利用堆溢出攻击系统的病毒

bearhead001

好久没来样本区了，问一下，样本密码不是通用的virus吗？

LSPD

bearhead001 发表于 2020-3-23 10:46
好久没来样本区了，问一下，样本密码不是通用的virus吗？

是infected

IC9

关键行为
行为描述：        对比可疑进程名
详情信息：       
strcmp: 360safe.exe <------> Ollydbg.exe Des: 360安全卫士

strcmp: [System Process] <------> 360safe.exe Des: 360安全卫士

strcmp: System <------> 360safe.exe Des: 360安全卫士

strcmp: smss.exe <------> 360safe.exe Des: 360安全卫士

strcmp: csrss.exe <------> 360safe.exe Des: 360安全卫士

strcmp: winlogon.exe <------> 360safe.exe Des: 360安全卫士

strcmp: services.exe <------> 360safe.exe Des: 360安全卫士

strcmp: lsass.exe <------> 360safe.exe Des: 360安全卫士

strcmp: CYmxService.exe <------> 360safe.exe Des: 360安全卫士

strcmp: ipycthlp.exe <------> 360safe.exe Des: 360安全卫士

strcmp: svchost.exe <------> 360safe.exe Des: 360安全卫士

strcmp: spoolsv.exe <------> 360safe.exe Des: 360安全卫士

strcmp: jqs.exe <------> 360safe.exe Des: 360安全卫士

strcmp: CJMpgradeHelper.exe <------> 360safe.exe Des: 360安全卫士

strcmp: alg.exe <------> 360safe.exe Des: 360安全卫士

行为描述：        查找指定内核模块
详情信息：       
strcmp: Procmon64.exe <------> regedit.exe Des: procmon

strcmp: Procmon.exe <------> regedit.exe Des: procmon

strcmp: Procmon64.exe <------> PEID.exe Des: procmon

strcmp: Procmon.exe <------> PEID.exe Des: procmon

strcmp: [System Process] <------> Procmon.exe Des: procmon

strcmp: System <------> Procmon.exe Des: procmon

strcmp: smss.exe <------> Procmon.exe Des: procmon

strcmp: csrss.exe <------> Procmon.exe Des: procmon

strcmp: winlogon.exe <------> Procmon.exe Des: procmon

strcmp: services.exe <------> Procmon.exe Des: procmon

strcmp: lsass.exe <------> Procmon.exe Des: procmon

strcmp: TTjxService.exe <------> Procmon.exe Des: procmon

strcmp: zkvcthlp.exe <------> Procmon.exe Des: procmon

strcmp: svchost.exe <------> Procmon.exe Des: procmon

strcmp: spoolsv.exe <------> Procmon.exe Des: procmon

行为描述：        在桌面创建文件
详情信息：       
C:\Documents and Settings\Administrator\桌面\destroy_38.exe

C:\Documents and Settings\Administrator\桌面\destroy_7719.exe

C:\Documents and Settings\Administrator\桌面\destroy_21238.exe

C:\Documents and Settings\Administrator\桌面\destroy_2437.exe

C:\Documents and Settings\Administrator\桌面\destroy_8855.exe

C:\Documents and Settings\Administrator\桌面\destroy_11797.exe

C:\Documents and Settings\Administrator\桌面\destroy_8365.exe

C:\Documents and Settings\Administrator\桌面\destroy_32285.exe

C:\Documents and Settings\Administrator\桌面\destroy_10450.exe

C:\Documents and Settings\Administrator\桌面\destroy_30612.exe

C:\Documents and Settings\Administrator\桌面\destroy_5853.exe

C:\Documents and Settings\Administrator\桌面\destroy_28100.exe

C:\Documents and Settings\Administrator\桌面\destroy_1142.exe

C:\Documents and Settings\Administrator\桌面\destroy_281.exe

C:\Documents and Settings\Administrator\桌面\destroy_20537.exe

行为描述：        杀掉进程
详情信息：       
C:\WINDOWS\system32\taskmgr.exe

C:\WINDOWS\system32\Procmon.exe

C:\WINDOWS\system32\Procmon64.exe

C:\WINDOWS\system32\Autoruns.exe

C:\WINDOWS\system32\360safe.exe

C:\WINDOWS\system32\ida.exe

bearhead001

LSPD 发表于 2020-3-23 10:46
是infected

好的，谢谢

lifan88

IC9 发表于 2020-3-23 14:04
关键行为
行为描述：        对比可疑进程名
详情信息：       

看到进程，老取证了VM-win10x64-1709重复不出来