TeslaCrypt ransomware 4.0：加密不添扩展名

显示全部楼层 · 发表于 2016-3-18 20:51:11

天蓝色的忧伤发表于 2016-3-18 19:06
Dr.Web detected

蜘蛛就交给你了，我有新玩具了，马上到货

显示全部楼层 · 发表于 2016-3-18 20:54:14

windows7爱好者发表于 2016-3-18 20:51
蜘蛛就交给你了，我有新玩具了，马上到货

你可是正版啊。趋势到了？

显示全部楼层 · 发表于 2016-3-18 20:59:09

天蓝色的忧伤发表于 2016-3-18 20:54
你可是正版啊。趋势到了？

我没买过趋势啊.......

显示全部楼层 · 发表于 2016-3-18 21:00:16

本帖最后由左手于 2016-3-18 21:01 编辑

[mw_shl_code=css,true]2016-3-18 20:58:28 创建新进程风险级别:未知允许
进程: c:\documents and settings\administrator\桌面\teslacrypt 4.0\teslacrypt 4.0.exe
目标: c:\documents and settings\administrator\桌面\teslacrypt 4.0\teslacrypt 4.0.exe
命令行: "C:\Documents and Settings\Administrator\桌面\TeslaCrypt 4.0\TeslaCrypt 4.0.exe"
规则: [应用程序]??* -> [子应用程序]*\桌面\*

2016-3-18 20:58:29 修改注册表值风险级别:未知阻止
进程: c:\documents and settings\administrator\桌面\teslacrypt 4.0\teslacrypt 4.0.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Personal
值: C:\Documents and Settings\Administrator\My Documents
规则: [应用程序]* -> [注册表]*\Microsoft\Windows\CurrentVersion\Explorer\*Shell Folders*

2016-3-18 20:58:41 创建文件风险级别:未知允许
进程: c:\documents and settings\administrator\桌面\teslacrypt 4.0\teslacrypt 4.0.exe
目标: C:\Documents and Settings\Administrator\My Documents\xwfbxm.exe
规则: [应用程序]?:\*\*\*\*\* -> [文件]c:\documents and settings\*\my documents\*

2016-3-18 20:58:41 设置文件隐藏属性风险级别:低阻止
进程: c:\documents and settings\administrator\桌面\teslacrypt 4.0\teslacrypt 4.0.exe
目标: C:\Documents and Settings\Administrator\My Documents\xwfbxm.exe
规则: [应用程序]?:\*\*\*\*\* -> [文件]c:\documents and settings\*\my documents\*

2016-3-18 20:58:41 读文件风险级别:未知阻止
进程: c:\documents and settings\administrator\桌面\teslacrypt 4.0\teslacrypt 4.0.exe
目标: \Device\NamedPipe\wkssvc
规则: [文件组]Namedpipe -> [文件]\device\namedpipe\*

2016-3-18 20:58:41 读文件风险级别:未知阻止
进程: c:\documents and settings\administrator\桌面\teslacrypt 4.0\teslacrypt 4.0.exe
目标: \Device\NamedPipe\lsarpc
规则: [文件组]Namedpipe -> [文件]\device\namedpipe\*

2016-3-18 20:58:41 修改注册表值风险级别:未知阻止
进程: c:\documents and settings\administrator\桌面\teslacrypt 4.0\teslacrypt 4.0.exe
目标: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Common Documents
值: C:\Documents and Settings\All Users\Documents
规则: [应用程序]* -> [注册表]*\Microsoft\Windows\CurrentVersion\Explorer\*Shell Folders*

2016-3-18 20:58:41 修改注册表值风险级别:未知阻止
进程: c:\documents and settings\administrator\桌面\teslacrypt 4.0\teslacrypt 4.0.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Desktop
值: C:\Documents and Settings\Administrator\桌面
规则: [应用程序]* -> [注册表]*\Microsoft\Windows\CurrentVersion\Explorer\*Shell Folders*

