请大家帮忙分析一个新发现的病毒的行为

显示全部楼层 · 发表于 2009-11-8 09:43:39

分析结果 http://camas.comodo.com/cgi-bin/ ... cfe5f7bb1804cc487df
• File Info

Name	Value
Size	100616
MD5	be049e75bfea8fa1e194e656d6831757
SHA1	b7e26a7381ae982cb8f46c34b1f36260885ed194
SHA256	cd6dc594e3ebd6eebaca067812961b1f599ee8d58dc0bcfe5f7bb1804cc487df
Process	Active

• Keys Created• Keys Changed• Keys Deleted• Values Created• Values Changed

Name	Type	Size	Value
CU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Hidden	REG_DWORD/REG_DWORD	4/4	0x1/0x2
CU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt	REG_DWORD/REG_DWORD	4/4	0x0/0x1
CU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden	REG_DWORD/REG_DWORD	4/4	0x1/0x0
CU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\WebViewBarricade	REG_DWORD/REG_DWORD	4/4	0x1/0x0
CU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Startup	REG_SZ/REG_SZ	118/138	"C:\Documentsand Settings\User\Start Menu\Programs\Startup"/"C:\Documents andSettings\User\Local Settings\Application Data\Start"
CU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Startup	REG_EXPAND_SZ/REG_SZ	84/138	"%USERPROFILE%\Start Menu\Programs\Startup"/"C:\Documents and Settings\User\Local Settings\Application Data\Start"

• Values Deleted• Directories Created

Name	Last Write Time	Creation Time	Last Access Time	Attr
C:\Documents and Settings\User\Local Settings\Application Data\S-1-5-31-1286970278978-5713669491-166975984-320	2008.10.31 11:22:48.000	2007.07.27 12:00:00.000	2008.09.11 09:02:36.250	0x17
C:\Documents and Settings\User\Local Settings\Application Data\S-1-5-31-1286970278978-5713669491-166975984-320\dmc	2008.10.31 11:22:48.000	2007.07.27 12:00:00.000	2008.09.11 09:02:36.250	0x17
C:\Documents and Settings\User\Local Settings\Application Data\S-1-5-31-1286970278978-5713669491-166975984-320\Rotinom	2008.10.31 11:22:48.000	2007.07.27 12:00:00.000	2008.09.11 09:02:36.250	0x17
C:\Documents and Settings\User\Local Settings\Application Data\S-1-5-31-1286970278978-5713669491-166975984-320\tlsr	2008.10.31 11:22:48.000	2007.07.27 12:00:00.000	2008.09.11 09:02:36.250	0x17
C:\Documents and Settings\User\Local Settings\Application Data\Start	2009.01.12 14:47:59.515	2009.01.12 14:47:59.515	2009.01.12 14:47:59.515	0x17
C:\TEST\sample	2009.01.12 14:48:00.859	2009.01.12 14:48:00.859	2009.01.12 14:48:00.859	0x17

• Directories Changed• Directories Deleted• Files Created

Name	Size	Last Write Time	Creation Time	Last Access Time	Attr
C:\Documents and Settings\User\Local Settings\Application Data\Start\update.exe	100616	2008.10.31 11:22:48.000	2007.07.27 12:00:00.000	2008.09.11 09:02:36.250	0x20

• Files Changed• Files Deleted• Directories Hidden• Files Hidden• Drivers Loaded• Drivers Unloaded• Processes Created• Processes Terminated• Threads Created

PId	Process Name	TId	Start	Start Mem	Win32 Start	Win32 Start Mem
0x344	svchost.exe	0x170	0x7c810856	MEM_IMAGE	0x7c910760	MEM_IMAGE

• Modules Loaded• Windows Api Calls

PId	Image Name	Address	Function ( Parameters ) \| Return Value
0x358	C:\TEST\sample.exe	0x40287a	CopyFileW(lpExistingFileName:"C:\TEST\sample.exe", lpNewFileName: "C:\Documents andSettings\User\Local Settings\Application Data\Start\update.exe",bFailIfExists: 0x0)\|0x1

