ursnif

csklho

Ir.exe VT: https://virustotal.com/en/file/17050331675b74d024c495c5d3b07f897a69dc340115c2e479d92c851c3b2bd1/analysis/
TrendMicro OfficeScan XG detected as TROJ_MSILKRYPT.ASUGH

shipment.doc VT: https://www.virustotal.com/en/file/4c1ff8b5226329b85e09c36f3cdec370dd42964950c548070799afdf61e3c7a4/analysis/
TrendMicro OfficeScan XG detected as W2KM_DLOADER.AUSUG

tianzhena

费尔双击

和泉纱雾

Dolby123

心醉咖啡

管家扫描miss

桑德尔

卡巴全灭

zst470396853

QQ

左手

2017-8-25 21:58:31    修改注册表值 危险等级:敏感    阻止
进程: c:\program files\winrar\winrar.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\AppData
值: C:\Documents and Settings\Administrator\Application Data
规则: [应用程序]?:\program files\*\*.exe -> [注册表组]阻止_优先黑名单

2017-8-25 21:58:58    创建文件夹 危险等级:低危    允许
进程: c:\documents and settings\administrator\桌面\ir.exe
目标: C:\Documents and Settings\Administrator\Application Data\atrapntw
规则: [应用程序]?:\*\*\*\* -> [文件]c:\documents and settings\*\application data\*

2017-8-25 21:58:58    修改注册表值 危险等级:敏感    阻止
进程: d:\program files\fscapture8.4_chs\fscapture.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\NetHood
值: C:\Documents and Settings\Administrator\NetHood
规则: [应用程序组]→a080_★★★【一般加至该组《常用的程序和游戏》】★★★ -> [注册表组]阻止_优先黑名单

2017-8-25 21:59:05    修改注册表值 危险等级:敏感    阻止
进程: c:\documents and settings\administrator\桌面\ir.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\asfetext
值: C:\Documents and Settings\Administrator\Application Data\atrapntw\alrseter.exe
规则: [应用程序组]a082_《行为防御》_自动运行 -> [应用程序]c:\documents and settings\*\* -> [注册表]*\SOFTWARE\Microsoft\Windows\CurrentVersion\Run*

ziyerain2015