| 行为分析报告: 微步文件行为分析报告 |
| 基本信息 | |
|---|---|
| MD5: | 6226d4dfa294380d25c6b70aa6e4bad5 |
| 文件类型: | EXE |
| 出品公司: | |
| 版本: | 1.0.0.0---1.0.0.0 |
| 壳或编译器信息: | PACKER:UPX 0.89.6 - 1.02 / 1.05 - 1.24 -> Markus & Laszlo [Overlay] |
| 子文件信息: | upx_c_6faa115bdumpFile / 1820423f3d01a183664480d24de0d325 / EXE |
| Chew-WGA.0.9.exe / big file / EXE | |
| hao123安全导航.HTML / 50ee6af67b32c5238a465e7daa27b5b8 / Unknown | |
| 关键行为 | |
|---|---|
| 行为描述: | 获取窗口截图信息 |
| 详细信息: | Foreground window Info: HWND = 0x00000000, DC = 0xbd010577. |
| Foreground window Info: HWND = 0x00000000, DC = 0xfd010632. | |
| Foreground window Info: HWND = 0x00000000, DC = 0xa3010516. | |
| Foreground window Info: HWND = 0x00000000, DC = 0x9a0101dc. | |
| Foreground window Info: HWND = 0x00000000, DC = 0x1d010509. | |
| Foreground window Info: HWND = 0x00000000, DC = 0x9e01051d. | |
| Foreground window Info: HWND = 0x00000000, DC = 0xb4010187. | |
| Foreground window Info: HWND = 0x00000000, DC = 0xce0104f2. | |
| Foreground window Info: HWND = 0x00000000, DC = 0x6601064e. | |
| Foreground window Info: HWND = 0x00000000, DC = 0x6a01064e. | |
| Foreground window Info: HWND = 0x00000000, DC = 0xda0104f2. | |
| Foreground window Info: HWND = 0x00000000, DC = 0xdb0104f2. | |
| Foreground window Info: HWND = 0x00000000, DC = 0xac010685. | |
| Foreground window Info: HWND = 0x00000000, DC = 0x040106de. | |
| Foreground window Info: HWND = 0x00000000, DC = 0x080106da. | |
| 进程行为 | |
|---|---|
| 行为描述: | 创建新文件进程 |
| 详细信息: | ImagePath = C:\Program Files\Chew-WGA.0.9.exe, CmdLine = "C:\Program Files\Chew-WGA.0.9.exe" |
| ImagePath = C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\ir_ext_temp_0\autorun.exe, CmdLine = "C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\ir_ext_temp_0\autorun.exe" "SFXSOURCE:C:\Program Files\Chew-WGA.0.9.exe" | |
| 行为描述: | 创建本地线程 |
| 详细信息: | TargetProcess: %temp%\****.exe, InheritedFromPID = 1944, ProcessID = 2524, ThreadID = 2600, StartAddress = 00401460, Parameter = 009981B0 |
| TargetProcess: %temp%\****.exe, InheritedFromPID = 1944, ProcessID = 2524, ThreadID = 2604, StartAddress = 77C0A341, Parameter = 00D58298 | |
| TargetProcess: %temp%\****.exe, InheritedFromPID = 1944, ProcessID = 2524, ThreadID = 2608, StartAddress = 77C0A341, Parameter = 00D58328 | |
| TargetProcess: %temp%\****.exe, InheritedFromPID = 1944, ProcessID = 2524, ThreadID = 2612, StartAddress = 77C0A341, Parameter = 00D58298 | |
| TargetProcess: %temp%\****.exe, InheritedFromPID = 1944, ProcessID = 2524, ThreadID = 2664, StartAddress = 77DC845A, Parameter = 00000000 | |
| TargetProcess: autorun.exe, InheritedFromPID = 2668, ProcessID = 2840, ThreadID = 2916, StartAddress = 5FE01259, Parameter = 00000000 | |
| 文件行为 | |
|---|---|
| 行为描述: | 创建文件 |
| 详细信息: | C:\Program Files\hao123安全导航.HTML |
| C:\Program Files\Chew-WGA.0.9.exe | |
| C:\Documents and Settings\Administrator\Local Settings\Temp\ir_ext_temp_0\AutoPlay\Audio\Click1.ogg | |
