帮忙测试下

显示全部楼层 · 发表于 2009-1-8 11:27:26

(Registry)2009.01.08 11:15:43 victim.exe ISOLATE on start from explorer.exe
2009.01.08 11:17:08 victim.exe ISOLATE on start from explorer.exe
2009.01.08 11:17:18 victim.exe READONLY access to HKLM\SOFTWARE\Microsoft\DownloadManager (Registry)2009.01.08 11:18:39 victim.exe DENY C0AC message to mmc.exe (Process)
2009.01.08 11:18:43 victim.exe DENY C0AE message to explorer.exe (Process)
2009.01.08 11:18:43 victim.exe DENY C0AE message to ctfmon.exe (Process)

[size=+1]Log Scope: Last 7 Days

Date/Time	Application	Action	Protocol	Source IP	Source Port	Destination IP	Destination Port
2009-1-8 11:18:08	C:\Documents and Settings\Owner\桌面\test\victim.exe	Blocked	UDP	[MyComputerIP]	1051	[OPENDNS]	53
2009-1-8 11:18:09	C:\Documents and Settings\Owner\桌面\test\victim.exe	Blocked	UDP	[MyComputerIP]	1051	[OPENDNS]	53
2009-1-8 11:18:13	C:\Documents and Settings\Owner\桌面\test\victim.exe	Blocked	UDP	[MyComputerIP]	1051	[OPENDNS]	53

[size=+1]End of The Report

[size=+1]Log Scope: All The Times

Date/Time	Application	Action	Target
2009-1-8 11:17:14	C:\Documents and Settings\Owner\桌面\test\victim.exe	Modify File	C:\Documents and Settings\Owner\桌面\test\victim.exe
2009-1-8 11:17:18	C:\Documents and Settings\Owner\桌面\test\victim.exe	Modify File	C:\Documents and Settings\Owner\桌面\test\victim.exe
2009-1-8 11:17:22	C:\Documents and Settings\Owner\桌面\test\victim.exe	Modify Key	HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\Directory
2009-1-8 11:17:24	C:\Documents and Settings\Owner\桌面\test\victim.exe	Modify Key	HKUS\S-1-5-21-839522115-706699826-2147053123-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cookies
2009-1-8 11:17:25	C:\Documents and Settings\Owner\桌面\test\victim.exe	Modify File	C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\index.dat
2009-1-8 11:17:27	C:\Documents and Settings\Owner\桌面\test\victim.exe	Modify File	C:\Documents and Settings\Owner\Local Settings\Temp\Temporary Internet Files\Content.IE5\index.dat
2009-1-8 11:17:29	C:\Documents and Settings\Owner\桌面\test\victim.exe	Modify Key	HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\Directory
2009-1-8 11:17:31	C:\Documents and Settings\Owner\桌面\test\victim.exe	Modify Key	HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1\CacheLimit
2009-1-8 11:17:33	C:\Documents and Settings\Owner\桌面\test\victim.exe	Modify File	C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\index.dat
2009-1-8 11:17:35	C:\Documents and Settings\Owner\桌面\test\victim.exe	Access COM Interface	\RPC Control\ntsvcs
2009-1-8 11:17:37	C:\Documents and Settings\Owner\桌面\test\victim.exe	Modify File	\Device\NamedPipe\lsarpc
2009-1-8 11:17:40	C:\Documents and Settings\Owner\桌面\test\victim.exe	Modify Key	HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Common AppData
2009-1-8 11:17:42	C:\Documents and Settings\Owner\桌面\test\victim.exe	Modify Key	HKUS\S-1-5-21-839522115-706699826-2147053123-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\AppData
2009-1-8 11:17:45	C:\Documents and Settings\Owner\桌面\test\victim.exe	Modify Key	HKUS\S-1-5-21-839522115-706699826-2147053123-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\MigrateProxy
2009-1-8 11:17:47	C:\Documents and Settings\Owner\桌面\test\victim.exe	Modify Key	HKUS\S-1-5-21-839522115-706699826-2147053123-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer
2009-1-8 11:17:51	C:\Documents and Settings\Owner\桌面\test\victim.exe	Modify Key	HKUS\S-1-5-21-839522115-706699826-2147053123-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL
2009-1-8 11:17:52	C:\Documents and Settings\Owner\桌面\test\victim.exe	Modify Key	HKLM\SYSTEM\ControlSet001\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings\ProxyEnable
2009-1-8 11:17:54	C:\Documents and Settings\Owner\桌面\test\victim.exe	Modify Key	HKUS\S-1-5-21-839522115-706699826-2147053123-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings
2009-1-8 11:17:56	C:\Documents and Settings\Owner\桌面\test\victim.exe	Modify Key	HKUS\S-1-5-21-839522115-706699826-2147053123-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass
2009-1-8 11:17:59	C:\Documents and Settings\Owner\桌面\test\victim.exe	Modify Key	HKUS\S-1-5-21-839522115-706699826-2147053123-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet
2009-1-8 11:18:02	C:\Documents and Settings\Owner\桌面\test\victim.exe	DNS/RPC Client Access	\RPC Control\DNSResolver
2009-1-8 11:18:05	C:\Documents and Settings\Owner\桌面\test\victim.exe	Modify File	\Device\WMIDataDevice
2009-1-8 11:18:20	C:\Documents and Settings\Owner\桌面\test\victim.exe	Modify File	\Device\NetBT_Tcpip_{XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX}

