163987014.scr

驭龙

楼上几位的双击很精彩啊，不过我的MA没机会双击了。

僵尸爱上猫

可疑文件： 163987014.scr

风险： 高
路径： F:\test\876CDFC715A1A49CA5A69C0CE3ABCA6B180B85D3\163987014.scr

详细信息
•    163987014.scr 程序试图修改敏感的系统资源。

修改的文件
•    c:\sandbox\likeabull\00test\user\current\appdata\local (created)
•    c:\sandbox\likeabull\00test\user\current\appdata\local\gdipfontcachev1.dat (created)
•    c:\sandbox\likeabull\00test\user\current\appdata\local\temp (created)
•    c:\sandbox\likeabull\00test\user\current\appdata\local\temp\sysinfo.txt (created)
•    c:\sandbox\likeabull\00test\user\current\appdata\roaming\windows update.exe (created)
•    c:\sandbox\likeabull\00test\user\current\appdata\roaming\microsoft\windows\adobearmservice.exe (created)
•    c:\sandbox\likeabull\00test\user\current\appdata\roaming\microsoft\windows\bthserv.exe (created)
•    f:\test\876cdfc715a1a49ca5a69c0ce3abca6b180b85d3\163987014.scr

修改的注册表
•    \REGISTRY\USER\SANDBOX_LIKEABULL_00TEST\USER\CURRENT\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS:Load (modified: old_value=, new_value =C:\Users\Likeabull\AppData\Roaming\Microsoft\Windows\AdobeARMservice.exe
•    \REGISTRY\USER\SANDBOX_LIKEABULL_00TEST\USER\CURRENT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP:AutoDetect (modified: old_value=, new_value =0x1 (1))
•    \REGISTRY\USER\SANDBOX_LIKEABULL_00TEST\USER\CURRENT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP:UNCAsIntranet (modified: old_value=, new_value =0x0 (0))
•    \REGISTRY\USER\SANDBOX_LIKEABULL_00TEST\USER\CURRENT_CLASSES\LOCAL SETTINGS\SOFTWARE\MICROSOFT\WINDOWS\SHELL\MUICACHE:C:\Sandbox\Likeabull\00test\user\current\AppData\Roaming\Microsoft\Windows\AdobeARMservice.exe (modified: old_value=, new_value =             Adobe Acrobat Update Service
•    \REGISTRY\USER\SANDBOX_LIKEABULL_00TEST\USER\CURRENT_CLASSES\LOCAL SETTINGS\SOFTWARE\MICROSOFT\WINDOWS\SHELL\MUICACHE:C:\Sandbox\Likeabull\00test\user\current\AppData\Roaming\Windows Update.exe (modified: old_value=, new_value =System Credential Manager
•    \REGISTRY\USER\SANDBOX_LIKEABULL_00TEST\USER\CURRENT_CLASSES\LOCAL SETTINGS\SOFTWARE\MICROSOFT\WINDOWS\SHELL\MUICACHE:F:\test\876CDFC715A1A49CA5A69C0CE3ABCA6B180B85D3\163987014.scr (modified: old_value=, new_value =System Credential Manager

EnZhSTReLniKoVa

bbszy

胖福 发表于 2015-6-10 07:20
文件名: 163987014.scr
威胁名称: SONAR.Heuristic.120完整路径: 不可用

sep12.6 Infostealer.Limitail