| C:\Documents and Settings\Administrator\Local Settings\Temp\ir_ext_temp_0\AutoPlay\Audio\High1.ogg | |
| C:\Documents and Settings\Administrator\Local Settings\Temp\ir_ext_temp_0\AutoPlay\Audio\Shekere.ogg | |
| C:\Documents and Settings\Administrator\Local Settings\Temp\ir_ext_temp_0\AutoPlay\autorun.cdd | |
| C:\Documents and Settings\Administrator\Local Settings\Temp\ir_ext_temp_0\AutoPlay\Buttons\Baslat.Btn | |
| C:\Documents and Settings\Administrator\Local Settings\Temp\ir_ext_temp_0\AutoPlay\Buttons\button.btn | |
| C:\Documents and Settings\Administrator\Local Settings\Temp\ir_ext_temp_0\AutoPlay\Buttons\Cik11.Btn | |
| C:\Documents and Settings\Administrator\Local Settings\Temp\ir_ext_temp_0\AutoPlay\Buttons\Cik-2.Btn | |
| C:\Documents and Settings\Administrator\Local Settings\Temp\ir_ext_temp_0\AutoPlay\Buttons\Home2.Btn | |
| C:\Documents and Settings\Administrator\Local Settings\Temp\ir_ext_temp_0\AutoPlay\Buttons\Sol-4.Btn | |
| C:\Documents and Settings\Administrator\Local Settings\Temp\ir_ext_temp_0\AutoPlay\Icons\mainicon.ico | |
| C:\Documents and Settings\Administrator\Local Settings\Temp\ir_ext_temp_0\AutoPlay\Images\credits-screen.jpg | |
| C:\Documents and Settings\Administrator\Local Settings\Temp\ir_ext_temp_0\AutoPlay\Images\done-install.jpg | |
| 行为描述: | 创建可执行文件 |
| 详细信息: | C:\Program Files\Chew-WGA.0.9.exe |
| C:\Documents and Settings\Administrator\Local Settings\Temp\ir_ext_temp_0\AutoPlay\Plugins\IRDissolveTransition.tns | |
| C:\Documents and Settings\Administrator\Local Settings\Temp\ir_ext_temp_0\autorun.exe | |
| 行为描述: | 修改文件内容 |
| 详细信息: | C:\Program Files\hao123安全导航.HTML ---> Offset = 0 |
| C:\Program Files\Chew-WGA.0.9.exe ---> Offset = 0 | |
| C:\Program Files\Chew-WGA.0.9.exe ---> Offset = 65536 | |
| C:\Program Files\Chew-WGA.0.9.exe ---> Offset = 131072 | |
| C:\Program Files\Chew-WGA.0.9.exe ---> Offset = 196608 | |
| C:\Program Files\Chew-WGA.0.9.exe ---> Offset = 262144 | |
| C:\Documents and Settings\Administrator\Local Settings\Temp\ir_ext_temp_0\AutoPlay\Audio\Click1.ogg ---> Offset = 0 | |
| C:\Documents and Settings\Administrator\Local Settings\Temp\ir_ext_temp_0\AutoPlay\Audio\High1.ogg ---> Offset = 0 | |
| C:\Documents and Settings\Administrator\Local Settings\Temp\ir_ext_temp_0\AutoPlay\Audio\Shekere.ogg ---> Offset = 0 | |
| C:\Documents and Settings\Administrator\Local Settings\Temp\ir_ext_temp_0\AutoPlay\autorun.cdd ---> Offset = 0 | |
| C:\Documents and Settings\Administrator\Local Settings\Temp\ir_ext_temp_0\AutoPlay\autorun.cdd ---> Offset = 65536 | |
| C:\Documents and Settings\Administrator\Local Settings\Temp\ir_ext_temp_0\AutoPlay\autorun.cdd ---> Offset = 131072 | |
| C:\Documents and Settings\Administrator\Local Settings\Temp\ir_ext_temp_0\AutoPlay\autorun.cdd ---> Offset = 196608 | |
| C:\Documents and Settings\Administrator\Local Settings\Temp\ir_ext_temp_0\AutoPlay\autorun.cdd ---> Offset = 262144 | |
