Analysis Report for 52829643

Comment on this report

Summary:

Description	Risk
AV Hit: This executable is detected by an antivirus software.

Table of Contents
expand all	collapse all
General information 52829643.exe C:\52829643.exe Primary Analysis Subject General Information a) Registry Activities b) File Activities

1. General Information

	- Information about Anubis' invocation

Time needed:	250 s
Report created:	08/03/11, 12:11:28 UTC
Termination reason:	Timeout
Program version:	1.75.3394

2. 52829643.exe

	- General information about this executable

Analysis Reason:	Primary Analysis Subject
Filename:	52829643.exe
MD5:	db3e04b30eea8c232eac66dfba3e64c4
SHA-1:	74e1662507124bf6419904f66fd8c752a4bb6356
File Size:	164352 Bytes
Command Line:	"C:\52829643.exe"
Process-status at analysis end:	alive
Exit Code:	0

	- Load-time Dlls

Module Name	Base Address	Size
C:\WINDOWS\system32\ntdll.dll	0x7C900000	0x000AF000
C:\WINDOWS\system32\kernel32.dll	0x7C800000	0x000F6000
C:\WINDOWS\system32\USER32.dll	0x7E410000	0x00091000
C:\WINDOWS\system32\GDI32.dll	0x77F10000	0x00049000
C:\WINDOWS\system32\ole32.dll	0x774E0000	0x0013D000
C:\WINDOWS\system32\ADVAPI32.dll	0x77DD0000	0x0009B000
C:\WINDOWS\system32\RPCRT4.dll	0x77E70000	0x00092000
C:\WINDOWS\system32\Secur32.dll	0x77FE0000	0x00011000
C:\WINDOWS\system32\msvcrt.dll	0x77C10000	0x00058000
C:\WINDOWS\system32\MSVCP60.dll	0x76080000	0x00065000

	- Run-time Dlls

Module Name	Base Address	Size
C:\WINDOWS\system32\MSCTF.dll	0x74720000	0x0004C000
C:\WINDOWS\system32\shlwapi.dll	0x77F60000	0x00076000

	- Ikarus Virus Scanner

Trojan.Win32.Lethic (Sig-Id:1590024)

2.a) 52829643.exe - Registry Activities

	- Registry Values Read:

Key	Name	Value	Times
HKLM\SOFTWARE\Microsoft\CTF\SystemShared\	CUAS	0	1
HKLM\SYSTEM\CurrentControlSet\Control\Session Manager	CriticalSectionTimeout	2592000	1
HKLM\SYSTEM\Setup	SystemSetupInProgress	0	1
HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers	TransparentEnabled	1	1
HKLM\System\CurrentControlSet\Control\Terminal Server	TSUserEnabled	0	1
HKU\S-1-5-21-842925246-1425521274-308236825-500\Keyboard Layout\Toggle	Language Hotkey	1	2
HKU\S-1-5-21-842925246-1425521274-308236825-500\Keyboard Layout\Toggle	Layout Hotkey	2	2

2.b) 52829643.exe - File Activities

	- File System Control Communication:

File	Control Code	Times
C:\Program Files\Common Files\	0x00090028	1

	- Device Control Communication:

File	Control Code	Times
\Device\KsecDD	0x00390008	1

	- Memory Mapped Files:

File Name

C:\WINDOWS\system32\MSCTF.dll

C:\WINDOWS\system32\MSVCP60.dll

C:\WINDOWS\system32\imm32.dll

C:\WINDOWS\system32\shell32.dll

International Secure Systems Lab
Vienna University of Technology, Eurecom France, UC Santa Barbara
Contact: anubis@iseclab.org