File name: 6015.tmp.exe Detection ratio: 4 / 56 加密勒索挂马

僵尸爱上猫

费尔对这个东西有感觉
[mw_shl_code=css,true]2016-03-22 17:47:51, F:\test\6015.tmp.exe . 云鉴定: 未鉴定, (等待处理)
2016-03-22 17:47:51, ServerCreatePrompt and send to client success for F:\test\6015.tmp.exe, action: 0
2016-03-22 17:47:51, PromptUnion for F:\test\6015.tmp.exe
2016-03-22 17:47:51, ClientCreatePrompt success
2016-03-22 17:47:51, Rules 310 for E:\Program Files\WinRAR\WinRAR.exe 50.1000000 -> Level: 50.8800.1b00000001000000
2016-03-22 17:47:52, MpApplyCaution Type: 21, Action: 4, Caution: 0595EF70, UpdatePromptStatus: 1, UpdateCautionStatus: 1
2016-03-22 17:47:57, MpApplyCaution Type: 21, Action: 4, Caution: 0595EF70, UpdatePromptStatus: 1, UpdateCautionStatus: 1
2016-03-22 17:48:00, ProcessLoad was blocked for C:\Sandbox\Likeabull\0test\user\current\Documents\psauoi.exe. <- F:\test\6015.tmp.exe(PID:4060)::F:\test\6015.tmp.exe(TID:8016)
2016-03-22 17:48:00, Begin Rollback for C:\Sandbox\Likeabull\0test\user\current\Documents\psauoi.exe
2016-03-22 17:48:00, Rollback Terminate Process C:\Sandbox\Likeabull\0test\user\current\Documents\psauoi.exe(PID: 9032) succed(0x0)
2016-03-22 17:48:00, Rollback Terminate Process
2016-03-22 17:48:00, End Rollback for C:\Sandbox\Likeabull\0test\user\current\Documents\psauoi.exe
2016-03-22 17:48:00, 成功 结束进程 C:\Sandbox\Likeabull\0test\user\current\Documents\psauoi.exe(PID: 9032)
2016-03-22 17:48:00, Begin Rollback for C:\Sandbox\Likeabull\0test\user\current\Documents\psauoi.exe
2016-03-22 17:48:00, Rollback to remove and quarantine dropped file C:\Sandbox\Likeabull\0test\user\current\Documents\psauoi.exe, quarantine succed.
2016-03-22 17:48:00, Rollback to remove file \Device\HarddiskVolume5\Sandbox\Likeabull\0test\user\current\Documents\psauoi.exe succed(0x0)
2016-03-22 17:48:00, Rollback to remove and quarantine dropped file C:\Sandbox\Likeabull\0test\user\current\Documents\psauoi.exe, quarantine failed.
2016-03-22 17:48:00, End Rollback for C:\Sandbox\Likeabull\0test\user\current\Documents\psauoi.exe
2016-03-22 17:48:00, 成功 结束进程 C:\Sandbox\Likeabull\0test\user\current\Documents\psauoi.exe, 返回代码: 0
2016-03-22 17:48:00, 清除文件 C:\Sandbox\Likeabull\0test\user\current\Documents\psauoi.exe. 云鉴定: 未鉴定, (成功清除) 备份返回代码: 4, 清除返回代码: -1
2016-03-22 17:48:04, MpApplyCaution Type: 21, Action: 4, Caution: 0595EF70, UpdatePromptStatus: 1, UpdateCautionStatus: 1
2016-03-22 17:48:06, Begin Rollback for F:\test\6015.tmp.exe
2016-03-22 17:48:06, Rollback Terminate Process F:\test\6015.tmp.exe(PID: 4060) succed(0x0)
2016-03-22 17:48:06, Rollback Terminate Process
2016-03-22 17:48:06, Rollback Terminate Process
2016-03-22 17:48:06, End Rollback for F:\test\6015.tmp.exe
2016-03-22 17:48:06, 成功 结束进程 F:\test\6015.tmp.exe(PID: 4060)
2016-03-22 17:48:06, Begin Rollback for F:\test\6015.tmp.exe
2016-03-22 17:48:06, Rollback Terminate Process F:\test\6015.tmp.exe(PID: 4060) succed(0x0)
2016-03-22 17:48:06, Rollback to remove and quarantine dropped file C:\Sandbox\Likeabull\0test\user\current\Documents\psauoi.exe, quarantine failed.