| C:\Documents and Settings\Administrator\Local Settings\Temp\ir_ext_temp_0\AutoPlay\Buttons\Baslat.Btn ---> Offset = 0 | |
| 行为描述: | 查找文件 |
| 详细信息: | FileName = C:\WINDOWS |
| FileName = C:\WINDOWS\system32 | |
| FileName = C:\Program Files | |
| FileName = C:\Program Files\Chew-WGA.0.9.exe | |
| FileName = C:\DOCUME~1 | |
| FileName = C:\DOCUME~1\ADMINI~1 | |
| FileName = C:\DOCUME~1\ADMINI~1\LOCALS~1 | |
| FileName = C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp | |
| FileName = C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\ir_ext_temp_0\autorun.exe | |
| FileName = C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\ir_ext_temp_0\AutoPlay\autorun.cdd | |
| FileName = C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\ir_ext_temp_0\AutoPlay\Plugins\* | |
| FileName = C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\ir_ext_temp_0\AutoPlay\Plugins\*.tns | |
| FileName = C:\Documents and Settings | |
| FileName = C:\Documents and Settings\All Users | |
| FileName = C:\Documents and Settings\All Users\桌面 | |
| 网络行为 | |
|---|---|
| 行为描述: | 按名称获取主机地址 |
| 详细信息: | gethostbyname: computer |
| 注册表行为 | |
|---|---|
| 行为描述: | 修改注册表 |
| 详细信息: | \REGISTRY\USER\S-*\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\Program Files\Chew-WGA.0.9.exe |
| 其他行为 | |
|---|---|
| 行为描述: | 创建互斥体 |
| 详细信息: | CTF.LBES.MutexDefaultS-* |
| CTF.Compart.MutexDefaultS-* | |
| CTF.Asm.MutexDefaultS-* | |
| CTF.Layouts.MutexDefaultS-* | |
| CTF.TMD.MutexDefaultS-* | |
| CTF.TimListCache.FMPDefaultS-*MUTEX.DefaultS-* | |
| MSCTF.Shared.MUTEX.ELH | |
| Local\ZonesCounterMutex | |
| Local\ZoneAttributeCacheCounterMutex | |
| Local\ZonesCacheCounterMutex | |
| Local\ZonesLockedCacheCounterMutex | |
| MSCTF.Shared.MUTEX.AHK | |
| DirectSound DllMain mutex (0x00000B18) | |
| DirectSound Administrator shared thread array (lock) | |
| 行为描述: | 创建事件对象 |
| 详细信息: | EventName = Global\userenv: User Profile setup event |
| EventName = MSCTF.SendReceive.Event.AHK.IC | |
| EventName = MSCTF.SendReceiveConection.Event.AHK.IC | |
| EventName = DINPUTWINMM | |
| EventName = Global\crypt32LogoffEvent | |
| 行为描述: | 查找指定窗口 |
| 详细信息: | NtUserFindWindowEx: [Class,Window] = [Shell_TrayWnd,] |
| NtUserFindWindowEx: [Class,Window] = [CicLoaderWndClass,] | |
| 行为描述: | 打开事件 |
| 详细信息: | HookSwitchHookEnabledEvent |
| _fCanRegisterWithShellService | |
| CTF.ThreadMIConnectionEvent.000007B4.00000000.00000051 | |
| CTF.ThreadMarshalInterfaceEvent.000007B4.00000000.00000051 | |
| MSCTF.SendReceiveConection.Event.ELH.IC | |
| MSCTF.SendReceive.Event.ELH.IC | |
| \SECURITY\LSA_AUTHENTICATION_INITIALIZED | |
| CTF.ThreadMIConnectionEvent.000007B4.00000000.00000052 | |
| CTF.ThreadMarshalInterfaceEvent.000007B4.00000000.00000052 | |
| Global\SvcctrlStartEvent_A3752DX | |
| Global\crypt32LogoffEvent | |
| CTF.ThreadMIConnectionEvent.000007B4.00000000.00000053 | |
| CTF.ThreadMarshalInterfaceEvent.000007B4.00000000.00000053 | |
| 行为描述: | 调整进程token权限 |
