ammnms.exe

显示全部楼层 · 发表于 2016-9-15 00:10:49

2016-09-15 00:08:13 C:\Users\Administrator\Desktop\ammnms.exe 修改文件 C:\360SANDBOX\SHADOW\Users\Administrator\AppData\Local\Temp\888.jpg
2016-09-15 00:08:04 C:\Users\Administrator\Desktop\ammnms.exe 直接显示器访问
2016-09-15 00:07:54 C:\Users\Administrator\Desktop\ammnms.exe 直接键盘访问 C:\Users\Administrator\Desktop\ammnms.exe
2016-09-15 00:07:48 C:\Users\Administrator\Desktop\ammnms.exe 修改文件 C:\360SANDBOX\SHADOW\Users\Administrator\AppData\Local\Microsoft\Windows\INetCache\IE\OHUQO8HO\checkip[1].htm
2016-09-15 00:07:42 C:\Users\Administrator\Desktop\ammnms.exe 修改文件 C:\360SANDBOX\SHADOW\Users\Administrator\AppData\Local\Microsoft\Windows\INetCache\counters.dat
2016-09-15 00:07:35 C:\Users\Administrator\Desktop\ammnms.exe 访问COM接口 C:\Windows\System32\svchost.exe
2016-09-15 00:07:31 C:\Users\Administrator\Desktop\ammnms.exe 访问COM接口 {8BC3F05E-D86B-11D0-A075-00C04FB68820}
2016-09-15 00:07:24 C:\Users\Administrator\Desktop\ammnms.exe 访问内存 C:\Windows\explorer.exe
2016-09-15 00:07:16 C:\Users\Administrator\Desktop\ammnms.exe 修改文件 C:\360SANDBOX\SHADOW\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft UpdatX.lnk
2016-09-15 00:06:53 C:\Users\Administrator\Desktop\ammnms.exe 修改文件 C:\360SANDBOX\SHADOW\Users\Administrator\AppData\Local\Temp\Server.exe
2016-09-15 00:06:49 C:\Users\Administrator\Desktop\ammnms.exe 修改文件 C:\360SANDBOX\SHADOW\Users\Administrator\AppData\Local\Temp\rjijxvy
2016-09-15 00:06:45 C:\Users\Administrator\Desktop\ammnms.exe 修改文件 C:\360SANDBOX\SHADOW\Users\Administrator\AppData\Local\Temp\autE9BF.tmp

显示全部楼层 · 发表于 2016-9-15 04:56:39

趋势双击拦截

显示全部楼层 · 发表于 2016-9-15 07:16:15

AVG IDP 常规行为检测

显示全部楼层 · 发表于 2016-9-15 08:12:52

诺顿信誉不良，沙盘内双击后程序闪退

显示全部楼层 · 发表于 2016-9-15 10:03:26

火绒扫描miss

显示全部楼层 · 发表于 2016-9-15 13:41:11

本帖最后由 aboringman 于 2016-9-15 13:43 编辑

Kaspersky：

扫描：miss；

双击：PDM击杀之。

15.09.2016 13.40.03;恶意程序的操作已回滚;

PDM:Trojan.Win32.Generic;

C:\Users\26629\Desktop\ammnms.exe;c:\users\26629\desktop\ammnms.exe;

09/15/2016 13:40:03

15.09.2016 13.40.03;回滚恶意程序的操作时文件被删除;

c:\users\26629\appdata\roaming\microsoft\windows\start menu\programs\startup\microsoft updatx.lnk;

c:\users\26629\appdata\roaming\microsoft\windows\start menu\programs\startup\microsoft updatx.lnk;

C:\Users\26629\Desktop\ammnms.exe;c:\users\26629\desktop\ammnms.exe;

09/15/2016 13:40:03

15.09.2016 13.40.03;回滚恶意程序的操作时文件被删除;

c:\users\26629\appdata\local\temp\server.exe;c:\users\26629\appdata\local\temp\server.exe;

C:\Users\26629\Desktop\ammnms.exe;

c:\users\26629\desktop\ammnms.exe;

09/15/2016 13:40:03

15.09.2016 13.38.30;恶意程序已删除;

PDM:Trojan.Win32.Generic;

