Kryptik.FM_22 is a Trojan. A Trojan is a program that pretends to have a valid use, but in fact modifies the user's computer in malicious ways. Trojans do not replicate or spread to other computers.
Mutexes created
Directory level activity
File level activity- write - file - PIPE\lsarpc
- write - file - C:\DOCUME~1\TestMachine\LOCALS~1\Temp\84d4_appcompat.txt
- write - file - C:\DOCUME~1\TestMachine\LOCALS~1\Temp\84d4_appcompat.txt
Registry level activity
Library level activity- load - library - KERNEL32.DLL
- load - library - kernel32.dll
- load - library - KERNEL32.dll
- load - library - USER32.dll
- load - library - ADVAPI32.dll
- load - library - SHELL32.dll
- load - library - ole32.dll
- load - library - WININET.dll
- load - library - WINHTTP.dll
- load - library - msvcr100.dll
- load - library - api-ms-win-core-synch-l1-2-0
- load - library - kernel32
- load - library - api-ms-win-core-fibers-l1-1-1
- load - library - api-ms-win-core-localization-l1-2-1
- load - library - C:\WINDOWS\system32\faultrep.dll
- load - library - C:\Documents and Settings\TestMachine\Local Settings\Temp\751675a571dd42a5f2f879a3612b885c.bin
- load - library - ddraw.dll
- load - library - d3d8.dll
- load - library - d3d9.dll
- load - library - C:\DOCUME~1\TestMachine\LOCALS~1\Temp\751675a571dd42a5f2f879a3612b885c.bin
- load - library - C:\WINDOWS\system32\apphelp.dll
- load - library - SHLWAPI.dll
- load - library - VERSION.dll
- load - library - C:\DOCUME~1\TestMachine\LOCALS~1\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\netfx_Core_x86.msi
- load - library - shell32.dll
- load - library - C:\DOCUME~1\TestMachine\LOCALS~1\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\netfx_Extended_x86.msi
- load - library - C:\DOCUME~1\TestMachine\LOCALS~1\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\RGB9RAST_x86.msi
- load - library - C:\DOCUME~1\TestMachine\LOCALS~1\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\Setup.exe
- load - library - C:\DOCUME~1\TestMachine\LOCALS~1\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\SetupEngine.dll
- load - library - C:\DOCUME~1\TestMachine\LOCALS~1\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\SetupUi.dll
- load - library - C:\DOCUME~1\TestMachine\LOCALS~1\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\SetupUtility.exe
- load - library - C:\DOCUME~1\TestMachine\LOCALS~1\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\sqmapi.dll
- load - library - C:\DOCUME~1\TestMachine\LOCALS~1\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1025\SetupResources.dll
- load - library - C:\DOCUME~1\TestMachine\LOCALS~1\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1028\SetupResources.dll
- load - library - C:\DOCUME~1\TestMachine\LOCALS~1\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1029\SetupResources.dll
- load - library - C:\DOCUME~1\TestMachine\LOCALS~1\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1030\SetupResources.dll
- load - library - C:\DOCUME~1\TestMachine\LOCALS~1\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1031\SetupResources.dll
- load - library - C:\DOCUME~1\TestMachine\LOCALS~1\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1032\SetupResources.dll
- load - library - C:\DOCUME~1\TestMachine\LOCALS~1\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1033\SetupResources.dll
- load - library - C:\DOCUME~1\TestMachine\LOCALS~1\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1035\SetupResources.dll
- load - library - C:\DOCUME~1\TestMachine\LOCALS~1\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1036\SetupResources.dll
- load - library - C:\DOCUME~1\TestMachine\LOCALS~1\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1037\SetupResources.dll
- load - library - C:\DOCUME~1\TestMachine\LOCALS~1\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1038\SetupResources.dll
- load - library - C:\DOCUME~1\TestMachine\LOCALS~1\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1040\SetupResources.dll
- load - library - C:\DOCUME~1\TestMachine\LOCALS~1\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1041\SetupResources.dll
- load - library - C:\DOCUME~1\TestMachine\LOCALS~1\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1042\SetupResources.dll
- load - library - C:\DOCUME~1\TestMachine\LOCALS~1\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1043\SetupResources.dll
- load - library - C:\DOCUME~1\TestMachine\LOCALS~1\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1044\SetupResources.dll
- load - library - C:\DOCUME~1\TestMachine\LOCALS~1\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1045\SetupResources.dll
- load - library - C:\DOCUME~1\TestMachine\LOCALS~1\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1046\SetupResources.dll
- load - library - C:\DOCUME~1\TestMachine\LOCALS~1\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1049\SetupResources.dll
- load - library - C:\DOCUME~1\TestMachine\LOCALS~1\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1053\SetupResources.dll
- load - library - C:\DOCUME~1\TestMachine\LOCALS~1\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\1055\SetupResources.dll
- load - library - C:\DOCUME~1\TestMachine\LOCALS~1\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\2052\SetupResources.dll
- load - library - C:\DOCUME~1\TestMachine\LOCALS~1\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\2070\SetupResources.dll
- load - library - C:\DOCUME~1\TestMachine\LOCALS~1\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\3076\SetupResources.dll
- load - library - C:\DOCUME~1\TestMachine\LOCALS~1\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\3082\SetupResources.dll
- load - library - C:\WINDOWS\system32\kernel32.dll
- load - library - C:\WINDOWS\system32\kernel32.dll
Process API calls used
- VirtualProtectEx
- NtFreeVirtualMemory
- NtCreateSection
- ZwMapViewOfSection
- CreateProcessInternalW
Registry API calls used
- NtOpenKey
- NtQueryValueKey
- RegOpenKeyExW
- RegCreateKeyExW
- RegDeleteKeyW
- RegQueryValueExW
- RegCloseKey
- NtQueryValueKey
System API calls used
- LdrGetDllHandle
- LdrGetProcedureAddress
- LdrLoadDll
- LdrLoadDll
Filesystem API calls used
- FindFirstFileExW
- NtCreateFile
- NtSetInformationFile
- NtWriteFile
- NtReadFile
- NtOpenDirectoryObject
- NtQueryDirectoryFile
- NtOpenFile
- NtQueryInformationFile
- NtWriteFile
Network
Domains:NA DNS Request:NA HTTP Request:NA DLL related data Number of DLL's imported = 3
- KERNEL32.dll
- USER32.dll
- MSIMG32.dll
|