|
|
基本信息
文件名称：
雷达内测.exe
MD5： b42c06ad024f134c79bd39a94077b4f2
文件类型： EXE
上传时间： 2021-10-06 13:34:46
出品公司： N/A
版本： N/A
壳或编译器信息： COMPILER:Elan
子文件信息： 详情
关键行为
行为描述： 跨进程写入数据
详情信息：
TargetProcess = C:\Program Files\Tencent\QQ\Bin\QQ.exe, WriteAddress = 0x013e0000, Size = 0x0000000e TargetPID = 0x0000010c
TargetProcess = C:\Program Files\Tencent\QQ\Bin\QQ.exe, WriteAddress = 0x013f0000, Size = 0x0000001f TargetPID = 0x0000010c
TargetProcess = C:\Program Files\Tencent\QQ\Bin\QQ.exe, WriteAddress = 0x01410000, Size = 0x00000021 TargetPID = 0x0000010c
TargetProcess = C:\Program Files\Tencent\QQ\Bin\QQ.exe, WriteAddress = 0x013f0000, Size = 0x0000000f TargetPID = 0x0000010c
TargetProcess = C:\Program Files\Tencent\QQ\Bin\QQ.exe, WriteAddress = 0x013e0000, Size = 0x00000009 TargetPID = 0x0000010c
TargetProcess = C:\Program Files\Tencent\QQ\Bin\QQ.exe, WriteAddress = 0x01410000, Size = 0x0000000e TargetPID = 0x0000010c
TargetProcess = C:\Program Files\Tencent\QQ\Bin\QQ.exe, WriteAddress = 0x01420000, Size = 0x0000002f TargetPID = 0x0000010c
TargetProcess = C:\Program Files\Tencent\QQ\Bin\QQ.exe, WriteAddress = 0x01440000, Size = 0x00000021 TargetPID = 0x0000010c
TargetProcess = C:\%temp%\****.exe, WriteAddress = 0x00cc0000, Size = 0x0000000e TargetPID = 0x0000093c
TargetProcess = C:\%temp%\****.exe, WriteAddress = 0x00d50000, Size = 0x0000001f TargetPID = 0x0000093c
TargetProcess = C:\%temp%\****.exe, WriteAddress = 0x00d70000, Size = 0x00000021 TargetPID = 0x0000093c
TargetProcess = C:\%temp%\****.exe, WriteAddress = 0x00cc0000, Size = 0x00000009 TargetPID = 0x0000093c
TargetProcess = C:\%temp%\****.exe, WriteAddress = 0x00d70000, Size = 0x0000000e TargetPID = 0x0000093c
TargetProcess = C:\%temp%\****.exe, WriteAddress = 0x00d80000, Size = 0x0000002f TargetPID = 0x0000093c
TargetProcess = C:\%temp%\****.exe, WriteAddress = 0x00da0000, Size = 0x00000021 TargetPID = 0x0000093c
行为描述： 杀掉进程
详情信息：
C:\WINDOWS\system32\Steam.exe
C:\WINDOWS\system32\TslGame.exe
行为描述： 创建远程线程
详情信息：
TargetProcess: QQ.exe, InheritedFromPID = 2000, ProcessID = 268, ThreadID = 2928, StartAddress = 77D2A97D, Parameter = 01410000
TargetProcess: QQ.exe, InheritedFromPID = 2000, ProcessID = 268, ThreadID = 2932, StartAddress = 77D2A97D, Parameter = 013F0000
TargetProcess: QQ.exe, InheritedFromPID = 2000, ProcessID = 268, ThreadID = 2936, StartAddress = 77D2A97D, Parameter = 01440000
TargetProcess: QQ.exe, InheritedFromPID = 2304, ProcessID = 2364, ThreadID = 2972, StartAddress = 77D2A97D, Parameter = 00D70000
TargetProcess: QQ.exe, InheritedFromPID = 2304, ProcessID = 2364, ThreadID = 2976, StartAddress = 77D2A97D, Parameter = 00DA0000
TargetProcess: TIM.exe, InheritedFromPID = 2000, ProcessID = 2856, ThreadID = 2980, StartAddress = 77D2A97D, Parameter = 00A90000
TargetProcess: TIM.exe, InheritedFromPID = 2000, ProcessID = 2856, ThreadID = 2992, StartAddress = 77D2A97D, Parameter = 00AC0000
TargetProcess: QQ.exe, InheritedFromPID = 2000, ProcessID = 268, ThreadID = 3508, StartAddress = 77D2A97D, Parameter = 01450000
TargetProcess: QQ.exe, InheritedFromPID = 2000, ProcessID = 268, ThreadID = 3512, StartAddress = 77D2A97D, Parameter = 01420000
TargetProcess: QQ.exe, InheritedFromPID = 2000, ProcessID = 268, ThreadID = 3516, StartAddress = 77D2A97D, Parameter = 01480000
行为描述： 获取User基本信息
详情信息：
Level = 10.
行为描述： 获取TickCount值
详情信息：
TickCount = 223890, SleepMilliseconds = 250.
行为描述： 设置特殊文件夹属性
详情信息：
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
C:\Documents and Settings\Administrator\Local Settings\History
C:\Documents and Settings\Administrator\Local Settings\History\History.IE5
C:\Documents and Settings\Administrator\Cookies
行为描述： 直接获取CPU时钟
详情信息：
EAX = 0x39c0c5a7, EDX = 0x000000b9
EAX = 0x5977fc67, EDX = 0x000000b9
EAX = 0x5977fcb3, EDX = 0x000000b9
EAX = 0x5977fcff, EDX = 0x000000b9
EAX = 0x5977fd4b, EDX = 0x000000b9
EAX = 0x5c2afcc7, EDX = 0x000000b9
EAX = 0x5c2afd13, EDX = 0x000000b9
EAX = 0x5c2afd5f, EDX = 0x000000b9
EAX = 0x5eb2cce8, EDX = 0x000000b9
EAX = 0x5eb2cd34, EDX = 0x000000b9 |
|
雷达卡
发表于 2021-10-6 15:14
显身卡