用Gmail作为联系方式的勒索

显示全部楼层 · 发表于 2019-5-19 11:15:35

安天智甲、管家无BD，均杀！

显示全部楼层 · 发表于 2019-5-19 11:23:56

www-tekeze 发表于 2019-5-19 11:13
智量Heur杀，待会双击。。

关闭绒智监控，实机双击，智量主防杀。。

显示全部楼层 · 发表于 2019-5-19 12:26:12

本帖最后由 jdsh 于 2019-5-19 22:16 编辑

WD miss

EMSI

2019/5/19 22:10:49 创建新进程允许
进程: c:\windows\explorer.exe
目标: c:\users\jdsh\downloads\77ce1103d7828a17dae5bab147176052fb238c561cf999b631b50561ea3f6659.exe
命令行: "C:\Users\jdsh\Downloads\77ce1103d7828a17dae5bab147176052fb238c561cf999b631b50561ea3f6659.exe"
规则: [应用程序]*

2019/5/19 22:10:56 创建文件夹允许
进程: c:\users\jdsh\downloads\77ce1103d7828a17dae5bab147176052fb238c561cf999b631b50561ea3f6659.exe
目标: C:\ProgramData\local
规则: [文件]*

2019/5/19 22:10:59 创建文件允许
进程: c:\users\jdsh\downloads\77ce1103d7828a17dae5bab147176052fb238c561cf999b631b50561ea3f6659.exe
目标: C:\ProgramData\local\.D0169387EB562C92B2D5
规则: [文件]*

2019/5/19 22:11:01 设置文件隐藏属性允许
进程: c:\users\jdsh\downloads\77ce1103d7828a17dae5bab147176052fb238c561cf999b631b50561ea3f6659.exe
目标: C:\ProgramData\local\.D0169387EB562C92B2D5
规则: [文件]*

2019/5/19 22:11:02 创建文件夹允许
进程: c:\users\jdsh\downloads\77ce1103d7828a17dae5bab147176052fb238c561cf999b631b50561ea3f6659.exe
目标: C:\ProgramData\share
规则: [文件]*

2019/5/19 22:11:04 创建文件允许
进程: c:\users\jdsh\downloads\77ce1103d7828a17dae5bab147176052fb238c561cf999b631b50561ea3f6659.exe
目标: C:\ProgramData\share\.D0169387EB562C92B2D5
规则: [文件]*

2019/5/19 22:11:05 设置文件隐藏属性允许
进程: c:\users\jdsh\downloads\77ce1103d7828a17dae5bab147176052fb238c561cf999b631b50561ea3f6659.exe
目标: C:\ProgramData\share\.D0169387EB562C92B2D5
规则: [文件]*

2019/5/19 22:11:18 创建注册表项 (2) 阻止
进程: c:\users\jdsh\downloads\77ce1103d7828a17dae5bab147176052fb238c561cf999b631b50561ea3f6659.exe
目标: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\HomeGroup
规则: [注册表组]系统设置 -> [注册表]HKEY_LOCAL_MACHINE\SOFTWARE\Policies\*

2019/5/19 22:11:26 修改注册表值阻止
进程: c:\users\jdsh\downloads\77ce1103d7828a17dae5bab147176052fb238c561cf999b631b50561ea3f6659.exe
目标: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware
值: 0x00000001(1)
规则: [注册表组]系统设置 -> [注册表]HKEY_LOCAL_MACHINE\SOFTWARE\Policies\*

2019/5/19 22:11:29 创建注册表项 (2) 阻止
进程: c:\users\jdsh\downloads\77ce1103d7828a17dae5bab147176052fb238c561cf999b631b50561ea3f6659.exe
目标: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Policy Manager
规则: [注册表组]系统设置 -> [注册表]HKEY_LOCAL_MACHINE\SOFTWARE\Policies\*

2019/5/19 22:11:34 修改注册表值阻止
进程: c:\users\jdsh\downloads\77ce1103d7828a17dae5bab147176052fb238c561cf999b631b50561ea3f6659.exe
目标: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring
值: 0x00000001(1)
规则: [注册表组]系统设置 -> [注册表]HKEY_LOCAL_MACHINE\SOFTWARE\Policies\*

2019/5/19 22:11:36 修改注册表值阻止
进程: c:\users\jdsh\downloads\77ce1103d7828a17dae5bab147176052fb238c561cf999b631b50561ea3f6659.exe
目标: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring
值: 0x00000001(1)
规则: [注册表组]系统设置 -> [注册表]HKEY_LOCAL_MACHINE\SOFTWARE\Policies\*

2019/5/19 22:11:39 修改注册表值阻止
进程: c:\users\jdsh\downloads\77ce1103d7828a17dae5bab147176052fb238c561cf999b631b50561ea3f6659.exe
目标: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection
值: 0x00000001(1)
规则: [注册表组]系统设置 -> [注册表]HKEY_LOCAL_MACHINE\SOFTWARE\Policies\*

2019/5/19 22:11:41 修改注册表值阻止
进程: c:\users\jdsh\downloads\77ce1103d7828a17dae5bab147176052fb238c561cf999b631b50561ea3f6659.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce\WindowsUpdateCheck
值: C:\Users\jdsh\Downloads\77ce1103d7828a17dae5bab147176052fb238c561cf999b631b50561ea3f6659.exe
规则: [注册表组]自动运行程序所在位置 -> [注册表]HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce\*

2019/5/19 22:11:48 创建新进程阻止
进程: c:\users\jdsh\downloads\77ce1103d7828a17dae5bab147176052fb238c561cf999b631b50561ea3f6659.exe
目标: c:\windows\system32\cmd.exe
命令行: C:\Windows\system32\cmd.exe /c @echo off
sc config browser
sc config browser start=enabled
vssadmin delete shadows /all /quiet
sc stop vss
sc config vss start=disabled
sc stop MongoDB
sc config MongoDB start=disabled
sc stop SQLWriter
sc config SQLWr
规则: [应用程序]*

2019/5/19 22:11:54 底层磁盘写操作阻止并结束进程
进程: c:\users\jdsh\downloads\77ce1103d7828a17dae5bab147176052fb238c561cf999b631b50561ea3f6659.exe
目标: \Device\MountPointManager
规则: [应用程序]*

[病毒样本] 用Gmail作为联系方式的勒索

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源