伪压缩包程序让人防不胜防，非HIPS党不要双击运行！

z2665

又是这个东西。。。
• File Info

Name	Value
Size	128401
MD5	bef762f333fc2e6eb4efa09cfdb2d11b
SHA1	d78239b719c58dcc82624aaf529de016140ead7f
SHA256	7e87c5dac9d0a950b10452fcc79ec595a042e9752d9a8cc6cbd2210988256ee3
Process	Active

• Keys Created• Keys Changed• Keys Deleted• Values Created

Name	Type	Size	Value
CU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\shell	REG_SZ	94	"explorer.exe,C:\WINDOWS\system32\360WDtray.exe"
LM\System\CurrentControlSet\Control\Session Manager\PendingFileRenameOperations	REG_MULTI_SZ	198	"\??\C:\DOCUME~1\User\LOCALS~1\Temp\~nsu.tmp\Au_.exe"

• Values Changed• Values Deleted• Directories Created

Name	Last Write Time	Creation Time	Last Access Time	Attr
C:\Documents and Settings\User\Local Settings\Temp\~nsu.tmp	2009.01.12 15:12:48.859	2009.01.12 15:12:48.859	2009.01.12 15:12:48.859	0x10
C:\Documents and Settings\User\Local Settings\Temp\RarSFX0	2009.01.12 15:12:49.750	2009.01.12 15:12:46.718	2009.01.12 15:12:49.750	0x10

• Directories Changed• Directories Deleted• Files Created

Name	Size	Last Write Time	Creation Time	Last Access Time	Attr
C:\88642.txt	11	2009.01.12 15:12:54.796	2009.01.12 15:12:54.531	2009.01.12 15:12:54.531	0x20
C:\Documents and Settings\User\Local Settings\Temp\~nsu.tmp\Au_.exe	35356	2009.01.12 15:12:48.187	2009.01.12 15:12:48.859	2009.01.12 15:12:48.859	0x20
C:\Documents and Settings\User\Local Settings\Temp\RarSFX0\m.url	56	2010.01.01 08:45:01.612	2009.01.12 15:12:47.015	2009.01.12 15:12:47.015	0x20
C:\WINDOWS\system32\360WDtray.exe	16384	2009.12.31 15:31:58.000	2009.12.31 15:31:58.000	2009.01.12 15:12:47.921	0x20

• Files Changed• Files Deleted• Directories Hidden• Files Hidden• Drivers Loaded• Drivers Unloaded• Processes Created

PId	Process Name	Image Name
0x4ec	IEXPLORE.EXE	C:\Program Files\Internet Explorer\iexplore.exe
0x724	360WDtray.exe	C:\WINDOWS\system32\360WDtray.exe

• Processes Terminated• Threads Created

PId	Process Name	TId	Start	Start Mem	Win32 Start	Win32 Start Mem
0x2ac	lsass.exe	0x298	0x7c810856	MEM_IMAGE	0x77e76bf0	MEM_IMAGE
0x348	svchost.exe	0xf8	0x7c810856	MEM_IMAGE	0x7c910760	MEM_IMAGE
0x3f4	svchost.exe	0x67c	0x7c810856	MEM_IMAGE	0x77e76bf0	MEM_IMAGE
0x4ec	IEXPLORE.EXE	0x464	0x7c810867	MEM_IMAGE	0x402451	MEM_IMAGE
0x724	360WDtray.exe	0x610	0x7c810867	MEM_IMAGE	0x40a001	MEM_IMAGE

• Modules Loaded

PId	Process Name	Base	Size	Flags	Image Name
0x348	svchost.exe	0x76fd0000	0x7f000	0x800c4004	C:\WINDOWS\system32\CLBCATQ.DLL
0x348	svchost.exe	0x77050000	0xc5000	0x800c4006	C:\WINDOWS\system32\COMRes.dll
0x348	svchost.exe	0x77b40000	0x22000	0x800c4004	C:\WINDOWS\system32\Apphelp.dll