2016-3-18 20:58:41 修改注册表值风险级别:未知阻止
进程: c:\documents and settings\administrator\桌面\teslacrypt 4.0\teslacrypt 4.0.exe
目标: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Common Desktop
值: C:\Documents and Settings\All Users\桌面
规则: [应用程序]* -> [注册表]*\Microsoft\Windows\CurrentVersion\Explorer\*Shell Folders*

2016-3-18 20:58:41 修改注册表值风险级别:未知阻止
进程: c:\documents and settings\administrator\桌面\teslacrypt 4.0\teslacrypt 4.0.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass
值: 0x00000001(1)
规则: [注册表组]拦截_重要关联 -> [注册表]HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap; ProxyBypass

2016-3-18 20:58:41 修改注册表值风险级别:未知阻止
进程: c:\documents and settings\administrator\桌面\teslacrypt 4.0\teslacrypt 4.0.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName
值: 0x00000001(1)
规则: [注册表组]拦截_重要关联 -> [注册表]HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap; IntranetName

2016-3-18 20:58:41 修改注册表值风险级别:未知阻止
进程: c:\documents and settings\administrator\桌面\teslacrypt 4.0\teslacrypt 4.0.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet
值: 0x00000001(1)
规则: [注册表组]拦截_重要关联 -> [注册表]HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap; UNCAsIntranet

2016-3-18 20:58:41 修改注册表值风险级别:未知阻止
进程: c:\documents and settings\administrator\桌面\teslacrypt 4.0\teslacrypt 4.0.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect
值: 0x00000001(1)
规则: [注册表组]拦截_重要关联 -> [注册表]HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap; AutoDetect

2016-3-18 20:58:41 修改注册表值风险级别:未知阻止
进程: c:\documents and settings\administrator\桌面\teslacrypt 4.0\teslacrypt 4.0.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass
值: 0x00000001(1)
规则: [注册表组]拦截_重要关联 -> [注册表]HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap; ProxyBypass

2016-3-18 20:58:41 修改注册表值风险级别:未知阻止
进程: c:\documents and settings\administrator\桌面\teslacrypt 4.0\teslacrypt 4.0.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName
值: 0x00000001(1)
规则: [注册表组]拦截_重要关联 -> [注册表]HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap; IntranetName

2016-3-18 20:58:41 修改注册表值风险级别:未知阻止
进程: c:\documents and settings\administrator\桌面\teslacrypt 4.0\teslacrypt 4.0.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet
值: 0x00000001(1)
规则: [注册表组]拦截_重要关联 -> [注册表]HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap; UNCAsIntranet

2016-3-18 20:58:41 修改注册表值风险级别:未知阻止
进程: c:\documents and settings\administrator\桌面\teslacrypt 4.0\teslacrypt 4.0.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect
值: 0x00000001(1)
规则: [注册表组]拦截_重要关联 -> [注册表]HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap; AutoDetect

2016-3-18 20:58:41 修改注册表值风险级别:未知阻止
进程: c:\documents and settings\administrator\桌面\teslacrypt 4.0\teslacrypt 4.0.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cache
值: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
规则: [应用程序]* -> [注册表]*\Microsoft\Windows\CurrentVersion\Explorer\*Shell Folders*

2016-3-18 20:58:41 修改注册表值风险级别:未知阻止
进程: c:\documents and settings\administrator\桌面\teslacrypt 4.0\teslacrypt 4.0.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cookies
值: C:\Documents and Settings\Administrator\Cookies
规则: [应用程序]* -> [注册表]*\Microsoft\Windows\CurrentVersion\Explorer\*Shell Folders*

2016-3-18 20:58:41 创建新进程风险级别:未知阻止
进程: c:\documents and settings\administrator\桌面\teslacrypt 4.0\teslacrypt 4.0.exe
目标: c:\windows\system32\cmd.exe
命令行: "C:\WINDOWS\system32\cmd.exe" /c DEL C:\DOCUME~1\ADMINI~1\桌面\TESLAC~1.0\TESLAC~1.EXE >> NUL
规则: [应用程序组]→终止_降权组件

