Analysis Report for zus.exe

Comment on this report

Summary:

Description	Risk
Autostart capabilities: This executable registers processes to be executed at system start. This could result in unwanted actions to be performed automatically.
Creates files in the Windows system directory: Malware often keeps copies of itself in the Windows directory to stay undetected by users.
Performs File Modification and Destruction: The executable modifies and destructs files which are not temporary.
Performs Registry Activities: The executable reads and modifies registry values. It may also create and monitor registry keys.

Table of Contents
expand all	collapse all
General information zus.exe C:\zus.exe Primary Analysis Subject General Information a) Registry Activities b) File Activities

1. General Information

	- Information about Anubis' invocation

Time needed:	241 s
Report created:	08/08/09, 12:29:28 UTC
Termination reason:	Timeout
Program version:	1.70.0

2. zus.exe

	- General information about this executable

Analysis Reason:	Primary Analysis Subject
Filename:	zus.exe
MD5:	01aed193ac87eed6ce40e7cb7d35b36e
SHA-1:	02a3a2331fdede6e0648cdbfe0b49f2bc9a11b01
File Size:	49664 Bytes
Command Line:	"C:\zus.exe"
Process-status at analysis end:	alive
Exit Code:	0

	- Load-time Dlls

Module Name	Base Address	Size
C:\WINDOWS\system32\ntdll.dll	0x7C900000	0x000AF000
C:\WINDOWS\system32\kernel32.dll	0x7C800000	0x000F6000
C:\WINDOWS\system32\advapi32.dll	0x77DD0000	0x0009B000
C:\WINDOWS\system32\RPCRT4.dll	0x77E70000	0x00092000
C:\WINDOWS\system32\Secur32.dll	0x77FE0000	0x00011000
C:\WINDOWS\system32\shlwapi.dll	0x77F60000	0x00076000
C:\WINDOWS\system32\GDI32.dll	0x77F10000	0x00049000
C:\WINDOWS\system32\USER32.dll	0x7E410000	0x00091000
C:\WINDOWS\system32\msvcrt.dll	0x77C10000	0x00058000

	- Run-time Dlls

Module Name	Base Address	Size
C:\WINDOWS\system32\comctl32.dll	0x5D090000	0x0009A000
C:\WINDOWS\system32\psapi.dll	0x76BF0000	0x0000B000
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll	0x773D0000	0x00103000
C:\WINDOWS\system32\ole32.dll	0x774E0000	0x0013D000
C:\WINDOWS\system32\shell32.dll	0x7C9C0000	0x00817000

	- Ikarus Virus Scanner

Trojan-Spy.Win32.Zbot.cmr (Sig-Id:360487)

2.a) zus.exe - Registry Activities

	- Registry Values Modified:

Key	Name	New Value
HKLM\software\microsoft\windows nt\currentversion\winlogon	userinit	C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\ntos.exe,

	- Registry Values Read:

Key	Name	Value	Times
HKLM\SYSTEM\CurrentControlSet\Control\Session Manager	CriticalSectionTimeout	2592000	1
HKLM\SYSTEM\Setup	SystemSetupInProgress	0	1
HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers	TransparentEnabled	1	1
HKLM\System\CurrentControlSet\Control\ComputerName\ActiveComputerName	ComputerName	PC	1
HKLM\software\microsoft\windows nt\currentversion\winlogon	userinit	C:\WINDOWS\system32\userinit.exe,	2

2.b) zus.exe - File Activities

	- Files Created:

C:\WINDOWS\system32\ntos.exe

	- Files Read:

PIPE\lsarpc

	- Files Modified:

C:\WINDOWS\system32\ntos.exe

PIPE\lsarpc

	- File System Control Communication:

File	Control Code	Times
PIPE\lsarpc	0x0011C017	3

	- Device Control Communication:

File	Control Code	Times
\Device\KsecDD	0x00390008	1

	- Memory Mapped Files:

File Name

C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll

C:\WINDOWS\WindowsShell.Manifest

C:\WINDOWS\system32\comctl32.dll

C:\WINDOWS\system32\psapi.dll

C:\WINDOWS\system32\shell32.dll

C:\zus.exe