The cryptographic service provider is a library that implements cryptography-related APIs in Microsoft Windows. For the malware sample to initialize and use one of these providers, it executes the CryptAcquireContext API, as follows:
CryptAcquireContext(&hProv,NULL,MS_STRONG_PROV,PROV_RSA_FULL,0);
The provider can tell you a lot about the algorithm that can be used for the encryption process, as well as the most common values used by malware authors:
- PROV_RSA_FULL: This provides access to DES, Triple DES, RC2, and RC4 for encryption, as well as RSA for key exchange and signatures
- PROV_RSA_AES: This is used for AES, RC2, and RC4 encryption (again, together with RSA)
You can find all the supported providers in your system in the registry in the following key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Defaults\Provider