2016-3-18 20:59:13 修改注册表值风险级别:未知阻止
进程: c:\documents and settings\administrator\my documents\xwfbxm.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Personal
值: C:\Documents and Settings\Administrator\My Documents
规则: [应用程序]* -> [注册表]*\Microsoft\Windows\CurrentVersion\Explorer\*Shell Folders*

2016-3-18 20:59:13 读文件风险级别:未知阻止
进程: c:\documents and settings\administrator\my documents\xwfbxm.exe
目标: \Device\NamedPipe\lsarpc
规则: [文件组]Namedpipe -> [文件]\device\namedpipe\*

2016-3-18 20:59:13 修改注册表值风险级别:未知阻止
进程: c:\documents and settings\administrator\my documents\xwfbxm.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\CD Burning
值: C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\CD Burning
规则: [应用程序]* -> [注册表]*\Microsoft\Windows\CurrentVersion\Explorer\*Shell Folders*

2016-3-18 20:59:13 修改注册表值风险级别:未知阻止
进程: c:\documents and settings\administrator\my documents\xwfbxm.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Desktop
值: C:\Documents and Settings\Administrator\桌面
规则: [应用程序]* -> [注册表]*\Microsoft\Windows\CurrentVersion\Explorer\*Shell Folders*

2016-3-18 20:59:13 修改注册表值风险级别:未知阻止
进程: c:\documents and settings\administrator\my documents\xwfbxm.exe
目标: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Common Desktop
值: C:\Documents and Settings\All Users\桌面
规则: [应用程序]* -> [注册表]*\Microsoft\Windows\CurrentVersion\Explorer\*Shell Folders*

2016-3-18 20:59:13 读文件风险级别:未知阻止
进程: c:\documents and settings\administrator\my documents\xwfbxm.exe
目标: \Device\NamedPipe\wkssvc
规则: [文件组]Namedpipe -> [文件]\device\namedpipe\*

2016-3-18 20:59:13 读文件风险级别:未知阻止
进程: c:\documents and settings\administrator\my documents\xwfbxm.exe
目标: \Device\NamedPipe\srvsvc
规则: [文件组]Namedpipe -> [文件]\device\namedpipe\*

2016-3-18 20:59:13 修改文件风险级别:未知阻止
进程: c:\documents and settings\administrator\my documents\xwfbxm.exe
目标: C:\Documents and Settings\Administrator\ntuser.dat.LOG
规则: [应用程序]?:\*\*\*\* -> [文件]c:\documents and settings\administrator

2016-3-18 20:59:14 修改注册表值风险级别:未知阻止并结束进程
进程: c:\documents and settings\administrator\my documents\xwfbxm.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\_bfkr
值: C:\WINDOWS\SYSTEM32\CMD.EXE /C START C:\Documents and Settings\Administrator\My Documents\xwfbxm.exe
规则: [应用程序组]D+_Documents -> [应用程序]c:\documents and settings\*\* -> [注册表]*\SOFTWARE\Microsoft\Windows\CurrentVersion\Run*
[/mw_shl_code]

显示全部楼层 · 发表于 2016-3-18 22:19:31

显示全部楼层 · 发表于 2016-3-18 23:21:33

Virus: Trojan.Agent.BRSZ (Engine A)
File: TeslaCrypt 4.0.exe

显示全部楼层 · 发表于 2016-3-21 09:57:16

微软

C:\Users\XuanXia\Desktop\TeslaCrypt 4.0\TeslaCrypt 4.0.exe Infected: Ransom:Win32/Locky.A
Successfully checked: C:\Users\XuanXia\Desktop\TeslaCrypt 4.0

Scan ended on Mon Mar 21 09:56:58 2016

[病毒样本] TeslaCrypt ransomware 4.0：加密不添扩展名

本帖子中包含更多资源

评分

本帖子中包含更多资源

浏览过的版块