Analysis | #totalhash

Analysis Date	2014-04-18 13:36:37
MD5	1583e8e63eb27089e76564e5f856aa12
SHA1	1a368fcb94b122520dcc5bfbbba640d1b3ade37e

Static Details:

File type	PE32 executable for MS Windows (GUI) Intel 80386 32-bit
Section	.text md5: afae93b7d0dd6fd142b64d7b593176db sha1: 1cbcdf075f4c68683449bee497929631aab866a6 size: 119296
Section	.rdata md5: 802b24bcef5dcc7528c46901d750c565 sha1: 3c199a31f06f20fdcd4eef4c0f025001b8585a16 size: 16384
Section	.data md5: 561c9a40dfbb01ab6b880898e5ea454b sha1: 428cafa946122b2269a96e2f9692ce036790a403 size: 99840
Timestamp	2014-01-22 06:47:08
PEhash	92bb72c03327ad220119793b6a201b308f5ca793
IMPhash	79bf85e9214034442bb3a4275ebec0de
AV	avira	W32/Sality.AT
AV	avg	Generic_r.DML
AV	mcafee	W32/Sality.gen.z
AV	msse	Virus:Win32/Sality.AT

Runtime Details:

Screenshot

Process
↳ C:\malware.exe

Registry	HKEY_CURRENT_USER\Software\Aasppapmmxkvs\A1_0 ➝ 2692894802
Registry	HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\policies\system\EnableLUA ➝ NULL
Registry	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\AntiVirusOverride ➝ 1
Registry	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Hidden ➝ 2
Registry	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall ➝ NULL
Registry	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Framework Support Service Block Server ➝ C:\Documents and Settings\Administrator\Application Data\qeoywrpovv\impeifvsb.exe
Registry	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\malware.exe ➝ C:\malware.exe:*:Enabled:ipsec
Registry	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusOverride ➝ 1
Registry	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\GlobalUserOffline ➝ NULL
Registry	HKEY_CURRENT_USER\Software\Aasppapmmxkvs\-993627007\1768776769 ➝ 215
Creates File	PIPE\lsarpc
Creates File	C:\Documents and Settings\Administrator\Application Data\qeoywrpovv\impeifvsb.exe
Creates File	C:\WINDOWS\SYSTEM.INI
Creates Process	C:\Documents and Settings\Administrator\Application Data\qeoywrpovv\impeifvsb.exe
Creates Mutex	uxJLpe1m
Creates Mutex	services.exeM_616_
Creates Mutex	explorer.exeM_360_
Creates Mutex	svchost.exeM_1192_
Creates Mutex	svchost.exeM_1092_
Creates Mutex	svchost.exeM_800_
Creates Mutex	lsass.exeM_628_
Creates Mutex	monitor.exeM_1232_
Creates Mutex	spoolsv.exeM_1312_
Creates Mutex	malware.exeM_1456_
Creates Mutex	alg.exeM_1876_
Creates Mutex	reader_sl.exeM_972_
Creates Mutex	svchost.exeM_1208_
Creates Mutex	csrss.exeM_548_
Creates Mutex	svchost.exeM_852_
Creates Mutex	smss.exeM_500_
Creates Mutex	winlogon.exeM_572_
Creates Mutex	userinit.exeM_268_
Creates Mutex	svchost.exeM_1020_

Process
↳ C:\Documents and Settings\Administrator\Application Data\qeoywrpovv\impeifvsb.exe

Creates File	C:\Documents and Settings\Administrator\Application Data\qeoywrpovv\ngcstauj.exe
Creates File	\Device\Afd\Endpoint
Creates File	C:\Documents and Settings\Administrator\Application Data\qeoywrpovv\impeifvsb.yp
Creates Process	WATCHDOGPROC "C:\Documents and Settings\Administrator\Application Data\qeoywrpovv\impeifvsb.exe"
Creates Mutex	uxJLpe1m
Creates Mutex	impeifvsb.exeM_1424_

Process
↳ Pid 268

Process
↳ C:\WINDOWS\Explorer.EXE

Creates Mutex	uxJLpe1m

Process
↳ C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

Creates Mutex	uxJLpe1m

Process
↳ WATCHDOGPROC "C:\Documents and Settings\Administrator\Application Data\qeoywrpovv\impeifvsb.exe"

Registry	HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\policies\system\EnableLUA ➝ NULL
Registry	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\AntiVirusOverride ➝ 1
Registry	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Hidden ➝ 2
Registry	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall ➝ NULL
Registry	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Documents and Settings\Administrator\Application Data\qeoywrpovv\ngcstauj.exe ➝ C:\Documents and Settings\Administrator\Application Data\qeoywrpovv\ngcstauj.exe:*:Enabled:ipsec
Registry	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusOverride ➝ 1
Registry	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\GlobalUserOffline ➝ NULL
Registry	HKEY_CURRENT_USER\Software\Aasppapmmxkvs\-993627007\1768776769 ➝ 215
Creates File	C:\TEMP\FILES\monitor.exe
Creates File	C:\TEMP\FILES\ngcstauj.exe
Creates File	C:\Documents and Settings\Administrator\Local Settings\Temp\00015975_Rar\ngcstauj.exe
Creates File	C:\Documents and Settings\Administrator\Local Settings\Temp\nxsfqa.exe
Creates File	PIPE\SfcApi
Creates File	C:\Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32.exe
Creates File	C:\TEMP\FILES\ncfkr.exe
Creates File	C:\TEMP\FILES\impeifvsb.exe
Creates File	C:\TEMP\FILES\AcroRd32.exe
Creates File	C:\Documents and Settings\Administrator\Local Settings\Temp\ncfkr.exe
Creates File	C:\TEMP\monitor.exe
Creates File	PIPE\lsarpc
Creates File	\Device\Afd\Endpoint
Creates File	C:\WINDOWS\system32\drivers\lukgn.sys
Creates File	amsint32
Deletes File	C:\Documents and Settings\Administrator\Local Settings\Temp\00015975_Rar\ngcstauj.exe
Deletes File	C:\Documents and Settings\Administrator\Local Settings\Temp\nxsfqa.exe
Deletes File	C:\Documents and Settings\Administrator\Local Settings\Temp\ncfkr.exe
Deletes File	C:\WINDOWS\system32\drivers\lukgn.sys
Creates Mutex	uxJLpe1m
Creates Mutex	services.exeM_616_
Creates Mutex	explorer.exeM_360_
Creates Mutex	svchost.exeM_1192_
Creates Mutex	svchost.exeM_1092_
Creates Mutex	svchost.exeM_800_
Creates Mutex	lsass.exeM_628_
Creates Mutex	monitor.exeM_1232_
Creates Mutex	spoolsv.exeM_1312_
Creates Mutex	alg.exeM_1876_
Creates Mutex	reader_sl.exeM_972_
Creates Mutex	svchost.exeM_1208_
Creates Mutex	csrss.exeM_548_
Creates Mutex	svchost.exeM_852_
Creates Mutex	smss.exeM_500_
Creates Mutex	winlogon.exeM_572_
Creates Mutex	userinit.exeM_268_
Creates Mutex	ngcstauj.exeM_3548_
Creates Mutex	svchost.exeM_1020_
Creates Mutex	impeifvsb.exeM_1424_
Creates Service	amsint32 - C:\WINDOWS\system32\drivers\lukgn.sys
Starts Service	IPFILTERDRIVER
Starts Service	amsint32