哈勃分析系统报告:
基本信息
文件名称:
Recycle.exe
MD5: 284e0d45b6aab3745ec3ecbc914c2707
文件类型: EXE
上传时间: 2017-09-14 21:00:04
出品公司: N/A
版本: N/A
壳或编译器信息: PACKER:UPolyX v0.5
关键行为
行为描述: 设置特殊文件属性
详情信息:
C:\WINDOWS\system32\20E62D\9BB07D.EXE
C:\WINDOWS\system32\995119\cnvpe.fne
C:\WINDOWS\system32\995119\dp1.fne
C:\WINDOWS\system32\995119\eAPI.fne
C:\WINDOWS\system32\995119\HtmlView.fne
C:\WINDOWS\system32\995119\internet.fne
C:\WINDOWS\system32\995119\krnln.fnr
C:\WINDOWS\system32\995119\shell.fne
C:\WINDOWS\system32\995119\spec.fne
C:\WINDOWS\system32\995119\RegEx.fnr
行为描述: 设置特殊文件夹属性
详情信息:
C:\WINDOWS\system32\20E62D
C:\WINDOWS\system32\995119
C:\WINDOWS\system32\F3A2C2
C:\WINDOWS\system32\4BCBB2
行为描述: 获取TickCount值
详情信息:
TickCount = 220781, SleepMilliseconds = 250.
TickCount = 220796, SleepMilliseconds = 250.
行为描述: 设置启动项
详情信息:
C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\9BB07D.lnk
进程行为
行为描述: 创建进程
详情信息:
[0x00000abc]ImagePath = C:\WINDOWS\explorer.exe, CmdLine = explorer C:\Documents and Settings\Administrator\Local Settings\%temp%\996E
行为描述: 创建本地线程
详情信息:
TargetProcess: %temp%\****.exe, InheritedFromPID = 2000, ProcessID = 2636, ThreadID = 2720, StartAddress = 77DC845A, Parameter = 00000000
TargetProcess: 9BB07D.EXE, InheritedFromPID = 2636, ProcessID = 2848, ThreadID = 2936, StartAddress = 77DC845A, Parameter = 00000000
行为描述: 创建新文件进程
详情信息:
[0x00000b20]ImagePath = C:\WINDOWS\system32\20E62D\9BB07D.EXE, CmdLine = C:\WINDOWS\system32\20E62D\9BB07D.EXE
文件行为
行为描述: 创建文件
详情信息:
C:\Documents and Settings\Administrator\Local Settings\Temp\E_N4\krnln.fnr
C:\Documents and Settings\Administrator\Local Settings\Temp\E_N4\HtmlView.fne
C:\Documents and Settings\Administrator\Local Settings\Temp\E_N4\internet.fne
C:\Documents and Settings\Administrator\Local Settings\Temp\E_N4\eAPI.fne
C:\Documents and Settings\Administrator\Local Settings\Temp\E_N4\dp1.fne
C:\Documents and Settings\Administrator\Local Settings\Temp\E_N4\shell.fne
C:\Documents and Settings\Administrator\Local Settings\Temp\E_N4\spec.fne
C:\Documents and Settings\Administrator\Local Settings\Temp\E_N4\cnvpe.fne
C:\WINDOWS\system32\20E62D\9BB07D.EXE
C:\WINDOWS\system32\995119\cnvpe.fne
C:\WINDOWS\system32\995119\dp1.fne
C:\WINDOWS\system32\995119\eAPI.fne
C:\WINDOWS\system32\995119\HtmlView.fne
C:\WINDOWS\system32\995119\internet.fne
C:\WINDOWS\system32\995119\krnln.fnr
行为描述: 创建可执行文件
详情信息:
C:\Documents and Settings\Administrator\Local Settings\Temp\E_N4\krnln.fnr
C:\Documents and Settings\Administrator\Local Settings\Temp\E_N4\HtmlView.fne
C:\Documents and Settings\Administrator\Local Settings\Temp\E_N4\internet.fne
C:\Documents and Settings\Administrator\Local Settings\Temp\E_N4\eAPI.fne
C:\Documents and Settings\Administrator\Local Settings\Temp\E_N4\dp1.fne
C:\Documents and Settings\Administrator\Local Settings\Temp\E_N4\shell.fne
C:\Documents and Settings\Administrator\Local Settings\Temp\E_N4\spec.fne
C:\Documents and Settings\Administrator\Local Settings\Temp\E_N4\cnvpe.fne
C:\WINDOWS\system32\20E62D\9BB07D.EXE
C:\WINDOWS\system32\995119\cnvpe.fne
C:\WINDOWS\system32\995119\dp1.fne
C:\WINDOWS\system32\995119\eAPI.fne
C:\WINDOWS\system32\995119\HtmlView.fne
C:\WINDOWS\system32\995119\internet.fne
C:\WINDOWS\system32\995119\krnln.fnr
行为描述: 覆盖已有文件
详情信息:
C:\Documents and Settings\Administrator\Local Settings\Temp\E_N4\internet.fne
C:\Documents and Settings\Administrator\Local Settings\Temp\E_N4\eAPI.fne
C:\Documents and Settings\Administrator\Local Settings\Temp\E_N4\spec.fne
C:\Documents and Settings\Administrator\Local Settings\Temp\E_N4\cnvpe.fne
行为描述: 复制文件
详情信息:
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\E_N4\cnvpe.fne ---> C:\WINDOWS\system32\995119\\cnvpe.fne
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\E_N4\cnvpe.fne-newfile ---> C:\WINDOWS\system32\995119\\cnvpe.fne-newfile
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\E_N4\cnvpe.fne-samplefile ---> C:\WINDOWS\system32\995119\\cnvpe.fne-samplefile
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\E_N4\cnvpe.fne.AmBackup13 ---> C:\WINDOWS\system32\995119\\cnvpe.fne.AmBackup13
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\E_N4\cnvpe.fne.AmBackup8 ---> C:\WINDOWS\system32\995119\\cnvpe.fne.AmBackup8
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\E_N4\dp1.fne ---> C:\WINDOWS\system32\995119\\dp1.fne
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\E_N4\dp1.fne-newfile ---> C:\WINDOWS\system32\995119\\dp1.fne-newfile
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\E_N4\dp1.fne-samplefile ---> C:\WINDOWS\system32\995119\\dp1.fne-samplefile
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\E_N4\dp1.fne.AmBackup5 ---> C:\WINDOWS\system32\995119\\dp1.fne.AmBackup5
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\E_N4\eAPI.fne ---> C:\WINDOWS\system32\995119\\eAPI.fne
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\E_N4\eAPI.fne-newfile ---> C:\WINDOWS\system32\995119\\eAPI.fne-newfile
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\E_N4\eAPI.fne-samplefile ---> C:\WINDOWS\system32\995119\\eAPI.fne-samplefile
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\E_N4\eAPI.fne.AmBackup11 ---> C:\WINDOWS\system32\995119\\eAPI.fne.AmBackup11
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\E_N4\eAPI.fne.AmBackup4 ---> C:\WINDOWS\system32\995119\\eAPI.fne.AmBackup4
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\E_N4\HtmlView.fne ---> C:\WINDOWS\system32\995119\\HtmlView.fne
行为描述: 设置启动项
详情信息:
C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\9BB07D.lnk
行为描述: 设置特殊文件属性
详情信息:
C:\WINDOWS\system32\20E62D\9BB07D.EXE
C:\WINDOWS\system32\995119\cnvpe.fne
C:\WINDOWS\system32\995119\dp1.fne
C:\WINDOWS\system32\995119\eAPI.fne
C:\WINDOWS\system32\995119\HtmlView.fne
C:\WINDOWS\system32\995119\internet.fne
C:\WINDOWS\system32\995119\krnln.fnr
C:\WINDOWS\system32\995119\shell.fne
C:\WINDOWS\system32\995119\spec.fne
C:\WINDOWS\system32\995119\RegEx.fnr
行为描述: 查找文件
详情信息:
FileName = C:\WINDOWS
FileName = C:\WINDOWS\explorer.exe
FileName = C:\Documents and Settings
FileName = C:\Documents and Settings\Administrator
FileName = C:\Documents and Settings\Administrator\Local Settings
FileName = C:\Documents and Settings\Administrator\Local Settings\Temp
FileName = C:\Documents and Settings\Administrator\Local Settings\%temp%
FileName = C:\Documents and Settings\Administrator\Local Settings\%temp%\996E
FileName = C:\WINDOWS\system32\9BB07D.EXE
FileName = C:\WINDOWS\system32
FileName = C:\WINDOWS\system32\20E62D
FileName = C:\WINDOWS\system32\20E62D\9BB07D.EXE
FileName = C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\E_N4\*.*
FileName = C:\Documents and Settings\Administrator\My Documents
FileName = C:\Documents and Settings\All Users
行为描述: 设置特殊文件夹属性
详情信息:
C:\WINDOWS\system32\20E62D
C:\WINDOWS\system32\995119
C:\WINDOWS\system32\F3A2C2
C:\WINDOWS\system32\4BCBB2
行为描述: 修改文件内容
详情信息:
C:\Documents and Settings\Administrator\Local Settings\Temp\E_N4\krnln.fnr ---> Offset = 0
C:\Documents and Settings\Administrator\Local Settings\Temp\E_N4\HtmlView.fne ---> Offset = 0
C:\Documents and Settings\Administrator\Local Settings\Temp\E_N4\internet.fne ---> Offset = 0
C:\Documents and Settings\Administrator\Local Settings\Temp\E_N4\eAPI.fne ---> Offset = 0
C:\Documents and Settings\Administrator\Local Settings\Temp\E_N4\dp1.fne ---> Offset = 0
C:\Documents and Settings\Administrator\Local Settings\Temp\E_N4\shell.fne ---> Offset = 0
C:\Documents and Settings\Administrator\Local Settings\Temp\E_N4\spec.fne ---> Offset = 0
C:\Documents and Settings\Administrator\Local Settings\Temp\E_N4\cnvpe.fne ---> Offset = 0
C:\WINDOWS\system32\20E62D\9BB07D.EXE ---> Offset = 0
C:\WINDOWS\system32\995119\cnvpe.fne ---> Offset = 0
C:\WINDOWS\system32\995119\cnvpe.fne ---> Offset = 4096
C:\WINDOWS\system32\995119\cnvpe.fne ---> Offset = 8192
C:\WINDOWS\system32\995119\cnvpe.fne ---> Offset = 12288
C:\WINDOWS\system32\995119\dp1.fne ---> Offset = 0
C:\WINDOWS\system32\995119\dp1.fne ---> Offset = 65536
其他行为
行为描述: 创建互斥体
详情信息:
CTF.LBES.MutexDefaultS-*
CTF.Compart.MutexDefaultS-*
CTF.Asm.MutexDefaultS-*
CTF.Layouts.MutexDefaultS-*
CTF.TMD.MutexDefaultS-*
CTF.TimListCache.FMPDefaultS-*MUTEX.DefaultS-*
行为描述: 创建事件对象
详情信息:
EventName = DINPUTWINMM
EventName = Wait For Buffer Return
EventName = rxr
EventName = Global\userenv: User Profile setup event
行为描述: 获取TickCount值
详情信息:
TickCount = 220781, SleepMilliseconds = 250.
TickCount = 220796, SleepMilliseconds = 250.