• DNS Queries• HTTP Queries• Verdict

Auto Analysis Verdict

Suspicious

• Description

Suspicious Actions Detected

Copies self to other locations

• Mutexes Created or Opened

PId	Image Name	Address	Mutex Name
0x358	C:\TEST\sample.exe	0x4035aa	LDLLMAIN

显示全部楼层 · 发表于 2009-11-8 09:57:53

2009-11-08 09:57:02 创建注册表值    操作:阻止
进程路径:C:\Documents and Settings\Administrator\桌面\新建文件夹\form\2009年海淀区企业知识产权保护体系专项专家评审表.exe
注册表路径:HKEY_CURRENT_USER\user\current\software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
注册表名称:Local AppData
触发规则:所有程序规则->A07…系统和软件操作（黑白）->*\Software\Microsoft\Windows*\*

2009-11-08 09:57:02 创建注册表值    操作:阻止
进程路径:C:\Documents and Settings\Administrator\桌面\新建文件夹\form\2009年海淀区企业知识产权保护体系专项专家评审表.exe
注册表路径:HKEY_CURRENT_USER\user\current\software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
注册表名称:Local AppData
触发规则:所有程序规则->A07…系统和软件操作（黑白）->*\Software\Microsoft\Windows*\*

2009-11-08 09:57:02 创建注册表值    操作:阻止
进程路径:C:\Documents and Settings\Administrator\桌面\新建文件夹\form\2009年海淀区企业知识产权保护体系专项专家评审表.exe
注册表路径:HKEY_CURRENT_USER\user\current\software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
注册表名称:Hidden
触发规则:所有程序规则->A07…系统和软件操作（黑白）->*\Software\Microsoft\Windows*\*

2009-11-08 09:57:02 创建注册表值    操作:阻止
进程路径:C:\Documents and Settings\Administrator\桌面\新建文件夹\form\2009年海淀区企业知识产权保护体系专项专家评审表.exe
注册表路径:HKEY_CURRENT_USER\user\current\software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
注册表名称:Hidden
触发规则:所有程序规则->A07…系统和软件操作（黑白）->*\Software\Microsoft\Windows*\*

2009-11-08 09:57:02 创建注册表值    操作:阻止
进程路径:C:\Documents and Settings\Administrator\桌面\新建文件夹\form\2009年海淀区企业知识产权保护体系专项专家评审表.exe
注册表路径:HKEY_CURRENT_USER\user\current\software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
注册表名称:Startup
触发规则:所有程序规则->A07…系统和软件操作（黑白）->*\Software\Microsoft\Windows*\*

2009-11-08 09:57:02 创建注册表值    操作:阻止
进程路径:C:\Documents and Settings\Administrator\桌面\新建文件夹\form\2009年海淀区企业知识产权保护体系专项专家评审表.exe
注册表路径:HKEY_CURRENT_USER\user\current\software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
注册表名称:Startup
触发规则:所有程序规则->A07…系统和软件操作（黑白）->*\Software\Microsoft\Windows*\*

2009-11-08 09:57:02 创建注册表值    操作:阻止
进程路径:C:\Documents and Settings\Administrator\桌面\新建文件夹\form\2009年海淀区企业知识产权保护体系专项专家评审表.exe
注册表路径:HKEY_CURRENT_USER\user\current\software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
注册表名称:Startup
触发规则:所有程序规则->A07…系统和软件操作（黑白）->*\Software\Microsoft\Windows*\*

2009-11-08 09:57:02 创建注册表值    操作:阻止
进程路径:C:\Documents and Settings\Administrator\桌面\新建文件夹\form\2009年海淀区企业知识产权保护体系专项专家评审表.exe
注册表路径:HKEY_CURRENT_USER\user\current\software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
注册表名称:Startup
触发规则:所有程序规则->A07…系统和软件操作（黑白）->*\Software\Microsoft\Windows*\*

