Troj/Agent-AWUK

File Information

Size

180K

SHA-1

47fb3f1ee06e26acf755a7de2d919aacecbacce5

MD5

b338d7265fbb65e3671719fce607bf70

CRC-32

63477608

File type

Windows executable

First seen

2015-08-19

Other vendor detection

Avira

TR/Crypt.Xpack.wgukt

Runtime Analysis

Modified Files

• C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files
  • Set the hidden and system flags
• C:\Documents and Settings\LocalService\Local Settings\History
  • Set the hidden and system flags

Registry Keys Created

• HKLM\SYSTEM\CurrentControlSet\Services\cryptcert

  Description

  Configures hard disk drives and volumes. The service only runs for configuration processes and then stops.

• HKLM\SYSTEM\CurrentControlSet\Services\cryptcert\Security

  Security

  □□□@□□□□□□□□□□□□□□@□□□□□□□□□□□ □□□□□□□□□□□ □□@□□□□□□□□□□□□□□□□□□□□□□□□□□ □□□□□@□□□□□□□□@□□□□□ □□□□□□□□□□□□□□ □□□□□□□□□□□□□□□□□□□□□□□□□□□□□□□□□□□□□□□□□□□□@□□□□□ □□□□□□□□□□□□□□□□□□□□□□□□□□□□□ □□□□□□□□□□□□□□□□□□□□0□□□□□□□□□□□□□□□□□ □□□□□□□□□□□□□□□□□ □□□□□

• HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections

  DefaultConnectionSettings

  <□□□□□□□□□□□□□□□□□□□□□□□□□□□□□□□□□□□@□□□□□□□□□□□□□□□□□□□□0□□□□□□□□□□□□□□□□□□□□□□□□□□

• HKLM\SYSTEM\CurrentControlSet\Services\cryptcert\Enum

  NextInstance

  0x00000001

• HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections

  DefaultConnectionSettings

  <□□□□□□□□□□□□□□□□□□□□□□□□□□□□□□□□□□□@□□□□□□□□□□□□□□□□□□□□0□□□□□□□□□□□□□□□□□□□□□□□□□□

Registry Keys Modified

• HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths

  Directory

  C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5

• HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3

  CachePath

  C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Cache3

• HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4

  CachePath

  C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Cache4

• HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections

  SavedLegacySettings

  3c 00 00 00 03 00 00 00 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

• HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2

  CachePath

  C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Cache2

• HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

  History

  C:\Documents and Settings\LocalService\Local Settings\History

• HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections

  SavedLegacySettings

  3c 00 00 00 03 00 00 00 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

• HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1

  CachePath

  C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Cache1

• HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

  History

  C:\Documents and Settings\LocalService\Local Settings\History

Processes Created

• c:\windows\system32\cryptcert.exe

IP Connections

• 178.79.132.214:443
• 192.81.212.79:443