C:\Users\26629\Desktop\ammnms.exe;

c:\users\26629\desktop\ammnms.exe;

09/15/2016 13:38:30

15.09.2016 13.37.44;恶意程序已终止;

PDM:Trojan.Win32.Generic;

C:\Users\26629\Desktop\ammnms.exe;

C:\Users\26629\Desktop\ammnms.exe;

09/15/2016 13:37:44

15.09.2016 13.37.43;检测到恶意程序;

PDM:Trojan.Win32.Generic;

C:\Users\26629\Desktop\ammnms.exe;

c:\users\26629\desktop\ammnms.exe;

09/15/2016 13:37:43

显示全部楼层 · 发表于 2016-9-15 13:42:48

ESET 右键 kill

显示全部楼层 · 发表于 2016-9-15 19:28:41

mcafee kill

显示全部楼层 · 发表于 2016-9-15 22:08:31

2016-9-15 22:07:11 创建文件风险级别:未知阻止
进程: c:\documents and settings\administrator\桌面\ammnms\ammnms.exe
目标: C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\Microsoft UpdatX.lnk
规则: [应用程序]?* -> [文件组]拦截_自启动目录

2016-9-15 22:07:11 访问COM接口风险级别:低阻止
进程: c:\documents and settings\administrator\桌面\ammnms\ammnms.exe
目标: {8BC3F05E-D86B-11D0-A075-00C04FB68820}
规则: [应用程序组]主动防御_COM接口 -> [应用程序]* -> [COM接口]{8BC3F05E-D86B-11D0-A075-00C04FB68820}

