Mal/EncPk-NST exhibits the following characteristics:
File Information
- Size
- 35K
- SHA-1
- cce7fb738d4ee17d6103465e3fcb25d7704d3c1a
- MD5
- 6a16606ba99af0cc4e08da3935507f15
- CRC-32
- 21bb4e76
- File type
- Windows executable
- First seen
- 2013-01-02
Runtime Analysis
Copies Itself To
- c:\Documents and Settings\test user\Application Data\SYSTEM\SYSTEM.exe
Dropped Files
- c:\Documents and Settings\test user\Application Data\Microsoft\Windows\epbEK.cfg
- Size
- 2.0K
- SHA-1
- eee8c5faa47f1948b76cc1a60575965950b4eb3a
- MD5
- 621820db789ed5756931be80f8e09754
- CRC-32
- e21b8cb4
- File type
- Unspecified binary - probably data
- First seen
- 2013-01-02
- c:\Documents and Settings\test user\Application Data\Microsoft\Windows\epbEK.dat
- Size
- 2
- SHA-1
- 4700b42849fb35be323774820bf1bc8019d26c80
- MD5
- 84cad01fdb44ae58dbe6c3973dcd87f5
- CRC-32
- 4f349987
- File type
- Windows Codepage 1252
- First seen
- 2011-09-26
Registry Keys Created
- HKCU\Software\epbEK
- InstalledServer
- c:\Documents and Settings\test user\Application Data\SYSTEM\SYSTEM.exe
- HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
- SYSTEM
- c:\Documents and Settings\test user\Application Data\SYSTEM\SYSTEM.exe
- HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
- Load
- c:\Documents and Settings\test user\Application Data\SYSTEM\SYSTEM.exe
- HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{0S6Q2I71-1N51-QMPP-5VCP-C100I27NE52L}
- StubPath
- c:\Documents and Settings\test user\Application Data\SYSTEM\SYSTEM.exe restart
- HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
- SYSTEM
- c:\Documents and Settings\test user\Application Data\SYSTEM\SYSTEM.exe
- HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run
- SYSTEM
- c:\Documents and Settings\test user\Application Data\SYSTEM\SYSTEM.exe
- HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
- SYSTEM
- c:\Documents and Settings\test user\Application Data\SYSTEM\SYSTEM.exe
- HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
- SYSTEM
- c:\Documents and Settings\test user\Application Data\SYSTEM\SYSTEM.exe
- HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows
- Load
- c:\Documents and Settings\test user\Application Data\SYSTEM\SYSTEM.exe
- HKCU\Software\Microsoft\Windows\CurrentVersion\Run
- SYSTEM
- c:\Documents and Settings\test user\Application Data\SYSTEM\SYSTEM.exe
Registry Keys Modified
- HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
- Shell
- explorer.exe c:\Documents and Settings\test user\Application Data\SYSTEM\SYSTEM.exe
- HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
- Shell
- explorer.exe c:\Documents and Settings\test user\Application Data\SYSTEM\SYSTEM.exe
Processes Created
- c:\windows\system32\notepad.exe
- c:\windows\system32\svchost.exe
DNS Requests