2016-03-22 17:48:06, Rollback to remove file \Device\HarddiskVolume5\Sandbox\Likeabull\0test\user\current\Documents\psauoi.exe failed(0xc0000034)
2016-03-22 17:48:06, Rollback to remove directory \Device\HarddiskVolume5\Sandbox\Likeabull\0test\user\current\Documents succed(0x0)
2016-03-22 17:48:06, Rollback to remove directory \Device\HarddiskVolume5\Sandbox\Likeabull\0test\user\current succed(0x0)
2016-03-22 17:48:06, Rollback to remove and quarantine dropped file F:\test\6015.tmp.exe, quarantine succed.
2016-03-22 17:48:06, Rollback to remove file \Device\HarddiskVolume3\test\6015.tmp.exe succed(0x0)
2016-03-22 17:48:06, Rollback to remove and quarantine dropped file F:\test\6015.tmp.exe, quarantine failed.
2016-03-22 17:48:06, 成功 结束进程 F:\test\6015.tmp.exe, 返回代码: 0
2016-03-22 17:48:06, End Rollback for F:\test\6015.tmp.exe
2016-03-22 17:48:06, 清除文件 F:\test\6015.tmp.exe. 云鉴定: 未鉴定, (成功清除) 备份返回代码: 4, 清除返回代码: -1
2016-03-22 17:48:06, MpApplyCaution Type: 21, Action: 1, Caution: 024F3364, UpdatePromptStatus: 1, UpdateCautionStatus: 1
2016-03-22 17:48:06, Begin Rollback for F:\test\6015.tmp.exe
2016-03-22 17:48:06, End Rollback for F:\test\6015.tmp.exe
2016-03-22 17:48:06, 成功 结束进程 F:\test\6015.tmp.exe(PID: 8412)
2016-03-22 17:48:06, Begin Rollback for F:\test\6015.tmp.exe
2016-03-22 17:48:06, Rollback to remove and quarantine dropped file C:\Sandbox\Likeabull\0test\user\current\Documents\psauoi.exe, quarantine failed.
2016-03-22 17:48:06, Rollback to remove file \Device\HarddiskVolume5\Sandbox\Likeabull\0test\user\current\Documents\psauoi.exe failed(0xc000003a)
2016-03-22 17:48:06, Rollback to remove directory \Device\HarddiskVolume5\Sandbox\Likeabull\0test\user\current\Documents failed(0xc000003a)
2016-03-22 17:48:06, Rollback to remove directory \Device\HarddiskVolume5\Sandbox\Likeabull\0test\user\current failed(0xc0000034)
2016-03-22 17:48:06, Rollback to remove and quarantine dropped file F:\test\6015.tmp.exe, quarantine failed.
2016-03-22 17:48:06, Rollback to remove file \Device\HarddiskVolume3\test\6015.tmp.exe failed(0xc0000034)
2016-03-22 17:48:06, Rollback to remove and quarantine dropped file F:\test\6015.tmp.exe, quarantine failed.
2016-03-22 17:48:06, 成功 结束进程 F:\test\6015.tmp.exe, 返回代码: 0
2016-03-22 17:48:06, End Rollback for F:\test\6015.tmp.exe
2016-03-22 17:48:06, 清除文件 F:\test\6015.tmp.exe. 云鉴定: 未鉴定, (成功清除) 备份返回代码: 4, 清除返回代码: -1
2016-03-22 17:48:06, MpApplyCaution Type: 21, Action: 1, Caution: 02503364, UpdatePromptStatus: 1, UpdateCautionStatus: 1
2016-03-22 17:48:10, MpApplyCaution Type: 21, Action: 4, Caution: 0595EF70, UpdatePromptStatus: 1, UpdateCautionStatus: 1
2016-03-22 17:48:15, MpApplyCaution Type: 21, Action: 4, Caution: 0595F1D2, UpdatePromptStatus: 1, UpdateCautionStatus: 1
2016-03-22 17:48:21, MpApplyCaution Type: 21, Action: 4, Caution: 0595EF70, UpdatePromptStatus: 1, UpdateCautionStatus: 1
2016-03-22 17:48:28, MpApplyCaution Type: 21, Action: 4, Caution: 0595EF70, UpdatePromptStatus: 1, UpdateCautionStatus: 1[/mw_shl_code]