测试一下你的卡巴手动挡程序控制，看看能不能拦截到对explorer的操作

学雷锋做人

火绒对楼主的样本可以说基本没反应，已转交火绒方面处理

，就一个.

墨家小子 发表于 2017-7-12 11:03
系统监控超级大变态

连SONAR都杀了....还超级大变态 真的好变态

我也来一个

AVA 25.13328
GD 25.9980

*** Process ***

Process: 8528
File name: 11398.exe
Path: d:\迅雷下载\11398.exe

Publisher: Unknown publisher
Creation date: 2017年7月12日 14:18:36
Modification date: 2017年7月12日 14:21:25

Started by: Explorer.EXE
Publisher: Microsoft Windows


*** Actions ***

The cloud server recognized this file and identified it as malicious.


*** Quarantine ***

The following files were moved into quarantine:
D:\迅雷下载\11398.exe

The following registry entries were deleted:


YHJyBy8nKCcoJganQicodIJiYnArJygnKCYGuXKS8CgnKScpJgbvcnJycmJicLqycVxjxnKycVxjxnJiYnCOcnIH9ygnCwA
Rules version: 5.0.148
OS: Windows 10.0 Service Pack 0.0 Build: 14393 - Workstation 64bit OS
dll version: 70613

"D:\迅雷下载\11398.exe"
MD5: 460F5ED9062ECA19FB7B571B520E2DCC
C:\Windows\explorer.exe /factory,ceff45ee-c862-41de-aee2-a022c81eda92 -Embedding
MD5: 679D17F8CDB938C7100D7A647953677E

，就一个.

IDP说话了

，就一个.

狗狗

可疑文件： 11398.exe

风险： 高
路径： D:\迅雷下载\11398.exe

详细信息
•    11398.exe 程序试图修改敏感的系统资源。

修改的文件
•    C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\ITUNES.EXE (created)
•    C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MICROSOFT\WINDOWS\START MENU\PROGRAMS\STARTUP\ITUNES.VBS (created)
•    D:\迅雷下载\11398.exe

修改的注册表
•    \REGISTRY\USER\S-1-5-21-3791087008-2748381550-4144482455-500\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN:itunes (modified: old_value=, new_value ="C:\Users\Administrator\AppData\Roaming\itunes.exe"
•    \REGISTRY\USER\S-1-5-21-3791087008-2748381550-4144482455-500\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE:*itunes (modified: old_value=, new_value ="C:\Users\Administrator\AppData\Roaming\itunes.exe"

2017/7/12 18:37:48

skycai

下载速度好慢~

skycai

学雷锋做人 发表于 2017-7-12 12:57
火绒对楼主的样本可以说基本没反应，已转交火绒方面处理

应该是行为防御升级出来了。

墨家小子

，就一个. 发表于 2017-7-12 14:26
连SONAR都杀了....还超级大变态 真的好变态

我也来一个

The cloud server recognized this file and identified it as malicious.

，就一个.

墨家小子 发表于 2017-7-12 19:33

有任何异议？断网测试一样可以拦截 要不我马上重装一个给你证明？连 IDP都可以拦截 GD会不拦截？BB本来就是先云验证过了才触发本地..

，就一个.

墨家小子 发表于 2017-7-12 19:33

那么GD就再说一次话嘛

AVA 25.13331
GD 25.9983

*** Process ***

Process: 8672
File name: 11398.exe
Path: c:\users\administrator\desktop\11398.exe

Publisher: Unknown publisher

Started by: Explorer.EXE
Publisher: Microsoft Windows


*** Actions ***

The program is trying to create a startup item to launch a program automatically at system startup.
The program has created or manipulated an executable file.
An executable file was stored in a suspicious location.
A suspicious location is referenced in startup.
The program has started another program to delete itself.


*** Quarantine ***

The following files were moved into quarantine:
C:\Users\Administrator\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log
C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\startup\itunes.vbs
C:\Users\Administrator\AppData\Roaming\itunes.exe
C:\Users\Administrator\AppData\Roaming\tor\state
C:\Users\Administrator\Desktop\11398.exe

The following registry entries were deleted:

\registry\user\s-1-5-21-3791087008-2748381550-4144482455-500\software\microsoft\windows\currentversion\run || itunes
\registry\user\s-1-5-21-3791087008-2748381550-4144482455-500\software\microsoft\windows\currentversion\runonce || *itunes

YGLxlnIGLCcoJiYnCC0nKCYmJwguJyknJycI6HJyYmJycpArFm8pZ5AtJwnpcnJiYnJyoCwnJyYmJwfacnJiYnJysCknJyYmJwe7cnJiYnJysC0nJyYmJwf8cnJiYnJy0CgnJyYmJwd3KicHhyonJyYmJweHKycnJiYnB4csJycmJicHhy4nJyYmJweXJicnJycmBpcnJycmJicHlygnJycnJganKicnJiYnB6crGnk1ZiwoG8c1ZiwnGnk1ZiwHtycnJycnJgbHLycnJiYnB+coJwz3KScoJiYnCPcqJycmJicHaCknB7gvJyknJycI6ConCOgrJygmJicIAA
Rules version: 5.0.148
OS: Windows 10.0 Service Pack 0.0 Build: 14393 - Workstation 64bit OS
dll version: 70613

"C:\Users\Administrator\Desktop\11398.exe"
MD5: 460F5ED9062ECA19FB7B571B520E2DCC
C:\Windows\Explorer.EXE
MD5: 679D17F8CDB938C7100D7A647953677E

望雪浮

这个东西安全么 用实机测试行不？