Analysis Summary:

Analysis Date13.08.2006 00:34:11
Sandbox VersionBeta 1.73
Filename2bf2a4f0bdac42f4d6f8a062a7206797.exe

Technical Details:

Analysis Number1
Parent ID0
Process ID1820
Filenamec:\analysis\binary\2bf2a4f0bdac42f4d6f8a062a7206797.exe
Filesize9374 bytes
MD52bf2a4f0bdac42f4d6f8a062a7206797
Start ReasonAnalysisTarget
Termination ReasonNormalTermination
Start Time00:00.109
Stop Time00:18.546
DetectionOK (ClamAV)
Generic.Malware.IXdld.77C2258A (BDC/Linux-Console)
OK (AntiVir Workstation)
DLL-Handling
Loaded DLLs
c:\analysis\binary\2bf2a4f0bdac42f4d6f8a062a7206797.exe
C:\WINDOWS\system32\ntdll.dll
C:\WINDOWS\system32\kernel32.dll
C:\WINDOWS\system32\user32.dll
C:\WINDOWS\system32\GDI32.dll
C:\WINDOWS\system32\advapi32.dll
C:\WINDOWS\system32\RPCRT4.dll
C:\WINDOWS\system32\oleaut32.dll
C:\WINDOWS\system32\msvcrt.dll
C:\WINDOWS\system32\ole32.dll
C:\WINDOWS\system32\comctl32.dll
C:\WINDOWS\system32\wsock32.dll
C:\WINDOWS\system32\WS2_32.dll
C:\WINDOWS\system32\WS2HELP.dll
C:\WINDOWS\system32\Wship6.dll
C:\WINDOWS\system32\pstorec.dll
C:\WINDOWS\system32\ATL.DLL
C:\WINDOWS\System32\mswsock.dll
C:\WINDOWS\system32\DNSAPI.dll
C:\WINDOWS\System32\winrnr.dll
C:\WINDOWS\system32\WLDAP32.dll
C:\WINDOWS\system32\Secur32.dll
KERNEL32.dll
USER32.dll
WS2_32.dll
ADVAPI32.dll
MSWSOCK.dll
VERSION.dll
Filesystem
New Files
C:\WINDOWS\system32\wgavm.exe
Opened Files
\SystemRoot\AppPatch\sysmain.sdb
\SystemRoot\AppPatch\systest.sdb
\Device\NamedPipe\ShimViewer
C:\WINDOWS\explorer.exe
Chronological order
Set File Attributes: C:\WINDOWS\system32\wgavm.exe Flags: (FILE_ATTRIBUTE_ARCHIVE,SECURITY_ANONYMOUS)
Copy File: c:\analysis\binary\2bf2a4f0bdac42f4d6f8a062a7206797.exe to C:\WINDOWS\system32\wgavm.exe
Open File: \SystemRoot\AppPatch\sysmain.sdb (OPEN_EXISTING)
Open File: \SystemRoot\AppPatch\systest.sdb (OPEN_EXISTING)
Open File: \Device\NamedPipe\ShimViewer (OPEN_EXISTING)
Open File: C:\WINDOWS\explorer.exe ()
Find File: explorer.exe
Registry
Reads
\Registry\Machine\SYSTEM\WPA\MediaCenter "Installed"
\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers "C:\WINDOWS\explorer.exe"
\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags "{8daa3198-f1f6-4d1d-9aa1-0a673bd3d3fb}"
Process Management Creates Process - Filename () CommandLine: (explorer.exe) As User: () Creation Flags: (CREATE_SUSPENDED)
Service Management Open Service Manager - Name: "SCM"
Open Service - Name: "wgavm"
Create Service - Name: (wgavm) Display Name: (Windows Genuine Advantage Validation Monitor) File Name: (C:\WINDOWS\system32\wgavm.exe) Control: () Start Type: (SERVICE_AUTO_START)
Start Service - Name: (wgavm) Display Name: () File Name: () Control: () Start Type: ()
Change Service Configuration - Name: (wgavm) Display Name: () File Name: () Control: () Start Type: (SERVICE_NO_CHANGE)
Change Service Configuration - Name: (wgavm) Display Name: (Ensures that your copy of Microsoft Windows is genuine. Stopping or disabling this service will result in system instability.) File Name: () Control: () Start Type: (SERVICE_NO_CHANGE)
System Info Get System Directory
Threads Create Remote Thread - Target PID (1632) Thread ID ($065C) Thread ID ($00090000) Parameter Address ($00000000) Creation Flags (CREATE_SUSPENDED)
Virtual Memory VM Allocate - Target: (1632) Address: ($00090000) Size: (4096) Protect: (PAGE_READWRITE) Allocation Type: (MEM_COMMIT)
VM Allocate - Target: (1632) Address: ($000A0000) Size: (1048576) Protect: (PAGE_READWRITE) Allocation Type: (MEM_RESERVE)
VM Allocate - Target: (1632) Address: ($0019E000) Size: (8192) Protect: (PAGE_READWRITE) Allocation Type: (MEM_COMMIT)
VM Protect - Target: (1632) Address: ($00090000) Size: (4096) Protect: (PAGE_EXECUTE_READWRITE)
VM Protect - Target: (1632) Address: ($00090000) Size: (4096) Protect: (PAGE_READWRITE)
VM Protect - Target: (1632) Address: ($00090000) Size: (4096) Protect: (PAGE_EXECUTE_READWRITE)
VM Protect - Target: (1632) Address: ($0019E000) Size: (4096) Protect: (PAGE_READWRITE,PAGE_GUARD)
VM Write - Target: (1632) Address: ($00090000) Size: (52)
VM Write - Target: (1632) Address: ($00090034) Size: (260)

