中秋快乐.exe

3245076553

https://share.weiyun.com/5Ze1lFu

www-tekeze

火绒、智量均不报，已上报智量。

dreams521

中秋快乐

Kaspersky用户

BDF扫描MISS

dg1vg4

卡巴斯基KIS2018 MISS

瑞星社区版扫描器 rdmk报法：

www-tekeze

www-tekeze 发表于 2018-9-25 20:40
火绒、智量均不报，已上报智量。

智量杀掉了衍生物，调用cmd，命令行重启系统，这和中秋快乐有啥关系，我还准备看歌舞片呢。。

cect258

关键行为
行为描述：        跨进程写入数据
详情信息：        
TargetProcess = C:\Windows\System32\cmd.exe, WriteAddress = 0x00050000, Size = 0x00000020 TargetPID = 0x00000438
TargetProcess = C:\Windows\System32\cmd.exe, WriteAddress = 0x00050020, Size = 0x00000034 TargetPID = 0x00000438
TargetProcess = C:\Windows\System32\cmd.exe, WriteAddress = 0x7ffd4238, Size = 0x00000004 TargetPID = 0x00000438
TargetProcess = C:\Windows\System32\cmd.exe, WriteAddress = 0x00050000, Size = 0x00000020 TargetPID = 0x00000b40
TargetProcess = C:\Windows\System32\cmd.exe, WriteAddress = 0x00050020, Size = 0x00000034 TargetPID = 0x00000b40
TargetProcess = C:\Windows\System32\cmd.exe, WriteAddress = 0x7ffdf238, Size = 0x00000004 TargetPID = 0x00000b40
TargetProcess = C:\Windows\System32\%temp%\****.exe, WriteAddress = 0x00040000, Size = 0x00000020 TargetPID = 0x00000c58
TargetProcess = C:\Windows\System32\%temp%\****.exe, WriteAddress = 0x00040020, Size = 0x00000034 TargetPID = 0x00000c58
TargetProcess = C:\Windows\System32\%temp%\****.exe, WriteAddress = 0x7ffdc238, Size = 0x00000004 TargetPID = 0x00000c58
行为描述：        直接获取CPU时钟
详情信息：        
EAX = 0xc8807d77, EDX = 0x0000039e
EAX = 0xc8807dc3, EDX = 0x0000039e
EAX = 0xcb337d3f, EDX = 0x0000039e
EAX = 0xcb337d8b, EDX = 0x0000039e
EAX = 0xeabf8458, EDX = 0x0000039e
EAX = 0xf7e820ae, EDX = 0x0000039e
EAX = 0x2f3d9052, EDX = 0x0000039f
EAX = 0x2f3d909e, EDX = 0x0000039f
EAX = 0x3f192c24, EDX = 0x0000039f
EAX = 0x3f192c70, EDX = 0x0000039f
行为描述：        获取TickCount值
详情信息：        
TickCount = 1110251, SleepMilliseconds = 1.
TickCount = 1110266, SleepMilliseconds = 1.
TickCount = 1110376, SleepMilliseconds = 1.
TickCount = 1110501, SleepMilliseconds = 1.
TickCount = 1110626, SleepMilliseconds = 1.
TickCount = 1110751, SleepMilliseconds = 1.
TickCount = 1110922, SleepMilliseconds = 1.
TickCount = 1111047, SleepMilliseconds = 1.
TickCount = 1111172, SleepMilliseconds = 1.
TickCount = 1111297, SleepMilliseconds = 1.
TickCount = 1111422, SleepMilliseconds = 1.
TickCount = 1111547, SleepMilliseconds = 1.
TickCount = 1111672, SleepMilliseconds = 1.
TickCount = 1111797, SleepMilliseconds = 1.
TickCount = 1111922, SleepMilliseconds = 1.

萧萧小

运行了一会，改桌面背景的时候BD ATD拦截

www-tekeze

www-tekeze 发表于 2018-9-25 20:50
智量杀掉了衍生物，调用cmd，命令行重启系统，这和中秋快乐有啥关系，我还准备看歌舞片呢。。

明白了，重启后把人家的桌面改了。。

dreams521

www-tekeze 发表于 2018-9-25 20:54
明白了，重启后把人家的桌面改了。。

篡改了时间没？