显示全部楼层 · 发表于 2009-11-8 10:09:59

某工具记录得还行
PID: 1768, 0x7D5BF51A: RegCreateKeyExW(key: HKEY_CURRENT_USER, subkey: Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders) -> SUCCESS
PID: 1768, --- handle: 0000076C
PID: 1768, 0x7D5F9C96: GetFileAttributesW(C:\Documents and Settings\Administrator\Local Settings\Application Data)
PID: 1768, 0x7D5BF51A: RegCreateKeyExW(key: HKEY_CURRENT_USER, subkey: Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders) -> SUCCESS
PID: 1768, --- handle: 0000076C
PID: 1768, 0x7D5F9CFF: RegSetValueExW(keyHandle: 0000076C, valueName: Local AppData, data: C:\Documents and Settings\Administrator\Local Settings\Application Data) -> SUCCESS
PID: 1768, 0x00402ACF: CreateFileW(file: C:\Documents and Settings\Administrator\Local Settings\Application Data\S-1-5-31-1286970278978-5713669491-166975984-320, OPEN_EXISTING)
PID: 1768, -- CreateFileW result - fHandle: FFFFFFFF
PID: 1768, 0x00402B0A: SetFileAttributesW(file: C:\Documents and Settings\Administrator\Local Settings\Application Data\S-1-5-31-1286970278978-5713669491-166975984-320, attrs: 00000007)
PID: 1768, 0x00402B87: CreateFileW(file: C:\WINDOWS\system32\KERNEL32.DLL, OPEN_EXISTING)
PID: 1768, -- CreateFileW result - fHandle: 00000768
PID: 1768, 0x00402BC4: SetFileTime(h: 0000076C)
PID: 1768, 0x00402ACF: CreateFileW(file: C:\Documents and Settings\Administrator\Local Settings\Application Data\S-1-5-31-1286970278978-5713669491-166975984-320\dmc, OPEN_EXISTING)
PID: 1768, -- CreateFileW result - fHandle: FFFFFFFF
PID: 1768, 0x00402B0A: SetFileAttributesW(file: C:\Documents and Settings\Administrator\Local Settings\Application Data\S-1-5-31-1286970278978-5713669491-166975984-320\dmc, attrs: 00000007)
PID: 1768, 0x00402B87: CreateFileW(file: C:\WINDOWS\system32\KERNEL32.DLL, OPEN_EXISTING)
PID: 1768, -- CreateFileW result - fHandle: 00000768
PID: 1768, 0x00402BC4: SetFileTime(h: 0000076C)
PID: 1768, 0x00402ACF: CreateFileW(file: C:\Documents and Settings\Administrator\Local Settings\Application Data\S-1-5-31-1286970278978-5713669491-166975984-320\tlsr, OPEN_EXISTING)
PID: 1768, -- CreateFileW result - fHandle: FFFFFFFF
PID: 1768, 0x00402B0A: SetFileAttributesW(file: C:\Documents and Settings\Administrator\Local Settings\Application Data\S-1-5-31-1286970278978-5713669491-166975984-320\tlsr, attrs: 00000007)
PID: 1768, 0x00402B87: CreateFileW(file: C:\WINDOWS\system32\KERNEL32.DLL, OPEN_EXISTING)
PID: 1768, -- CreateFileW result - fHandle: 00000768
PID: 1768, 0x00402BC4: SetFileTime(h: 0000076C)
PID: 1768, 0x00402ACF: CreateFileW(file: C:\Documents and Settings\Administrator\Local Settings\Application Data\S-1-5-31-1286970278978-5713669491-166975984-320\Rotinom, OPEN_EXISTING)
PID: 1768, -- CreateFileW result - fHandle: FFFFFFFF
PID: 1768, 0x00402B0A: SetFileAttributesW(file: C:\Documents and Settings\Administrator\Local Settings\Application Data\S-1-5-31-1286970278978-5713669491-166975984-320\Rotinom, attrs: 00000007)