Analysis Number2
Parent ID0
Process ID704
Filenameservices.exe
Filesize-1 bytes
MD5
Start ReasonSCM
Termination ReasonTimeout
Start Time00:16.125
Stop Time02:01.234
Process Management Creates Process - Filename () CommandLine: (C:\WINDOWS\system32\wgavm.exe) As User: () Creation Flags: (CREATE_SUSPENDED,CREATE_UNICODE_ENVIRONMENT,DETACHED_PROCESS)

The following process was started by process: 2
Analysis Number3
Parent ID2
Process ID1260
FilenameC:\WINDOWS\system32\wgavm.exe
Filesize9374 bytes
MD52bf2a4f0bdac42f4d6f8a062a7206797
Start ReasonCreateProcess
Termination ReasonTimeout
Start Time00:16.734
Stop Time02:01.250
DetectionOK (ClamAV)
Generic.Malware.IXdld.77C2258A (BDC/Linux-Console)
OK (AntiVir Workstation)
DLL-Handling
Loaded DLLs
C:\WINDOWS\system32\wgavm.exe
C:\WINDOWS\system32\ntdll.dll
C:\WINDOWS\system32\kernel32.dll
C:\WINDOWS\system32\user32.dll
C:\WINDOWS\system32\GDI32.dll
C:\WINDOWS\system32\advapi32.dll
C:\WINDOWS\system32\RPCRT4.dll
C:\WINDOWS\system32\oleaut32.dll
C:\WINDOWS\system32\msvcrt.dll
C:\WINDOWS\system32\ole32.dll
C:\WINDOWS\system32\comctl32.dll
C:\WINDOWS\system32\wsock32.dll
C:\WINDOWS\system32\WS2_32.dll
C:\WINDOWS\system32\WS2HELP.dll
C:\WINDOWS\system32\Wship6.dll
C:\WINDOWS\system32\pstorec.dll
C:\WINDOWS\system32\ATL.DLL
C:\WINDOWS\System32\mswsock.dll
C:\WINDOWS\system32\DNSAPI.dll
C:\WINDOWS\System32\winrnr.dll
C:\WINDOWS\system32\WLDAP32.dll
C:\WINDOWS\system32\Secur32.dll
KERNEL32.dll
USER32.dll
WS2_32.dll
ADVAPI32.dll
MSWSOCK.dll
dnsapi.dll
Filesystem
New Files
\Device\RasAcd
Chronological order
Set File Attributes: C:\WINDOWS\debug\dcpromo.log Flags: (FILE_ATTRIBUTE_READONLY,SECURITY_ANONYMOUS)
Create/Open File: \Device\RasAcd (OPEN_ALWAYS)
Mutexes Creates Mutex: wgavm
Registry
Create or Open
HKEY_LOCAL_MACHINE\software\microsoft\ole
HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\lanmanserver\parameters
HKEY_LOCAL_MACHINE\software\microsoft\security center
HKEY_LOCAL_MACHINE\software\policies\microsoft\windowsfirewall\domainprofile
HKEY_LOCAL_MACHINE\software\policies\microsoft\windowsfirewall\standardprofile
Changes
HKEY_LOCAL_MACHINE\software\microsoft\ole "enabledcom" = n
HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa "restrictanonymous" = [REG_DWORD, value: 00000001]
HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa "restrictanonymoussam" = [REG_DWORD, value: 00000001]
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\lanmanserver\parameters "autoshareserver" = [REG_DWORD, value: 00000000]
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\lanmanserver\parameters "autosharewks" = [REG_DWORD, value: 00000000]
HKEY_LOCAL_MACHINE\software\microsoft\security center "antivirusdisablenotify" = [REG_DWORD, value: 00000001]
HKEY_LOCAL_MACHINE\software\microsoft\security center "antivirusoverride" = [REG_DWORD, value: 00000001]
HKEY_LOCAL_MACHINE\software\microsoft\security center "firewalldisablenotify" = [REG_DWORD, value: 00000001]
HKEY_LOCAL_MACHINE\software\microsoft\security center "firewalldisableoverride" = [REG_DWORD, value: 00000001]
HKEY_LOCAL_MACHINE\software\policies\microsoft\windowsfirewall\domainprofile "enablefirewall" = [REG_DWORD, value: 00000000]
HKEY_LOCAL_MACHINE\software\policies\microsoft\windowsfirewall\standardprofile "enablefirewall" = [REG_DWORD, value: 00000000]
Reads
HKEY_LOCAL_MACHINE\Software\Microsoft\Rpc\SecurityService "DefaultAuthLevel"
Service Management Open Service Manager - Name: "SCM"
Open Service - Name: "sharedaccess"
Control Service - Name: (sharedaccess) Display Name: () File Name: () Control: (SERVICE_CONTROL_STOP) Start Type: ()
Change Service Configuration - Name: (sharedaccess) Display Name: () File Name: () Control: () Start Type: (SERVICE_DISABLED)
System Info Get Windows Directory
Network Activity
DNS Lookup
Host NameIP Address
bniu.househot.com61.163.231.115
Outgoing connection to remote server: bniu.househot.com TCP port 18067

The following process was started by process: 1
Analysis Number4
Parent ID1
Process ID1632
Filenameexplorer.exe
Filesize-1 bytes
MD5
Start ReasonCreateProcess
Termination ReasonTimeout
Start Time00:18.062
Stop Time02:01.093

Report generated at 13.08.2006 00:34:11 with CWSandbox Version Beta 1.73
This analysis was created by the CWSandbox Copyright © 2006 Carsten Willems
Copyright © 1996-2006 Sunbelt Software. All rights reserved.