'virtual_size': '0x00071eb4'}

description

A section with a high entropy has been found

entropy

0.9956331877729258

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619967604.47375 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1	0

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Disables Windows Security features (4 个事件)

description	attempts to modify windows defender policies	registry	HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring
description	attempts to modify windows defender policies	registry	HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware
description	attempts to modify windows defender policies	registry	HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable
description	attempts to modify windows defender policies	registry	HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection

File has been identified by 52 AntiVirus engines on VirusTotal as malicious (50 out of 52 个事件)

Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Razy.813794
FireEye	Generic.mg.e620cb9ccee4b046
CAT-QuickHeal	Trojanpws.Msil
ALYac	Gen:Variant.Razy.813794
Cylance	Unsafe
AegisLab	Trojan.MSIL.Agensla.i!c
K7AntiVirus	Trojan ( 00565ad41 )
Alibaba	TrojanPSW:MSIL/Agensla.8d363ce8
K7GW	Trojan ( 00565ad41 )
Cybereason	malicious.ccee4b
Arcabit	Trojan.Razy.DC6AE2
Cyren	W32/MSIL_Troj.UI.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Paloalto	generic.ml
Kaspersky	HEUR:Trojan-PSW.MSIL.Agensla.gen
BitDefender	Gen:Variant.Razy.813794
NANO-Antivirus	Trojan.Win32.Tordev.dztbnk
Avast	Win32:PWSX-gen [Trj]
Tencent	Win32.Trojan.Inject.Auto
Ad-Aware	Gen:Variant.Razy.813794
Sophos	Mal/Generic-S
Comodo	Malware@#y7goonc56qtl
F-Secure	Trojan.TR/AD.AgentTesla.klmzq
DrWeb	Trojan.Siggen9.42943
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	TROJ_GEN.R066C0DIK20
McAfee-GW-Edition	BehavesLike.Win32.Generic.gc
Emsisoft	Gen:Variant.Razy.813794 (B)
Jiangmin	Trojan.PSW.MSIL.aaxu
Webroot	W32.Trojan.MSIL.AGensla
Avira	TR/AD.AgentTesla.klmzq
Kingsoft	Win32.PSWTroj.Undef.(kcloud)
Microsoft	Trojan:MSIL/Remcos.SD!MTB
ZoneAlarm	HEUR:Trojan-PSW.MSIL.Agensla.gen
GData	Gen:Variant.Razy.813794
Cynet	Malicious (score: 85)
AhnLab-V3	Trojan/Win32.Kryptik.C4082810
McAfee	Packed-GAA!E620CB9CCEE4
MAX	malware (ai score=82)
Malwarebytes	Trojan.Crypt.MSIL
ESET-NOD32	a variant of MSIL/Kryptik.VQK
TrendMicro-HouseCall	TROJ_GEN.R066C0DIK20
Ikarus	Trojan.MSIL.Crypt
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	MSIL/Kryptik.VQV!tr
BitDefenderTheta	Gen:NN.ZemsilF.34700.Cm0@ayN08We
AVG	Win32:PWSX-gen [Trj]
Panda	Trj/GdSda.A

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (2 个事件)

dead_host	172.217.24.14:443
dead_host	172.217.160.110:443

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-04-28 05:51:44

Imports

Library mscoree.dll:

• 0x402000 _CorExeMain

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
clients2.google.com	A 172.217.160.110 CNAME clients.l.google.com	172.217.160.78
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
update.googleapis.com	A 203.208.40.98	203.208.41.34
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	51808	114.114.114.114	53
192.168.56.101	51963	114.114.114.114	53
192.168.56.101	53210	114.114.114.114	53
192.168.56.101	55368	114.114.114.114	53
192.168.56.101	60123	114.114.114.114	53
192.168.56.101	60384	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	49713	224.0.0.252	5355
192.168.56.101	51378	224.0.0.252	5355
192.168.56.101	53237	224.0.0.252	5355
192.168.56.101	53380	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	58367	224.0.0.252	5355
192.168.56.101	61680	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	62318	224.0.0.252	5355
192.168.56.101	63429	224.0.0.252	5355
192.168.56.101	65004	224.0.0.252	5355

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.