[size=+1]End of The Report

等了一会儿，无后续行为手动终止。

[ 本帖最后由星之梦于 2009-1-8 11:30 编辑 ]

显示全部楼层 · 发表于 2009-1-8 11:36:34

运行即出错，不知道是DEP拦了还是什么，没有DNS，SCM。

----------------------------
DEP关闭重起后有了
2009.01.08 11:51:24 7,.exe ISOLATE on start from explorer.exe
2009.01.08 11:51:24 7,.exe READONLY access to HKLM\SOFTWARE\Microsoft\DownloadManager (Registry)2009.01.08 11:52:32 7,.exe DENY C0AE message to explorer.exe (Process)
2009.01.08 11:52:32 7,.exe DENY C0AE message to ctfmon.exe (Process)

[size=+1]Log Scope: Last 7 Days

Date/Time	Application	Action	Protocol	Source IP	Source Port	Destination IP	Destination Port
2009-1-8 11:52:14	C:\Documents and Settings\Owner\桌面\test\样本.exe	Blocked	UDP	[MyComputerIP]	1028	[OpenDNS]	53
2009-1-8 11:52:16	C:\Documents and Settings\Owner\桌面\test\样本.exe	Blocked	UDP	[MyComputerIP]	1028	[OpenDNS]	53
2009-1-8 11:52:20	C:\Documents and Settings\Owner\桌面\test\样本.exe	Blocked	UDP	[MyComputerIP]	1028	[OpenDNS]	53

[size=+1]End of The Report

[size=+1]Log Scope: All The Times

Date/Time	Application	Action	Target
2009-1-8 11:51:25	C:\Documents and Settings\Owner\桌面\test\样本.exe	Modify Key	HKUS\S-1-5-21-839522115-706699826-2147053123-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cache
2009-1-8 11:51:27	C:\Documents and Settings\Owner\桌面\test\样本.exe	Modify Key	HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\Directory
2009-1-8 11:51:29	C:\Documents and Settings\Owner\桌面\test\样本.exe	Modify Key	HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1\CacheLimit
2009-1-8 11:51:31	C:\Documents and Settings\Owner\桌面\test\样本.exe	Modify File	C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\index.dat
2009-1-8 11:51:33	C:\Documents and Settings\Owner\桌面\test\样本.exe	Modify Key	HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1\CacheLimit
2009-1-8 11:51:35	C:\Documents and Settings\Owner\桌面\test\样本.exe	Modify Key	HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\Directory
2009-1-8 11:51:37	C:\Documents and Settings\Owner\桌面\test\样本.exe	Modify File	C:\Documents and Settings\Owner\Local Settings\Temp\Temporary Internet Files\Content.IE5\index.dat
2009-1-8 11:51:38	C:\Documents and Settings\Owner\桌面\test\样本.exe	Modify File	C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\index.dat
2009-1-8 11:51:41	C:\Documents and Settings\Owner\桌面\test\样本.exe	Access COM Interface	\RPC Control\ntsvcs
2009-1-8 11:51:43	C:\Documents and Settings\Owner\桌面\test\样本.exe	Modify Key	HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\Directory
2009-1-8 11:51:45	C:\Documents and Settings\Owner\桌面\test\样本.exe	Modify File	C:\Documents and Settings\Owner\Local Settings\Temp\Temporary Internet Files\Content.IE5\index.dat
2009-1-8 11:51:48	C:\Documents and Settings\Owner\桌面\test\样本.exe	Modify File	\Device\NamedPipe\lsarpc
2009-1-8 11:51:49	C:\Documents and Settings\Owner\桌面\test\样本.exe	Modify Key	HKUS\S-1-5-21-839522115-706699826-2147053123-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\AppData
2009-1-8 11:51:51	C:\Documents and Settings\Owner\桌面\test\样本.exe	Modify Key	HKUS\S-1-5-21-839522115-706699826-2147053123-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer
2009-1-8 11:51:53	C:\Documents and Settings\Owner\桌面\test\样本.exe	Modify Key	HKLM\SYSTEM\ControlSet001\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings\ProxyEnable
2009-1-8 11:51:55	C:\Documents and Settings\Owner\桌面\test\样本.exe	Modify Key	HKUS\S-1-5-21-839522115-706699826-2147053123-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass
2009-1-8 11:51:57	C:\Documents and Settings\Owner\桌面\test\样本.exe	Modify Key	HKUS\S-1-5-21-839522115-706699826-2147053123-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass
2009-1-8 11:51:59	C:\Documents and Settings\Owner\桌面\test\样本.exe	Modify Key	HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\Directory
2009-1-8 11:52:03	C:\Documents and Settings\Owner\桌面\test\样本.exe	Modify File	C:\Documents and Settings\Owner\Local Settings\Temp\Temporary Internet Files\Content.IE5\index.dat
2009-1-8 11:52:05	C:\Documents and Settings\Owner\桌面\test\样本.exe	Modify Key	HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\Directory
2009-1-8 11:52:07	C:\Documents and Settings\Owner\桌面\test\样本.exe	Modify Key	HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1\CacheLimit
2009-1-8 11:52:08	C:\Documents and Settings\Owner\桌面\test\样本.exe	Modify File	C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\index.dat
2009-1-8 11:52:10	C:\Documents and Settings\Owner\桌面\test\样本.exe	DNS/RPC Client Access	\RPC Control\DNSResolver
2009-1-8 11:52:12	C:\Documents and Settings\Owner\桌面\test\样本.exe	Modify File	\Device\WMIDataDevice