| 详细信息: | SE_LOAD_DRIVER_PRIVILEGE |
| 行为描述: | 窗口信息 |
| 详细信息: | Pid = 2524, Hwnd=0x1b02b6, Text = SYSCEO1, ClassName = Static. |
| Pid = 2524, Hwnd=0xf033c, Text = SYSCEO2, ClassName = Static. | |
| Pid = 2524, Hwnd=0x60380, Text = 目标文件夹, ClassName = Static. | |
| Pid = 2524, Hwnd=0x140306, Text = C:\Program Files, ClassName = Edit. | |
| Pid = 2524, Hwnd=0xa03b0, Text = ..., ClassName = Button. | |
| Pid = 2524, Hwnd=0x2102bc, Text = 下一步(&N), ClassName = Button. | |
| Pid = 2524, Hwnd=0x16032e, Text = 取消(&C), ClassName = Button. | |
| Pid = 2524, Hwnd=0x160342, Text = Chew-WGA.0.9|Win7万能激活, ClassName = #32770. | |
| Pid = 2668, Hwnd=0x2202bc, Text = Progress1, ClassName = msctls_progress32. | |
| Pid = 2668, Hwnd=0x190342, Text = Loading Chew-WGA 0.9 ..., ClassName = #32770. | |
| Pid = 2840, Hwnd=0x14034c, Text = Chew-WGA v0.9, ClassName = Afx:400000:3:0:6:10467. | |
| 行为描述: | 获取窗口截图信息 |
| 详细信息: | Foreground window Info: HWND = 0x00000000, DC = 0xbd010577. |
| Foreground window Info: HWND = 0x00000000, DC = 0xfd010632. | |
| Foreground window Info: HWND = 0x00000000, DC = 0xa3010516. | |
| Foreground window Info: HWND = 0x00000000, DC = 0x9a0101dc. | |
| Foreground window Info: HWND = 0x00000000, DC = 0x1d010509. | |
| Foreground window Info: HWND = 0x00000000, DC = 0x9e01051d. | |
| Foreground window Info: HWND = 0x00000000, DC = 0xb4010187. | |
| Foreground window Info: HWND = 0x00000000, DC = 0xce0104f2. | |
| Foreground window Info: HWND = 0x00000000, DC = 0x6601064e. | |
| Foreground window Info: HWND = 0x00000000, DC = 0x6a01064e. | |
| Foreground window Info: HWND = 0x00000000, DC = 0xda0104f2. | |
| Foreground window Info: HWND = 0x00000000, DC = 0xdb0104f2. | |
| Foreground window Info: HWND = 0x00000000, DC = 0xac010685. | |
| Foreground window Info: HWND = 0x00000000, DC = 0x040106de. | |
| Foreground window Info: HWND = 0x00000000, DC = 0x080106da. | |
| 行为描述: | 可执行文件签名信息 |
| 详细信息: | C:\Program Files\Chew-WGA.0.9.exe(签名验证: 未通过) |
| C:\Documents and Settings\Administrator\Local Settings\Temp\ir_ext_temp_0\AutoPlay\Plugins\IRDissolveTransition.tns(签名验证: 未通过) | |
| C:\Documents and Settings\Administrator\Local Settings\Temp\ir_ext_temp_0\autorun.exe(签名验证: 未通过) | |
| 行为描述: | 隐藏指定窗口 |
| 详细信息: | [Window,Class] = [Loading Chew-WGA 0.9 ...,#32770] |
| [Window,Class] = [Debug,#32770] | |
| 行为描述: | 可执行文件MD5 |
| 详细信息: | C:\Program Files\Chew-WGA.0.9.exe ---> 文件过大! |
| C:\Documents and Settings\Administrator\Local Settings\Temp\ir_ext_temp_0\AutoPlay\Plugins\IRDissolveTransition.tns ---> 6a9b0ab9341ac4204aafc7fac9872962 | |
| C:\Documents and Settings\Administrator\Local Settings\Temp\ir_ext_temp_0\autorun.exe ---> 6ed1ff22271e42f1b1b794fcf013c792 | |
| 行为描述: | 打开互斥体 |
| 详细信息: | ShimCacheMutex |
| Local\!IETld!Mutex | |
| 行为描述: | 加载新释放的文件 |
| 详细信息: | Image: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\ir_ext_temp_0\AutoPlay\Plugins\IRDissolveTransition.tns. |
| 运行截图 |
|---|
联系客服
