搜索
楼主: 墨家小子
收起左侧

[可疑文件] 测试一下你的卡巴手动挡程序控制,看看能不能拦截到对explorer的操作

[复制链接]
学雷锋做人
发表于 2017-7-12 12:57:15 | 显示全部楼层
火绒对楼主的样本可以说基本没反应,已转交火绒方面处理
,就一个.
发表于 2017-7-12 14:26:23 | 显示全部楼层
墨家小子 发表于 2017-7-12 11:03
系统监控超级大变态

连SONAR都杀了....还超级大变态 真的好变态

我也来一个

AVA 25.13328
GD 25.9980

*** Process ***

Process: 8528
File name: 11398.exe
Path: d:\迅雷下载\11398.exe

Publisher: Unknown publisher
Creation date: 2017年7月12日 14:18:36
Modification date: 2017年7月12日 14:21:25

Started by: Explorer.EXE
Publisher: Microsoft Windows


*** Actions ***

The cloud server recognized this file and identified it as malicious.


*** Quarantine ***

The following files were moved into quarantine:
D:\迅雷下载\11398.exe

The following registry entries were deleted:


YHJyBy8nKCcoJganQicodIJiYnArJygnKCYGuXKS8CgnKScpJgbvcnJycmJicLqycVxjxnKycVxjxnJiYnCOcnIH9ygnCwA
Rules version: 5.0.148
OS: Windows 10.0 Service Pack 0.0 Build: 14393 - Workstation 64bit OS
dll version: 70613

"D:\迅雷下载\11398.exe"
MD5: 460F5ED9062ECA19FB7B571B520E2DCC
C:\Windows\explorer.exe /factory,ceff45ee-c862-41de-aee2-a022c81eda92 -Embedding
MD5: 679D17F8CDB938C7100D7A647953677E
,就一个.
发表于 2017-7-12 15:49:17 | 显示全部楼层

IDP说话了




本帖子中包含更多资源

您需要 登录 才可以下载或查看,没有帐号?快速注册

x
,就一个.
发表于 2017-7-12 18:38:49 | 显示全部楼层
狗狗

可疑文件: 11398.exe

风险: 高
路径: D:\迅雷下载\11398.exe

详细信息
•    11398.exe 程序试图修改敏感的系统资源。

修改的文件
•    C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\ITUNES.EXE (created)
•    C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MICROSOFT\WINDOWS\START MENU\PROGRAMS\STARTUP\ITUNES.VBS (created)
•    D:\迅雷下载\11398.exe

修改的注册表
•    \REGISTRY\USER\S-1-5-21-3791087008-2748381550-4144482455-500\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN:itunes (modified: old_value=, new_value ="C:\Users\Administrator\AppData\Roaming\itunes.exe"
•    \REGISTRY\USER\S-1-5-21-3791087008-2748381550-4144482455-500\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE:*itunes (modified: old_value=, new_value ="C:\Users\Administrator\AppData\Roaming\itunes.exe"

2017/7/12 18:37:48
skycai
发表于 2017-7-12 18:57:21 | 显示全部楼层
下载速度好慢~
skycai
发表于 2017-7-12 19:04:59 | 显示全部楼层
本帖最后由 skycai 于 2017-7-12 19:06 编辑
学雷锋做人 发表于 2017-7-12 12:57
火绒对楼主的样本可以说基本没反应,已转交火绒方面处理

应该是行为防御升级出来了。

本帖子中包含更多资源

您需要 登录 才可以下载或查看,没有帐号?快速注册

x
墨家小子
 楼主| 发表于 2017-7-12 19:33:46 | 显示全部楼层
,就一个. 发表于 2017-7-12 14:26
连SONAR都杀了....还超级大变态 真的好变态

我也来一个
The cloud server recognized this file and identified it as malicious.
,就一个.
发表于 2017-7-12 19:41:09 | 显示全部楼层

有任何异议?断网测试一样可以拦截 要不我马上重装一个给你证明?连 IDP都可以拦截 GD会不拦截?BB本来就是先云验证过了才触发本地..
,就一个.
发表于 2017-7-12 20:09:51 | 显示全部楼层

那么GD就再说一次话嘛

AVA 25.13331
GD 25.9983

*** Process ***

Process: 8672
File name: 11398.exe
Path: c:\users\administrator\desktop\11398.exe

Publisher: Unknown publisher

Started by: Explorer.EXE
Publisher: Microsoft Windows


*** Actions ***

The program is trying to create a startup item to launch a program automatically at system startup.
The program has created or manipulated an executable file.
An executable file was stored in a suspicious location.
A suspicious location is referenced in startup.
The program has started another program to delete itself.


*** Quarantine ***

The following files were moved into quarantine:
C:\Users\Administrator\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log
C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\startup\itunes.vbs
C:\Users\Administrator\AppData\Roaming\itunes.exe
C:\Users\Administrator\AppData\Roaming\tor\state
C:\Users\Administrator\Desktop\11398.exe

The following registry entries were deleted:

\registry\user\s-1-5-21-3791087008-2748381550-4144482455-500\software\microsoft\windows\currentversion\run || itunes
\registry\user\s-1-5-21-3791087008-2748381550-4144482455-500\software\microsoft\windows\currentversion\runonce || *itunes

YGLxlnIGLCcoJiYnCC0nKCYmJwguJyknJycI6HJyYmJycpArFm8pZ5AtJwnpcnJiYnJyoCwnJyYmJwfacnJiYnJysCknJyYmJwe7cnJiYnJysC0nJyYmJwf8cnJiYnJy0CgnJyYmJwd3KicHhyonJyYmJweHKycnJiYnB4csJycmJicHhy4nJyYmJweXJicnJycmBpcnJycmJicHlygnJycnJganKicnJiYnB6crGnk1ZiwoG8c1ZiwnGnk1ZiwHtycnJycnJgbHLycnJiYnB+coJwz3KScoJiYnCPcqJycmJicHaCknB7gvJyknJycI6ConCOgrJygmJicIAA
Rules version: 5.0.148
OS: Windows 10.0 Service Pack 0.0 Build: 14393 - Workstation 64bit OS
dll version: 70613

"C:\Users\Administrator\Desktop\11398.exe"
MD5: 460F5ED9062ECA19FB7B571B520E2DCC
C:\Windows\Explorer.EXE
MD5: 679D17F8CDB938C7100D7A647953677E
望雪浮
发表于 2017-7-13 10:35:13 | 显示全部楼层
这个东西安全么 用实机测试行不?
您需要登录后才可以回帖 登录 | 快速注册

本版积分规则

手机版|杀毒软件|软件论坛|优惠券| 卡饭论坛

Copyright © KaFan  KaFan.cn All Rights Reserved.

Powered by Discuz! X3.4( 苏ICP备07004770号 ) GMT+8, 2017-11-20 21:40 , Processed in 0.044906 second(s), 6 queries , MemCached On.

快速回复 返回顶部 返回列表