Detection ratio: 1 / 54 利用explorer加密文档

墨家小子

https://www.virustotal.com/en/fi ... nalysis/1449662178/
SHA256:        a567515e0c0818d889bc7d2ab0263915a071b5374906e8101a57c7e04e196cba
File name:        a567515e0c0818d889bc7d2ab0263915a071b5374906e8101a57c7e04e196cba.exe
Detection ratio:        1 / 54
Analysis date:        2015-12-09 11:56:18 UTC ( 1 minute ago )



2015/12/9 19:56:27,C:\Windows\explorer.exe,53,Allowed ;执行应用程序 ("C:\Users\SSSS\Desktop\S\a567515e0c0818d889bc7d2ab0263915a071b5374906e8101a57c7e04e196cba.exe" )

2015/12/9 19:56:30,C:\Users\SSSS\Desktop\S\a567515e0c0818d889bc7d2ab0263915a071b5374906e8101a57c7e04e196cba.exe,53,Allowed ;执行应用程序 ("C:\Users\SSSS\Desktop\S\a567515e0c0818d889bc7d2ab0263915a071b5374906e8101a57c7e04e196cba.exe" )

2015/12/9 19:56:32,C:\Users\SSSS\Desktop\S\a567515e0c0818d889bc7d2ab0263915a071b5374906e8101a57c7e04e196cba.exe,53,Allowed ;执行应用程序 ("C:\Users\SSSS\Desktop\S\a567515e0c0818d889bc7d2ab0263915a071b5374906e8101a57c7e04e196cba.exe" )

2015/12/9 19:56:33,C:\Users\SSSS\Desktop\S\a567515e0c0818d889bc7d2ab0263915a071b5374906e8101a57c7e04e196cba.exe,53,Allowed ;执行应用程序 ("C:\Users\SSSS\Desktop\S\a567515e0c0818d889bc7d2ab0263915a071b5374906e8101a57c7e04e196cba.exe" )

2015/12/9 19:56:36,C:\Users\SSSS\Desktop\S\a567515e0c0818d889bc7d2ab0263915a071b5374906e8101a57c7e04e196cba.exe,53,Allowed ;执行应用程序 ("C:\windows\system32\explorer.exe")

2015/12/9 19:56:38,C:\Windows\SysWOW64\explorer.exe,41,Blocked ;修改受保护的文件 (C:\Windows\osirohex.exe)

2015/12/9 19:56:39,C:\Windows\SysWOW64\explorer.exe,26,Blocked ;修改受保护的注册表键 (HKLM\SOFTWARE\MICROSOFT\Windows\CurrentVersion\Run,etcxogoz)
2015/12/9 19:56:40,C:\Windows\SysWOW64\explorer.exe,26,Blocked ;修改受保护的注册表键 (HKCU\Software\Microsoft\Windows\CurrentVersion\Run,alacmkil)
2015/12/9 19:56:42,C:\Windows\SysWOW64\explorer.exe,26,Blocked ;修改受保护的注册表键 (HKLM\SOFTWARE\MICROSOFT\Windows\CurrentVersion\Run,ujogymyf)
2015/12/9 19:56:43,C:\Windows\SysWOW64\explorer.exe,26,Blocked ;修改受保护的注册表键 (HKCU\Software\Microsoft\Windows\CurrentVersion\Run,acokimup)
2015/12/9 19:56:44,C:\Windows\SysWOW64\explorer.exe,26,Blocked ;修改受保护的注册表键 (HKLM\SOFTWARE\MICROSOFT\Windows\CurrentVersion\Run,eronyrom)
2015/12/9 19:56:46,C:\Windows\SysWOW64\explorer.exe,26,Blocked ;修改受保护的注册表键 (HKCU\Software\Microsoft\Windows\CurrentVersion\Run,emejadij)

2015/12/9 19:56:53,C:\Windows\SysWOW64\explorer.exe,53,Blocked ;执行应用程序 (vssadmin.exe Delete Shadows /All /Quiet)

2015/12/9 19:56:55,C:\Windows\SysWOW64\explorer.exe,50,Allowed ;使用 DNS 解析服务访问网络

2015/12/9 19:56:58,C:\Windows\SysWOW64\explorer.exe,48,Blocked ;出站网络访问

Mary04

感谢楼主分享
已下载  

samlin01

红伞kill

aboringman

AVG：

扫描：miss；

双击：实机双击（不入沙），样本启动另一explorer.exe后，等了一会儿，IDP击杀之。

"";"IDP.SEMS.L1, C:\Users\killer.Killer-PC\Desktop\a567515e0c0818d889bc7d2ab0263915a071b5374906e8101a57c7e04e196cba.exe";"Deleted, Moved to Virus Vault";"File or Directory";"2015/12/9, 20:21:31"
"";", C:\Users\killer.Killer-PC\Desktop\a567515e0c0818d889bc7d2ab0263915a071b5374906e8101a57c7e04e196cba.exe";"Object was blocked";"Process";"2015/12/9, 20:21:31"
"";", C:\Users\killer.Killer-PC\Desktop\a567515e0c0818d889bc7d2ab0263915a071b5374906e8101a57c7e04e196cba.exe";"Object was blocked";"Process";"2015/12/9, 20:21:31"
"";", C:\Users\killer.Killer-PC\Desktop\a567515e0c0818d889bc7d2ab0263915a071b5374906e8101a57c7e04e196cba.exe";"Object was blocked";"Process";"2015/12/9, 20:21:31"
"";", C:\Windows\explorer.exe";"Object was blocked";"Process";"2015/12/9, 20:21:31"
"";", C:\Windows\yqymkhew.exe";"Deleted, Moved to Virus Vault";"File or Directory";"2015/12/9, 20:21:31"
"";", HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\\YLILAGEJ";"Deleted, Moved to Virus Vault";"Registry value";"2015/12/9, 20:21:31"
"";", C:\Users\killer.Killer-PC\Desktop\a567515e0c0818d889bc7d2ab0263915a071b5374906e8101a57c7e04e196cba.exe";"Object was blocked";"Process";"2015/12/9, 20:21:31"

pal家族

卡巴UDS云杀

XywCloud

SUD to BAV

lixihong10

这个前面跑了。过COMODO 内存。
ESET 拦截成功。

墨家小子

lixihong10 发表于 2015-12-9 20:42
这个前面跑了。过COMODO 内存。
ESET 拦截成功。

你确定是一样的吗？

lixihong10

墨家小子 发表于 2015-12-9 20:46
你确定是一样的吗？

嗯。下载下来跑了一下。一样的效果。

230f4

Bitdefender Awake