PID: 1768, 0x00402B87: CreateFileW(file: C:\WINDOWS\system32\KERNEL32.DLL, OPEN_EXISTING)
PID: 1768, -- CreateFileW result - fHandle: 00000768
PID: 1768, 0x00402BC4: SetFileTime(h: 0000076C)
PID: 1768, 0x004022B5: RegOpenKeyExW(key: HKEY_CURRENT_USER, subkey: Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced) -> SUCCESS
PID: 1768, --- handle: 0000076C
PID: 1768, 0x00402319: RegSetValueExW(keyHandle: 0000076C, valueName: Hidden, data: ) -> SUCCESS
PID: 1768, 0x00402373: RegSetValueExW(keyHandle: 0000076C, valueName: HideFileExt, data: ) -> SUCCESS
PID: 1768, 0x004023E3: RegSetValueExW(keyHandle: 0000076C, valueName: ShowSuperHidden, data: ) -> SUCCESS
PID: 1768, 0x00402443: RegSetValueExW(keyHandle: 0000076C, valueName: WebViewBarricade, data: ) -> SUCCESS
PID: 1768, 0x004027F3: SetFileAttributesW(file: C:\Documents and Settings\Administrator\Local Settings\Application Data\Start, attrs: 00000007)
PID: 1768, 0x0040280D: CreateFileW(file: C:\Documents and Settings\Administrator\Local Settings\Application Data\Start, OPEN_EXISTING)
PID: 1768, -- CreateFileW result - fHandle: FFFFFFFF
PID: 1768,
PID: 1768, 0x00402896: CreateFileW(file: C:\Documents and Settings\Administrator\Local Settings\Application Data\Start\update.exe, OPEN_EXISTING)
PID: 1768, -- CreateFileW result - fHandle: 00000768
PID: 1768, 0x004028B6: SetFileTime(h: 00000768)
PID: 1768, 0x004028DA: RegOpenKeyExW(key: HKEY_CURRENT_USER, subkey: SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders) -> SUCCESS
PID: 1768, --- handle: 00000768
PID: 1768, 0x0040298F: RegSetValueExW(keyHandle: 00000768, valueName: Startup, data: C:\Documents and Settings\Administrator\Local Settings\Application Data\Start) -> SUCCESS
PID: 1768, 0x004029B1: RegOpenKeyExW(key: HKEY_CURRENT_USER, subkey: SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders) -> SUCCESS
PID: 1768, --- handle: 00000768
PID: 1768, 0x00402A4F: RegSetValueExW(keyHandle: 00000768, valueName: Startup, data: C:\Documents and Settings\Administrator\Local Settings\Application Data\Start) -> SUCCESS
PID: 1768, 0x00402CB3: CreateFileW(file: \\.\C:, OPEN_EXISTING)
PID: 1768, -- CreateFileW result - fHandle: 00000768
PID: 1768,
PID: 1768,
PID: 1768, 0x00402CB3: CreateFileW(file: \\.\C:, OPEN_EXISTING)
PID: 1768, -- CreateFileW result - fHandle: 000006F4
PID: 1768, 0x004035AA: CreateMutexW(name: LDLLMAIN, owner: 00000000)
PID: 1768, 0x00403B17: RegOpenKeyExW(key: HKEY_LOCAL_MACHINE, subkey: SYSTEM\CurrentControlSet\Services\USBSTOR\Enum) -> FAIL
PID: 1768, 0x00403B17: RegOpenKeyExW(key: HKEY_LOCAL_MACHINE, subkey: SYSTEM\CurrentControlSet\Services\USBSTOR\Enum) -> FAIL
PID: 1768, 0x00403B17: RegOpenKeyExW(key: HKEY_LOCAL_MACHINE, subkey: SYSTEM\CurrentControlSet\Services\USBSTOR\Enum) -> FAIL

显示全部楼层 · 发表于 2009-11-8 11:11:35

动态分析.

有图看 : http://xandora.security.net.my/?p=657

[病毒样本] 请大家帮忙分析一个新发现的病毒的行为

本帖子中包含更多资源