#Farfli (2023-06-20)

swizzer

https://t.wss.ink/f/bi2itpszaoz


ATC all.

LastF1ame_

卡巴扫描未提示

Hibike

Kaspersky 1x

另一个的衍生物迟迟下载不动

1. Name: PDM:Trojan.Win32.Generic
   
2. Threat level: High
   
3. Object type: Process
   
4. Object path: C:\Users\Public\WinZip
   
5. Object name: ypager.exe
   
6. MD5: 98EDE4F32BFC76F929D3880B6AACF588

复制代码

熊小度

腾讯 Miss

UNknownOoo

火绒
扫描：特征 1X

另一个扫描&双击MISS

swizzer

UNknownOoo 发表于 2023-6-20 21:58
火绒
扫描：特征 1X

另一个的衍生物过掉了火绒的特征吗

aikafans

avast kill 1
blocked 1

UNknownOoo

swizzer 发表于 2023-6-20 22:07
另一个的衍生物过掉了火绒的特征吗

是的

隔山打空气

S1
miss Wrangler.exe
kill Skyline.exe
呃，这俩文件名好眼熟。。。不会是根据BEST的HD机器学习引擎报毒名改的吧（

Exploitation

• Detected suspicious shellcode API call
  
• MITRE : Execution [T1106][T1059]
  

• Detected a shellcode that loads a DLL with socket APIs after process creation
  
• MITRE : Defense Evasion [T1055.001]
  
• ]MITRE : Privilege Escalation [T1055.001]
  

Persistence

• Detected persistency via scheduled task
  
• MITRE : Persistence [T1053.005]
• MITRE : Execution [T1053.005]
• MITRE : Privilege Escalation [T1053.005]
  

• Application registered itself to become persistent via scheduled task
• MITRE : Persistence [T1053.005]
• MITRE : Execution [T1053.005]
• MITRE : Privilege Escalation [T1053.005]
  

Injection

• Library was injected to a remote process
  
• MITRE : Defense Evasion [T1055]
• MITRE : Privilege Escalation [T1055]
  

Packer

• Process suspicious as packed
  
• MITRE : Defense Evasion [T1027][T1480.001]
  

Evasion

• Process started with a spoofed parent process
  
• MITRE : Defense Evasion [T1134.004]
• MITRE : Privilege Escalation [T1134.004]
  

swizzer

隔山打空气 发表于 2023-6-20 22:33
S1
miss Wrangler.exe
kill Skyline.exe

你猜的没错（当然HD并没有检出这两个文件）

改名的原因是原始文件名比较xx，所以本着整活的目的重命名了文件