行为描述: 调整进程token权限
详情信息:
SE_LOAD_DRIVER_PRIVILEGE
行为描述: 打开事件
详情信息:
HookSwitchHookEnabledEvent
_fCanRegisterWithShellService
rxr
行为描述: 直接操作物理设备
详情信息:
\??\PhysicalDrive0
行为描述: 可执行文件签名信息
详情信息:
C:\Documents and Settings\Administrator\Local Settings\Temp\E_N4\krnln.fnr(签名验证: 未通过)
C:\Documents and Settings\Administrator\Local Settings\Temp\E_N4\HtmlView.fne(签名验证: 未通过)
C:\Documents and Settings\Administrator\Local Settings\Temp\E_N4\internet.fne(签名验证: 未通过)
C:\Documents and Settings\Administrator\Local Settings\Temp\E_N4\eAPI.fne(签名验证: 未通过)
C:\Documents and Settings\Administrator\Local Settings\Temp\E_N4\dp1.fne(签名验证: 未通过)
C:\Documents and Settings\Administrator\Local Settings\Temp\E_N4\shell.fne(签名验证: 未通过)
C:\Documents and Settings\Administrator\Local Settings\Temp\E_N4\spec.fne(签名验证: 未通过)
C:\Documents and Settings\Administrator\Local Settings\Temp\E_N4\cnvpe.fne(签名验证: 未通过)
C:\WINDOWS\system32\20E62D\9BB07D.EXE(签名验证: 未通过)
C:\WINDOWS\system32\995119\cnvpe.fne(签名验证: 未通过)
C:\WINDOWS\system32\995119\dp1.fne(签名验证: 未通过)
C:\WINDOWS\system32\995119\eAPI.fne(签名验证: 未通过)
C:\WINDOWS\system32\995119\HtmlView.fne(签名验证: 未通过)
C:\WINDOWS\system32\995119\internet.fne(签名验证: 未通过)
C:\WINDOWS\system32\995119\krnln.fnr(签名验证: 未通过)
行为描述: 调用Sleep函数
详情信息:
[1]: MilliSeconds = 250.
行为描述: 隐藏指定窗口
详情信息:
[Window,Class] = [,Afx:10000000:8:10011:1900015:0]
[Window,Class] = [,Shell Embedding]
行为描述: 可执行文件MD5
详情信息:
C:\Documents and Settings\Administrator\Local Settings\Temp\E_N4\krnln.fnr ---> aa6d9565a3d8ea2a89ddc2148e1c05cb
C:\Documents and Settings\Administrator\Local Settings\Temp\E_N4\HtmlView.fne ---> e661178be8c745462fded7d0dd1cd940
C:\Documents and Settings\Administrator\Local Settings\Temp\E_N4\internet.fne ---> 0de8315d345b7f03cad6fc99f65b971c
C:\Documents and Settings\Administrator\Local Settings\Temp\E_N4\eAPI.fne ---> e2b589e4901281e367d51194c84db2bd
C:\Documents and Settings\Administrator\Local Settings\Temp\E_N4\dp1.fne ---> be55e6b02a87e6bba9e82b5f8c4dbe94
C:\Documents and Settings\Administrator\Local Settings\Temp\E_N4\shell.fne ---> c428378de853afdbc7316d11e929d348
C:\Documents and Settings\Administrator\Local Settings\Temp\E_N4\spec.fne ---> a060c10a53f8483a1454610ec0511fc4
C:\Documents and Settings\Administrator\Local Settings\Temp\E_N4\cnvpe.fne ---> 45989b69459a5d36b6288f281abaffd0
C:\WINDOWS\system32\20E62D\9BB07D.EXE ---> 284e0d45b6aab3745ec3ecbc914c2707
C:\WINDOWS\system32\995119\cnvpe.fne ---> 45989b69459a5d36b6288f281abaffd0
C:\WINDOWS\system32\995119\dp1.fne ---> be55e6b02a87e6bba9e82b5f8c4dbe94
C:\WINDOWS\system32\995119\eAPI.fne ---> e2b589e4901281e367d51194c84db2bd
C:\WINDOWS\system32\995119\HtmlView.fne ---> e661178be8c745462fded7d0dd1cd940
C:\WINDOWS\system32\995119\internet.fne ---> 0de8315d345b7f03cad6fc99f65b971c
C:\WINDOWS\system32\995119\krnln.fnr ---> aa6d9565a3d8ea2a89ddc2148e1c05cb
行为描述: 打开互斥体
详情信息:
ShimCacheMutex
行为描述: 加载新释放的文件
详情信息:
Image: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\E_N4\krnln.fnr.
Image: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\E_N4\HtmlView.fne.
Image: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\E_N4\shell.fne.
Image: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\E_N4\dp1.fne.
Image: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\E_N4\eAPI.fne.
进程树
****.exe (PID: 0x00000a4c)
9bb07d.exe (PID: 0x00000b20)
explorer.exe (PID: 0x00000abc) |