魔盾安全分析报告
分析类型 |
开始时间 |
结束时间 |
持续时间 |
分析引擎版本 |
URL |
2020-04-06 14:28:35 |
2020-04-06 14:36:43 |
488 秒 |
1.4-Maldun |
虚拟机机器名 |
标签 |
虚拟机管理 |
开机时间 |
关机时间 |
win7-sp1-x64-hpdapp01-7 |
win7-sp1-x64-hpdapp01-7 |
KVM |
2020-04-06 14:28:35 |
2020-04-06 14:36:44 |
URL信息
URL |
http://v.youku.com/v_show/id_XNDQ3NTQ5OTg0MA==.html |
VirusTotal |
VirusTotal无域名信息
|
行为分析
互斥量(Mutexes)
- Local\!IETld!Mutex
- Local\c:!users!test!appdata!local!microsoft!feeds cache!
- Local\ZonesCounterMutex
- Local\ZoneAttributeCacheCounterMutex
- Local\ZonesCacheCounterMutex
- Local\ZonesLockedCacheCounterMutex
- Local\!BrowserEmulation!SharedMemory!Mutex
- Local\!IECompat!Mutex
- Local\c:!users!test!appdata!roaming!microsoft!windows!iecompatcache!
- ConnHashTable<1704>_HashTable_Mutex
- Local\WininetStartupMutex
- Groove:PathMutex:huJZ0a1oPtB4yGzDQW9lw0niEfg=
- Groove.Mutex.WebServices.Status
- Groove.Mutex.SystemServices.Lock
- Groove:PathMutex:v1n9odwmzLTGaaFW7PZysBRMqq8=
- Local\MSCTF.Asm.MutexDefault1
执行的命令
无信息
创建的服务
无信息
启动的服务
无信息
进程
iexplore.exe PID: 1704, 上一级进程 PID: 2560
iexplore.exe PID: 1608, 上一级进程 PID: 1704
读取的文件
- C:\Windows\Globalization\Sorting\sortdefault.nls
- C:\Program Files (x86)\Internet Explorer\IEShims.dll
- C:\Windows\SysWOW64\shell32.dll
- \Device\KsecDD
- C:\Program Files (x86)\Internet Explorer\sqmapi.dll
- C:\
- C:\Users\test\AppData\Local\Microsoft\Windows\Caches\cversions.1.db
- C:\Users\test\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000052.db
- C:\Users\desktop.ini
- C:\Users
- C:\Users\test
- C:\Users\test\Favorites\desktop.ini
- C:\Users\test\Desktop\desktop.ini
- C:\Program Files (x86)\Internet Explorer\ieproxy.dll
- C:\Users\test\AppData\Local\Microsoft\Feeds Cache\index.dat
- C:\Users\test\AppData\Roaming\Microsoft\Windows\IECompatCache\index.dat
- C:\Windows\Fonts\staticcache.dat
- C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL
- C:\Windows\AppPatch\sysmain.sdb
- C:\Program Files (x86)\Microsoft Office\Office14\
- C:\Program Files (x86)\Java\jre1.8.0_121\bin\ssv.dll
- C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL
- C:\Program Files (x86)\Java\jre1.8.0_121\bin\jp2ssv.dll
- C:\Program Files (x86)\Java\jre1.8.0_121\bin\msvcr100.dll
- C:\Program Files (x86)\Java\jre1.8.0_121\bin\deploy.dll
- C:\Users\test\AppData\Local\Temp\JavaDeployReg.log
- C:\Windows\SysWOW64\ieframe.dll
- C:\Windows\WindowsShell.manifest
- C:\Windows\System32\en-US\MLANG.dll.mui
修改的文件
- C:\Users\test\AppData\Local\Microsoft\Feeds Cache\index.dat
- C:\Users\test\AppData\Roaming\Microsoft\Windows\IECompatCache\index.dat
- C:\Users\test\AppData\Local\Temp\JavaDeployReg.log
- C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CB4GP22D\dnserror[1]
- C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EHDRIWWS\ErrorPageTemplate[1]
- C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HEL4YQ7U\errorPageStrings[1]
- C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CB4GP22D\httpErrorPagesScripts[1]
- C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EHDRIWWS\noConnect[1]
- C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IDL4J1KW\background_gradient[1]
- C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CB4GP22D\down[1]
- C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EHDRIWWS\favcenter[1]
- C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IDL4J1KW\tools[1]
删除的文件
无信息
修改的注册表键
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\iexplore\Type
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\iexplore\Count
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\iexplore\Time
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\iexplore\Blocked
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}\iexplore\Type
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}\iexplore\Count
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}\iexplore\Time
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}\iexplore\LoadTime
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\iexplore\Type
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\iexplore\Count
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\iexplore\Time
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\iexplore\LoadTime
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{B4F3A835-0E21-4959-BA22-42B3008E02FF}\iexplore\Type
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{B4F3A835-0E21-4959-BA22-42B3008E02FF}\iexplore\Count
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{B4F3A835-0E21-4959-BA22-42B3008E02FF}\iexplore\Time
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{B4F3A835-0E21-4959-BA22-42B3008E02FF}\iexplore\LoadTime
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DBC80044-A445-435B-BC74-9C25C1C588A9}\iexplore\Type
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DBC80044-A445-435B-BC74-9C25C1C588A9}\iexplore\Count
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DBC80044-A445-435B-BC74-9C25C1C588A9}\iexplore\Time
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DBC80044-A445-435B-BC74-9C25C1C588A9}\iexplore\LoadTime
删除的注册表键
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass
- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName
- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName