Analysis Report for a3e0fae4cf7ce71b1e27ccbeed7eb310-5a94da838a12a93e975eee9d148ed5a0

Comment on this report

Summary:

Description	Risk
Performs File Modification and Destruction: The executable modifies and destructs files which are not temporary.
Performs Registry Activities: The executable reads and modifies registry values. It may also create and monitor registry keys.

Table of Contents
expand all	collapse all
General information a3e0fae4cf7ce71b1e27ccbeed7eb310-5a94da838a12a93e975eee9d148ed5a0 C:\a3e0fae4cf7ce71b1e27ccbeed7eb310-5a94da838a12a93e975eee9d148ed5a0 Primary Analysis Subject General Information a) Registry Activities b) File Activities c) Other Activities

	- Information about Anubis' invocation

	- General information about this executable

Analysis Reason:	Primary Analysis Subject
Filename:	a3e0fae4cf7ce71b1e27ccbeed7eb310-5a94da838a12a93e975eee9d148ed5a0
Command Line:	"C:\a3e0fae4cf7ce71b1e27ccbeed7eb310-5a94da838a12a93e975eee9d148ed5a0"
Process-status at analysis end:	alive
Exit Code:	0

	- Load-time Dlls

	- Run-time Dlls

Module Name	Base Address	Size
C:\WINDOWS\system32\comctl32.dll	0x5D090000	0x0009A000
C:\WINDOWS\system32\imagehlp.dll	0x76C90000	0x00028000
C:\WINDOWS\system32\OLEAUT32.dll	0x77120000	0x0008B000
C:\WINDOWS\system32\WININET.dll	0x771B0000	0x000AA000
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll	0x773D0000	0x00103000
C:\WINDOWS\system32\ole32.dll	0x774E0000	0x0013D000
C:\WINDOWS\system32\CRYPT32.dll	0x77A80000	0x00095000
C:\WINDOWS\system32\MSASN1.dll	0x77B20000	0x00012000
C:\WINDOWS\system32\msvcrt.dll	0x77C10000	0x00058000
C:\WINDOWS\system32\ADVAPI32.dll	0x77DD0000	0x0009B000
C:\WINDOWS\system32\RPCRT4.dll	0x77E70000	0x00092000
C:\WINDOWS\system32\SHLWAPI.dll	0x77F60000	0x00076000
C:\WINDOWS\system32\Secur32.dll	0x77FE0000	0x00011000
C:\WINDOWS\system32\SHELL32.dll	0x7C9C0000	0x00817000

	- Registry Values Read:

Key	Name	Value	Times
HKLM\SYSTEM\CurrentControlSet\Control\Session Manager	CriticalSectionTimeout	2592000	1
HKLM\SYSTEM\Setup	SystemSetupInProgress	0	1
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows	AppInit_DLLs		1
HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers	TransparentEnabled	1	1
HKLM\System\CurrentControlSet\Control\ComputerName\ActiveComputerName	ComputerName	PC	1
HKLM\System\CurrentControlSet\Control\Terminal Server	TSAppCompat	0	3
HKLM\System\CurrentControlSet\Control\Terminal Server	TSUserEnabled	0	1

	- Files Read:

PIPE\lsarpc

	- Files Modified:

PIPE\lsarpc

	- File System Control Communication:

	- Device Control Communication:

File	Control Code	Times
\Device\KsecDD	0x00390008	1

	- Memory Mapped Files:

File Name

C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll

C:\WINDOWS\WindowsShell.Manifest

C:\WINDOWS\system32\SHELL32.dll

C:\WINDOWS\system32\WININET.dll

C:\WINDOWS\system32\comctl32.dll

	- Mutexes Created:

\A0871E65-DDDA-4475-847B-9306443855DE

	- Windows SEH exceptions:

Description	Times
Exception 0xc0000005 (STATUS_ACCESS_VIOLATION) at 0x77dfc1a7	1