• Windows Api Calls• DNS Queries

DNS Query Text

www.666t.com IN A +

• HTTP Queries

HTTP Query Text

www.666t.com GET /index3.htm HTTP/1.1

• Verdict

Auto Analysis Verdict

Suspicious

• Description

Suspicious Actions Detected

Creates files in windows system directory

• Mutexes  Created or Opened

PId	Image Name	Address	Mutex Name
0x4ec	C:\Program Files\Internet Explorer\iexplore.exe	0x76ee3a34	RasPbFile
0x4ec	C:\Program Files\Internet Explorer\iexplore.exe	0x771ba3ae	_!MSFTHISTORY!_
0x4ec	C:\Program Files\Internet Explorer\iexplore.exe	0x771bc21c	WininetConnectionMutex
0x4ec	C:\Program Files\Internet Explorer\iexplore.exe	0x771bc23d	WininetProxyRegistryMutex
0x4ec	C:\Program Files\Internet Explorer\iexplore.exe	0x771bc2dd	WininetStartupMutex
0x4ec	C:\Program Files\Internet Explorer\iexplore.exe	0x771d9710	c:!documents and settings!user!cookies!
0x4ec	C:\Program Files\Internet Explorer\iexplore.exe	0x771d9710	c:!documents and settings!user!local settings!history!history.ie5!
0x4ec	C:\Program Files\Internet Explorer\iexplore.exe	0x771d9710	c:!documents and settings!user!local settings!temporary internet files!content.ie5!
0x4ec	C:\Program Files\Internet Explorer\iexplore.exe	0x777904d3	WininetStartupMutex
0x4ec	C:\Program Files\Internet Explorer\iexplore.exe	0x77f76e78	Shell.CMruPidlList
0x4ec	C:\Program Files\Internet Explorer\iexplore.exe	0x7c81a838	ShimCacheMutex
0x684	C:\TEST\sample.exe	0x77f76e78	_SHuassist.mtx
0x684	C:\TEST\sample.exe	0x7c81a838	ShimCacheMutex

• Events Created or Opened

PId	Image Name	Address	Event Name
0x4ec	C:\Program Files\Internet Explorer\iexplore.exe	0x769c4ec2	Global\userenv:  User Profile setup event
0x4ec	C:\Program Files\Internet Explorer\iexplore.exe	0x77de5f48	Global\SvcctrlStartEvent_A3752DX
0x684	C:\TEST\sample.exe	0x769c4ec2	Global\userenv:  User Profile setup event
0x684	C:\TEST\sample.exe	0x77a89422	Global\crypt32LogoffEvent
0x684	C:\TEST\sample.exe	0x7ca66917	ShellCopyEngineRunning
0x684	C:\TEST\sample.exe	0x7ca66957	ShellCopyEngineFinished
0x724	C:\WINDOWS\system32\360WDtray.exe	0x7473d2a8	CTF.ThreadMIConnectionEvent.00000628.00000000.00000005
0x724	C:\WINDOWS\system32\360WDtray.exe	0x7473d2a8	CTF.ThreadMarshalInterfaceEvent.00000628.00000000.00000005
0x724	C:\WINDOWS\system32\360WDtray.exe	0x7473d2a8	MSCTF.SendReceive.Event.ICG.IC
0x724	C:\WINDOWS\system32\360WDtray.exe	0x7473d2a8	MSCTF.SendReceiveConection.Event.ICG.IC

wsc47621

回報紅傘~

username

这是压缩包啊
不过是自解的＝ ＝
po几个关键的

2010-1-2 09:48:41    创建文件    允许
进程: d:\emule\病毒样本\2009142o0122210762\65642.exe
目标: C:\WINDOWS\system32\360WDtray.exe
规则: [文件组][A]所有执行文件_ -> [文件]*; *.exe

2010-1-2 09:48:54    修改注册表值    阻止
进程: d:\emule\病毒样本\2009142o0122210762\65642.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\shell
值: explorer.exe,C:\WINDOWS\system32\360WDtray.exe
规则: [注册表组]WinLogon -> [注册表]*\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon*

2010-1-2 09:49:26    创建文件    阻止
进程: c:\windows\system32\360wdtray.exe
目标: C:\网络赚钱宝典.url
规则: [文件组][A]系统关键文件_自订 -> [文件]?:\

2010-1-2 09:49:28    创建文件    阻止
进程: c:\windows\system32\360wdtray.exe
目标: C:\美女视频表演免费试看.url
规则: [文件组][A]系统关键文件_自订 -> [文件]?:\

humy123456

11楼天书~

星空下的吻

360 miss

hddu

费尔 miss

囧神

囧，过a-squared 扫描版~ 不过被马马屠准确拦截。

twtpy93123

过kis2010，主防提示，同意运行后弹出网页http://xxx.666t.com/index3.htm

tomofood

13楼正解,过红伞,但被 comodo拦截

aassddffgg961

NOD报警了