显示全部楼层 · 发表于 2016-9-16 17:26:26

【1】2016-09-16 17:22:55,系统防护,自定义防护,ammnms.exe触犯自定义文件防护规则, 已阻止

操作进程：D:\My Documents\Tencent Files\240364538\ammnms\ammnms.exe
触犯规则：基础防御 12 | FLY_MC
操作类型：创建
操作文件：C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\Microsoft UpdatX.lnk
用户操作：已阻止
17:23:12:906, ammnms.exe, 3088:4208, 3088, W32_sendmsg, C:\Program Files\huorong\Sysdiag\bin\HRSword.exe, target_pid:4168 hwnd:0x001A0158 msg:0x00000000 wparam:0x00000000 lparam:0x00000000 , 0x00000000 [操作成功完成。  ],
17:23:12:906, ammnms.exe, 3088:4208, 3088, W32_sendmsg, C:\Program Files\huorong\Sysdiag\bin\HRSword.exe, target_pid:4168 hwnd:0x001A0158 msg:0x0000000E wparam:0x00000000 lparam:0x00000000 , 0x0000000D [],
17:23:12:906, ammnms.exe, 3088:4208, 3088, W32_sendmsg, C:\Program Files\huorong\Sysdiag\bin\HRSword.exe, target_pid:4168 hwnd:0x001A0158 msg:0x0000000D wparam:0x0000000E lparam:0x0275C360 , 0x0000000D [],
17:23:12:953, ammnms.exe, 3088:4208, 3088, W32_sendmsg, C:\Program Files\huorong\Sysdiag\bin\HRSword.exe, target_pid:4168 hwnd:0x001A0158 msg:0x00000000 wparam:0x00000000 lparam:0x00000000 , 0x00000000 [操作成功完成。  ],
17:23:12:953, ammnms.exe, 3088:4208, 3088, W32_sendmsg, C:\Program Files\huorong\Sysdiag\bin\HRSword.exe, target_pid:4168 hwnd:0x001A0158 msg:0x0000000E wparam:0x00000000 lparam:0x00000000 , 0x0000000D [],
17:23:12:953, ammnms.exe, 3088:4208, 3088, W32_sendmsg, C:\Program Files\huorong\Sysdiag\bin\HRSword.exe, target_pid:4168 hwnd:0x001A0158 msg:0x0000000D wparam:0x0000000E lparam:0x0275C988 , 0x0000000D [],
17:23:13:000, ammnms.exe, 3088:4208, 3088, W32_sendmsg, C:\Program Files\huorong\Sysdiag\bin\HRSword.exe, target_pid:4168 hwnd:0x001A0158 msg:0x00000000 wparam:0x00000000 lparam:0x00000000 , 0x00000000 [操作成功完成。  ],
17:23:13:000, ammnms.exe, 3088:4208, 3088, W32_sendmsg, C:\Program Files\huorong\Sysdiag\bin\HRSword.exe, target_pid:4168 hwnd:0x001A0158 msg:0x0000000E wparam:0x00000000 lparam:0x00000000 , 0x0000000D [],
17:23:13:000, ammnms.exe, 3088:4208, 3088, W32_sendmsg, C:\Program Files\huorong\Sysdiag\bin\HRSword.exe, target_pid:4168 hwnd:0x001A0158 msg:0x0000000D wparam:0x0000000E lparam:0x0275C360 , 0x0000000D [],
17:23:13:046, ammnms.exe, 3088:4208, 3088, W32_sendmsg, C:\Program Files\huorong\Sysdiag\bin\HRSword.exe, target_pid:4168 hwnd:0x001A0158 msg:0x00000000 wparam:0x00000000 lparam:0x00000000 , 0x00000000 [操作成功完成。  ],
17:23:13:046, ammnms.exe, 3088:4208, 3088, W32_sendmsg, C:\Program Files\huorong\Sysdiag\bin\HRSword.exe, target_pid:4168 hwnd:0x001A0158 msg:0x0000000E wparam:0x00000000 lparam:0x00000000 , 0x0000000D [],
17:23:13:046, ammnms.exe, 3088:4208, 3088, W32_sendmsg, C:\Program Files\huorong\Sysdiag\bin\HRSword.exe, target_pid:4168 hwnd:0x001A0158 msg:0x0000000D wparam:0x0000000E lparam:0x0275C988 , 0x0000000D [],
17:23:13:093, ammnms.exe, 3088:4208, 3088, W32_sendmsg, C:\Program Files\huorong\Sysdiag\bin\HRSword.exe, target_pid:4168 hwnd:0x001A0158 msg:0x00000000 wparam:0x00000000 lparam:0x00000000 , 0x00000000 [操作成功完成。  ],
17:23:13:093, ammnms.exe, 3088:4208, 3088, W32_sendmsg, C:\Program Files\huorong\Sysdiag\bin\HRSword.exe, target_pid:4168 hwnd:0x001A0158 msg:0x0000000E wparam:0x00000000 lparam:0x00000000 , 0x0000000D [],
17:23:13:093, ammnms.exe, 3088:4208, 3088, W32_sendmsg, C:\Program Files\huorong\Sysdiag\bin\HRSword.exe, target_pid:4168 hwnd:0x001A0158 msg:0x0000000D wparam:0x0000000E lparam:0x0275C360 , 0x0000000D [],
17:23:13:140, ammnms.exe, 3088:4208, 3088, W32_sendmsg, C:\Program Files\huorong\Sysdiag\bin\HRSword.exe, target_pid:4168 hwnd:0x001A0158 msg:0x00000000 wparam:0x00000000 lparam:0x00000000 , 0x00000000 [操作成功完成。  ],
17:23:13:140, ammnms.exe, 3088:4208, 3088, W32_sendmsg, C:\Program Files\huorong\Sysdiag\bin\HRSword.exe, target_pid:4168 hwnd:0x001A0158 msg:0x0000000E wparam:0x00000000 lparam:0x00000000 , 0x0000000D [],
17:23:13:140, ammnms.exe, 3088:4208, 3088, W32_sendmsg, C:\Program Files\huorong\Sysdiag\bin\HRSword.exe, target_pid:4168 hwnd:0x001A0158 msg:0x0000000D wparam:0x0000000E lparam:0x0275C988 , 0x0000000D [],
17:23:13:187, ammnms.exe, 3088:4208, 3088, W32_sendmsg, C:\Program Files\huorong\Sysdiag\bin\HRSword.exe, target_pid:4168 hwnd:0x001A0158 msg:0x00000000 wparam:0x00000000 lparam:0x00000000 , 0x00000000 [操作成功完成。  ],
一直在向火绒剑发送消息，没什么别的行为（估计是想绕过火绒剑的分析）

[可疑文件] ammnms.exe

本帖子中包含更多资源

本帖子中包含更多资源

评分

本帖子中包含更多资源