MalAgent.J_76492 is a Trojan. A Trojan is a program that pretends to have a valid use, but in fact modifies the user's computer in malicious ways. Trojans do not replicate or spread to other computers.
Mutexes created
- 9C71F883-5E43-41AA-85D0-5272784FB258
- _!MSFTHISTORY!_
- c:!documents and settings!soumy!local settings!temporary internet files!content.ie5!
- c:!documents and settings!soumy!cookies!
- c:!documents and settings!soumy!local settings!history!history.ie5!
- WininetStartupMutex
- WininetConnectionMutex
- WininetProxyRegistryMutex
Directory level activity
File level activity- write - file - PIPE\wkssvc
- write - file - C:\DOCUME~1\TestMachine\LOCALS~1\Temp\d
- delete - file - C:\DOCUME~1\TestMachine\LOCALS~1\Temp\d-shm
- delete - file - C:\DOCUME~1\TestMachine\LOCALS~1\Temp\d-wal
- write - file - PIPE\lsarpc
- write - file - C:\DOCUME~1\TestMachine\LOCALS~1\Temp\3065_appcompat.txt
- write - file - C:\DOCUME~1\TestMachine\LOCALS~1\Temp\3065_appcompat.txt
Registry level activity- write - registry - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell FoldersCache
- write - registry - HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\CachePathsDirectory
- write - registry - HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\CachePathsPaths
- write - registry - HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\CachePathsPath1CachePath
- write - registry - HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\CachePathsPath2CachePath
- write - registry - HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\CachePathsPath3CachePath
- write - registry - HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\CachePathsPath4CachePath
- write - registry - HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\CachePathsPath1CacheLimit
- write - registry - HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\CachePathsPath2CacheLimit
- write - registry - HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\CachePathsPath3CacheLimit
- write - registry - HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\CachePathsPath4CacheLimit
- write - registry - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell FoldersCookies
- write - registry - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell FoldersHistory
Library level activity- load - library - KERNEL32
- load - library - KERNEL32.dll
- load - library - USER32.dll
- load - library - GDI32.dll
- load - library - WINSPOOL.DRV
- load - library - ADVAPI32.dll
- load - library - SHELL32.dll
- load - library - COMCTL32.dll
- load - library - SHLWAPI.dll
- load - library - ole32.dll
- load - library - OLEAUT32.dll
- load - library - oledlg.dll
- load - library - ESENT.dll
- load - library - IPHLPAPI.DLL
- load - library - NETAPI32.dll
- load - library - d3d9.dll
- load - library - VERSION.dll
- load - library - QUARTZ.dll
- load - library - OLEACC.dll
- load - library - kernel32.dll
- load - library - advapi32.dll
- load - library - ntdll.dll
- load - library - Wininet.dll
- load - library - Iepmapi.dll
- load - library - Ieframe.dll
- load - library - netapi32.dll
- load - library - C:\DOCUME~1\TestMachine\LOCALS~1\Temp\ca5022a05c6de9df582ed7f063dc4117ENU.dll
- load - library - C:\DOCUME~1\TestMachine\LOCALS~1\Temp\ca5022a05c6de9df582ed7f063dc4117LOC.dll
- load - library - Kernel32.dll
- load - library - Comctl32.dll
- load - library - shell32.dll
- load - library - C:\DOCUME~1\TestMachine\LOCALS~1\Temp\ca5022a05c6de9df582ed7f063dc4117.bin
- load - library - Secur32.dll
- load - library - rnaapp.exe
- load - library - C:\WINDOWS\system32\faultrep.dll
- load - library - C:\Documents and Settings\TestMachine\Local Settings\Temp\ca5022a05c6de9df582ed7f063dc4117.bin
- load - library - C:\WINDOWS\system32\kernel32.dll
- load - library - ddraw.dll
- load - library - d3d8.dll
- load - library - C:\WINDOWS\system32\apphelp.dll
- load - library - C:\WINDOWS\system32\kernel32.dll
Process API calls used
- VirtualProtectEx
- NtOpenSection
- ZwMapViewOfSection
- NtCreateSection
- NtFreeVirtualMemory
- CreateProcessInternalW
Registry API calls used
- RegOpenKeyExW
- RegQueryValueExW
- RegCloseKey
- RegCreateKeyExW
- RegOpenKeyExA
- RegQueryValueExA
- NtOpenKey
- NtQueryValueKey
- RegSetValueExW
- RegSetValueExA
- RegEnumKeyExA
- RegDeleteKeyW
- RegQueryValueExW
System API calls used
- LdrGetDllHandle
- LdrGetProcedureAddress
- LdrLoadDll
- NtDelayExecution
- SetWindowsHookExW
- LdrGetProcedureAddress
Filesystem API calls used
- NtCreateFile
- NtOpenFile
- NtDeviceIoControlFile
- NtQueryInformationFile
- NtSetInformationFile
- NtWriteFile
- NtReadFile
- DeleteFileW
- FindFirstFileExW
- NtOpenDirectoryObject
- NtQueryDirectoryFile
- NtWriteFile
Network
UDP source >> destination - 192.168.30.254 >> 192.168.30.7
- 192.168.30.7 >> 192.168.30.255
TCP source >> destination - 192.168.30.7 >> 192.168.30.254
Domains: DNS Request: HTTP Request: DLL related data Number of DLL's imported = 0
|