Injector.EIEA is a Trojan. A Trojan is a program that pretends to have a valid use, but in fact modifies the user's computer in malicious ways. Trojans do not replicate or spread to other computers.
Mutexes created
Directory level activity- create - dir - C:\Documents and Settings\All Users\Application Data\3c022f79-33eb-49e6-81b8-ddaa369645b1
File level activity- write - file - PIPE\lsarpc
- write - file - PIPE\lsarpc
Registry level activity- write - registry - HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell FoldersCommon AppData
Library level activity- load - library - kernel32.dll
- load - library - C:\WINDOWS\system32\rpcss.dll
- load - library - C:\WINDOWS\system32\winlogon.exe
- load - library - xpsp2res.dll
- load - library - CLBCATQ.DLL
- load - library - ole32.dll
- load - library - KERNEL32.DLL
- load - library - C:\WINDOWS\system32\wbem\wbemprox.dll
- load - library - wmisvc.dll
- load - library - OLE32
- load - library - OLE32.DLL
- load - library - C:\WINDOWS\system32\wbem\wbemsvc.dll
- load - library - C:\WINDOWS\system32\wbem\fastprox.dll
- load - library - oleaut32.dll
- load - library - rsaenh.dll
- load - library - kernel32
- load - library - C:\DOCUME~1\TestMachine\LOCALS~1\Temp\ada3e858ef6b4d2234f9d80d6c9aad73.bin
- load - library - ADVAPI32.DLL
- load - library - ws2_32
- load - library - C:\WINDOWS\system32\WINHTTP.dll
- load - library - mscoree.dll
Process API calls used
- NtFreeVirtualMemory
- NtCreateSection
- ZwMapViewOfSection
- ExitProcess
Registry API calls used
- RegOpenKeyExW
- RegQueryValueExW
- RegCloseKey
- RegCreateKeyExW
- RegSetValueExW
- NtOpenKey
- NtQueryValueKey
- RegOpenKeyExA
- RegQueryValueExA
- RegOpenKeyExA
System API calls used
- LdrGetDllHandle
- LdrGetProcedureAddress
- NtDelayExecution
- LdrLoadDll
- LdrGetDllHandle
Filesystem API calls used
- NtOpenFile
- CreateDirectoryW
- NtCreateFile
- NtSetInformationFile
- NtWriteFile
- NtReadFile
- NtQueryInformationFile
- NtDeviceIoControlFile
- NtDeviceIoControlFile
Network
UDP source >> destination
- 192.168.30.2 >> 192.168.30.254
- 192.168.30.2 >> 192.168.30.255
- 192.168.30.2 >> 8.8.8.8
- 192.168.30.254 >> 192.168.30.2
TCP source >> destination
- 192.168.30.2 >> 104.123.154.144
- 192.168.30.2 >> 192.168.30.254
Domains:- oursearchwindow-a.akamaihd.net with IP - 104.114.76.168
DNS Request:- oursearchwindow-a.akamaihd.net
HTTP Request:- POST URI - http://oursearchwindow-a.akamaihd.net/ah
DLL related data
Number of DLL's imported = 9
- KERNEL32.dll
- ADVAPI32.dll
- SHELL32.dll
- ole32.dll
- OLEAUT32.dll
- SHLWAPI.dll
- CRYPT32.dll
- WINHTTP.dll
- VERSION.dll
|