[size=+1]End of The Report

[ 本帖最后由星之梦于 2009-1-8 12:03 编辑 ]

显示全部楼层 · 发表于 2009-1-8 12:00:23

1.exe 过红伞（红伞今天刚更新过）：

但被蜘蛛查杀掉了：

[ 本帖最后由抓抓于 2009-1-8 13:33 编辑 ]

显示全部楼层 · 发表于 2009-1-8 12:13:43

可以确定那个样本.exe 可以被微软的DEP拦截
看来DEP开着没坏处。

显示全部楼层 · 发表于 2009-1-8 12:19:12

硬件DEP？

软件的还不如用CMF或CSS呢。

显示全部楼层 · 发表于 2009-1-8 12:23:15

我一起用，双重保护。

显示全部楼层 · 发表于 2009-1-8 12:28:12

001.exe
http://camas.comodo.com/cgi-bin/ ... c42a7bbb9c9573e87b3

启动、联网都会报可疑

日志：
获得SeDebug特权

Access COM Interface

LocalSecurityAuthority.Debug

文件：D:\ntdetect_.com

注册表：
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\NOHIDDEN\CheckedValue
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\NOHIDDEN\DefaultValue
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\CheckedValue
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\DefaultValue

1.exe
http://camas.comodo.com/cgi-bin/ ... d6abde89ed71f9ec58e

启发报可疑，主要是连 0.0.0.1，调用cmd.exe

Mouse.exe
http://camas.comodo.com/cgi-bin/ ... fe2c3507cdaf650068b

行为非常多

LocalSecurityAuthority.Debug

映像劫持
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KPFW32.exe
。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Wsyscheck.exe

写系统目录
C:\WINDOWS\system32\keepSafe.exe

启动项
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\run
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\run\TXMouie
HKUS\S-1-5-21-842925246-1343024091-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Run\dsfghjgj
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ilortgdg
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\cvhnykzx
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx\deryheruxc

Explorer Advanced
HKUS\S-1-5-21-842925246-1343024091-854245398-1003
\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Debugger
HKUS\S-1-5-21-842925246-1343024091-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Hidden

结束安全软件

Terminate Process

C:\Program Files\COMODO\COMODO Internet Security\cfp.exe

后面两个没什么大动作，允许联网后自己退出了

http://camas.comodo.com/cgi-bin/ ... e4f69c9c82d25a74a15

http://camas.comodo.com/cgi-bin/ ... 6072d1dd2a76c3851d1

[ 本帖最后由 ubuntu 于 2009-1-8 14:39 编辑 ]

显示全部楼层 · 发表于 2009-1-8 12:31:22

原帖由 星之梦 于 2009-1-8 12:13 发表
可以确定那个样本.exe 可以被微软的DEP拦截
看来DEP开着没坏处。

DEP我也是一直开启着的，为什么我的是由comodo先拦截的？

另外，可能不同的规则导致日志不太相同，，

比如某些管道设置会直接终止一些行为而使其后继行为终止运行，也就不会呈现在日志里。。。

[ 本帖最后由抓抓于 2009-1-8 13:00 编辑 ]

显示全部楼层 · 发表于 2009-1-8 12:39:23

是否軟硬之別?

显示全部楼层 · 发表于 2009-1-8 13:38:16

回复 18楼抓抓的帖子
嗯，看看CPU支持不支持？

我开启DEP，程序就直接出错，
关闭就有行为了，再开起还是运行就出错。

[讨论] 帮忙测试下

victim.exe

样本.exe

本帖子中包含更多资源

本帖子中包含更多资源

回复 14楼星之梦的帖子

回复 15楼 magiscoldeye 的帖子

本帖子中包含更多资源

回复 18楼抓抓的帖子

浏览过的版块

[讨论] 帮忙测试下

victim.exe

样本.exe

本帖子中包含更多资源

本帖子中包含更多资源

回复 14楼 星之梦 的帖子

回复 15楼 magiscoldeye 的帖子

本帖子中包含更多资源

回复 18楼 抓抓 的帖子

浏览过的版块

回复 14楼星之梦的帖子

回复 18楼抓抓的帖子