分析看出是个恶意程序，文件行为：
1、自我复制
2、建立可执行脚本
3、在WINDOWS系统目录下创建文件
4、创建服务及驱动
• Keys Created
Name Last Write Time
LM\System\CurrentControlSet\Services\NTService 2009.01.12 14:47:55.125
LM\System\CurrentControlSet\Services\NTService\Enum 2009.01.12 14:47:55.125
LM\System\CurrentControlSet\Services\NTService\Security 2009.01.12 14:47:54.687
• Values Created
Name Type Size Value
LM\System\CurrentControlSet\Services\NTService\Description REG_SZ 238 "For the security of Windows NT servies. An important System service, If it was terminated, Windows would be Collapsed."
LM\System\CurrentControlSet\Services\NTService\DisplayName REG_SZ 38 "Windows NT Service"
LM\System\CurrentControlSet\Services\NTService\Enum\0 REG_SZ 54 "Root\LEGACY_NTSERVICE\0000"
LM\System\CurrentControlSet\Services\NTService\Enum\Count REG_DWORD 4 0x1
LM\System\CurrentControlSet\Services\NTService\Enum\NextInstance REG_DWORD 4 0x1
LM\System\CurrentControlSet\Services\NTService\ErrorControl REG_DWORD 4 0x1
LM\System\CurrentControlSet\Services\NTService\ImagePath REG_EXPAND_SZ 54 "C:\WINDOWS\system\smss.exe"
LM\System\CurrentControlSet\Services\NTService\ObjectName REG_SZ 24 "LocalSystem"
LM\System\CurrentControlSet\Services\NTService\Security\Security REG_BINARY 168 ?
LM\System\CurrentControlSet\Services\NTService\Start REG_DWORD 4 0x2
LM\System\CurrentControlSet\Services\NTService\Type REG_DWORD 4 0x10
• Values Changed
Name Type Size Value
LM\System\CurrentControlSet\Control\ServiceCurrent\ REG_DWORD/REG_DWORD 4/4 0x8/0x9
• Files Created
Name Size Last Write Time Creation Time Last Access Time Attr
C:\WINDOWS\system\smss.exe 57344 2009.01.12 14:47:53.390 2009.01.12 14:47:53.968 2009.01.12 14:47:53.968 0x7
• Processes Created
PId Process Name Image Name
0x36c cmd.exe C:\WINDOWS\system32\cmd.exe
0x374 smss.exe C:\WINDOWS\system\smss.exe
0x7d0 smss.exe C:\WINDOWS\system\smss.exe
• Threads Created
PId Process Name TId Start Start Mem Win32 Start Win32 Start Mem
0x344 svchost.exe 0x170 0x7c810856 MEM_IMAGE 0x7c910760 MEM_IMAGE
0x36c cmd.exe 0x370 0x7c810867 MEM_IMAGE 0x4ad05056 MEM_IMAGE
0x374 smss.exe 0x7cc 0x7c810867 MEM_IMAGE 0x140049c3 MEM_IMAGE
0x404 svchost.exe 0x7a8 0x7c810856 MEM_IMAGE 0x762cf0a3 MEM_IMAGE
0x404 svchost.exe 0x7ac 0x7c810856 MEM_IMAGE 0x7529edb3 MEM_IMAGE
0x404 svchost.exe 0x7b8 0x7c810856 MEM_IMAGE 0x7529e44b MEM_IMAGE
0x404 svchost.exe 0x7bc 0x7c810856 MEM_IMAGE 0x762cf0a3 MEM_IMAGE
0x7d0 smss.exe 0x7d8 0x7c810867 MEM_IMAGE 0x140049c3 MEM_IMAGE
0x7d0 smss.exe 0x7dc 0x7c810856 MEM_IMAGE 0x77deb479 MEM_IMAGE
• Modules Loaded
PId Process Name Base Size Flags Image Name
