样本一枚

心醉咖啡

管家扫描miss

侠盗猎车333

谢谢了，用虚拟机试试

毛可多来

个人认为风险很大
基本信息

文件名称：	netpubloader.exe
MD5：	1e59ec05cddd6d44d149576f95e8f774
文件类型：	EXE
上传时间：	2018-02-18 10:10:36
出品公司：	厦门粉酷网络科技有限公司
版本：	2.0.0.6---2.0.0.6
壳或编译器信息：	PACKER:UPX 0.89.6 - 1.02 / 1.05 - 1.24 -> Markus & Laszlo
子文件信息：	upx_c_39746617dumpFile /  301637d104294f10102acfff359a4f76 /  EXE

关键行为

行为描述：	设置特殊文件夹属性
详情信息：	C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5 C:\Documents and Settings\Administrator\Local Settings\History C:\Documents and Settings\Administrator\Local Settings\History\History.IE5 C:\Documents and Settings\Administrator\Cookies
行为描述：	修改注册表_启动项
详情信息：	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\DominoLoader

进程行为

行为描述：

创建本地线程

详情信息：

TargetProcess: %temp%\****.exe, InheritedFromPID = 2000, ProcessID = 2776, ThreadID = 2812, StartAddress = 77DC845A, Parameter = 00000000 TargetProcess: %temp%\****.exe, InheritedFromPID = 2000, ProcessID = 2776, ThreadID = 2840, StartAddress = 7C947EBB, Parameter = 00000000 TargetProcess: %temp%\****.exe, InheritedFromPID = 2000, ProcessID = 2776, ThreadID = 2844, StartAddress = 7C930230, Parameter = 00000000 TargetProcess: %temp%\****.exe, InheritedFromPID = 2000, ProcessID = 2776, ThreadID = 2904, StartAddress = 00531F66, Parameter = 00FB73E8 TargetProcess: %temp%\****.exe, InheritedFromPID = 2000, ProcessID = 2776, ThreadID = 2908, StartAddress = 00531F66, Parameter = 00FB7D70 TargetProcess: %temp%\****.exe, InheritedFromPID = 2000, ProcessID = 2776, ThreadID = 2912, StartAddress = 00531F66, Parameter = 00FB9CD8 TargetProcess: %temp%\****.exe, InheritedFromPID = 2000, ProcessID = 2776, ThreadID = 2916, StartAddress = 719CD33A, Parameter = 001A2AB0

文件行为

行为描述：	创建文件
详情信息：	C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C1OS62RY\check_upgrade[1] C:\Documents and Settings\Administrator\Local Settings\Temp.Hp2776
行为描述：	设置特殊文件夹属性
详情信息：	C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5 C:\Documents and Settings\Administrator\Local Settings\History C:\Documents and Settings\Administrator\Local Settings\History\History.IE5 C:\Documents and Settings\Administrator\Cookies
行为描述：	删除文件
详情信息：	C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C1OS62RY\check_upgrade[1]
行为描述：	查找文件
详情信息：	FileName = C:\Documents and Settings FileName = C:\Documents and Settings\Administrator FileName = C:\Documents and Settings\Administrator\Local Settings FileName = C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Connections\Pbk\*.pbk FileName = C:\WINDOWS\system32\Ras\*.pbk FileName = C:\Documents and Settings\Administrator\Application Data\Microsoft\Network\Connections\Pbk\*.pbk FileName = C:\DOCUME~1 FileName = C:\DOCUME~1\ADMINI~1 FileName = C:\DOCUME~1\ADMINI~1\LOCALS~1 FileName = C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp

网络行为

行为描述：	联网打开网址
详情信息：	InternetOpenUrlA: http://se****om/check_upgrade?mac=7B-*-*-*-*-28&code=tgmhc25818&file=%temp%\****.exe&ver=2.0.0.6&productVer=2.0.0.6&filetime=2017%2F04%2F10-17%3A59, hInternet = 0x00cc0004, Flags = 0x00000000
行为描述：	连接指定站点
详情信息：	InternetConnectA: ServerName = se****om, PORT = 80, UserName = , Password = , hSession = 0x00cc0004, hConnect = 0x00cc0008, Flags = 0x00000000
行为描述：	打开HTTP连接
详情信息：	InternetOpenA: UserAgent: tszAgent, hSession = 0x00cc0004
行为描述：	建立到一个指定的套接字连接
详情信息：	URL: se****om, IP: **.133.40.**:80, SOCKET = 0x00000250 URL: se****om, IP: **.133.40.**:80, SOCKET = 0x00000254 URL: se****om, IP: **.133.40.**:80, SOCKET = 0x0000029c
行为描述：	发送HTTP包
详情信息：	GET /check_upgrade?mac=7B-*-*-*-*-28&code=tgmhc25818&file=%temp%\****.exe&ver=2.0.0.6&productVer=2.0.0.6&filetime=2017%2F04%2F10-17%3A59 HTTP/1.1 User-Agent: tszAgent Host: se****om GET /server/config HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: zh-CN,en,* User-Agent: Mozilla/5.0 Host: se****om
行为描述：	打开HTTP请求
详情信息：	HttpOpenRequestA: se****om:80/check_upgrade?mac=7B-*-*-*-*-28&code=tgmhc25818&file=%temp%\****.exe&ver=2.0.0.6&productver=2.0.0.6&filetime=2017%2f04%2f10-17%3a59, hConnect = 0x00cc0008, hRequest = 0x00cc000c, Verb: GET, Referer: , Flags = 0x00000000
行为描述：	按名称获取主机地址
详情信息：	GetAddrInfoW: se****om

注册表行为

行为描述：	修改注册表
详情信息：	\REGISTRY\USER\S-*\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings
行为描述：	删除注册表键值
详情信息：	\REGISTRY\USER\S-*\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer \REGISTRY\USER\S-*\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyOverride \REGISTRY\USER\S-*\Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL
行为描述：	修改注册表_启动项
详情信息：	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\DominoLoader

其他行为

行为描述：	打开互斥体
详情信息：	Local\_!MSFTHISTORY!_ Local\c:!documents and settings!administrator!local settings!temporary internet files!content.ie5! Local\c:!documents and settings!administrator!cookies! Local\c:!documents and settings!administrator!local settings!history!history.ie5! Local\WininetStartupMutex Local\WininetConnectionMutex Local\WininetProxyRegistryMutex RasPbFile Local\!IETld!Mutex DBWinMutex
行为描述：	创建互斥体
详情信息：	tgmhc25818DAED29E6-2962-4A7A-96E8-741C30103EA5 RasPbFile Local\ZonesCounterMutex Local\ZoneAttributeCacheCounterMutex Local\ZonesCacheCounterMutex Local\ZonesLockedCacheCounterMutex CTF.LBES.MutexDefaultS-* CTF.Compart.MutexDefaultS-* CTF.Asm.MutexDefaultS-* CTF.Layouts.MutexDefaultS-* CTF.TMD.MutexDefaultS-* CTF.TimListCache.FMPDefaultS-*MUTEX.DefaultS-*
行为描述：	创建事件对象
详情信息：	EventName = DINPUTWINMM EventName = Global\userenv: User Profile setup event
行为描述：	打开事件
详情信息：	HookSwitchHookEnabledEvent \SECURITY\LSA_AUTHENTICATION_INITIALIZED Global\SvcctrlStartEvent_A3752DX \INSTALLATION_SECURITY_HOLD

文件分析图谱(PortEx)