0x404 svchost.exe 0x73d30000 0x17000 0x800c4004 C:\WINDOWS\system32\wbem\wbemcons.dll
• Windows Api Calls
PId Image Name Address Function ( Parameters ) | Return Value
0x358 C:\TEST\sample.exe 0x14001143 CopyFileA(lpExistingFileName: "C:\TEST\sample.exe", lpNewFileName: "C:\WINDOWS\system\smss.exe", bFailIfExists: 0x0)|0x1
0x358 C:\TEST\sample.exe 0x14001143 CopyFileA(lpExistingFileName: "C:\TEST\sample.exe", lpNewFileName: "C:\WINDOWS\system\smss.exe", bFailIfExists: 0x0)|0x1
0x358 C:\TEST\sample.exe 0x14001143 CopyFileA(lpExistingFileName: "C:\TEST\sample.exe", lpNewFileName: "C:\WINDOWS\system\smss.exe", bFailIfExists: 0x0)|0x1
0x358 C:\TEST\sample.exe 0x14001143 CopyFileA(lpExistingFileName: "C:\TEST\sample.exe", lpNewFileName: "C:\WINDOWS\system\smss.exe", bFailIfExists: 0x0)|0x1
0x358 C:\TEST\sample.exe 0x14001143 CopyFileA(lpExistingFileName: "C:\TEST\sample.exe", lpNewFileName: "C:\WINDOWS\system\smss.exe", bFailIfExists: 0x0)|0x1
0x358 C:\TEST\sample.exe 0x14001143 CopyFileA(lpExistingFileName: "C:\TEST\sample.exe", lpNewFileName: "C:\WINDOWS\system\smss.exe", bFailIfExists: 0x0)|0x1
0x358 C:\TEST\sample.exe 0x14001143 CopyFileA(lpExistingFileName: "C:\TEST\sample.exe", lpNewFileName: "C:\WINDOWS\system\smss.exe", bFailIfExists: 0x0)|0x1
0x358 C:\TEST\sample.exe 0x14001143 CopyFileA(lpExistingFileName: "C:\TEST\sample.exe", lpNewFileName: "C:\WINDOWS\system\smss.exe", bFailIfExists: 0x0)|0x1
0x358 C:\TEST\sample.exe 0x14001143 CopyFileA(lpExistingFileName: "C:\TEST\sample.exe", lpNewFileName: "C:\WINDOWS\system\smss.exe", bFailIfExists: 0x0)|0x1
0x358 C:\TEST\sample.exe 0x14001143 CopyFileA(lpExistingFileName: "C:\TEST\sample.exe", lpNewFileName: "C:\WINDOWS\system\smss.exe", bFailIfExists: 0x0)|0x1
0x374 C:\WINDOWS\system\smss.exe 0x140013dd CreateServiceA(hSCManager: 0x159a90, lpServiceName: "NTService", lpDisplayName: "Windows NT Service", dwDesiredAccess: 0xf01ff, dwServiceType: 0x10, dwStartType: 0x2, dwErrorControl: 0x1, lpBinaryPathName: "C:\WINDOWS\system\smss.exe", lpLoadOrderGroup: "(null)", lpdwTagId: 0x0, lpDependencies: 0x1400b068, lpServiceStartName: "(null)", lpPassword: 0x0)|0x159728
Rated as Suspicious
• Description
Suspicious Actions Detected
Copies self to other locations
Creates and executes scripts
Creates files in windows system directory
Creates system services or drivers
• Events Created or Opened
PId Image Name Address Event Name
0x374 C:\WINDOWS\system\smss.exe 0x77de5f48 Global\SvcctrlStartEvent_A3752DX
0x7d0 C:\WINDOWS\system\smss.exe 0x77de5f48 Global\SvcctrlStartEvent_A3752DX |
楼主: 彼岸あ天堂
发表于 2009-6-17 23:18:53
发表于 2009-6-18 16:44:58
