Submission Summary:

• Submission details:
• Submission received: 3 August 2012, 07:04:42
• Processing time: 3 min 47 sec
• Submitted sample:
• File MD5: 0x15C4F45AEDE86BAFBD95AB745750C28B
• File SHA-1: 0xE11E8E13EF860063D047F2E3EDDD5C2073A08D22
• Filesize: 421,888 bytes

Technical Details:

File System Modifications

• The following files were created in the system:

• Notes:
• %CommonAppData% is a variable that refers to the file system directory containing application data for all users. A typical path is C:\Documents and Settings\All Users\Application Data.
• %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

• The following files were deleted:
• %LocalSettings%\History\desktop.ini
• %InternetCache%\desktop.ini

• Notes:
• %LocalSettings% is a variable that specifies the current user's local settings folder. By default, this is C:\Documents and Settings\[UserName]\Local Settings (Windows NT/2000/XP).
• %InternetCache% is a variable that refers to the file system directory that serves as a common repository for temporary Internet files. A typical path is C:\Documents and Settings\[UserName]\Local Settings\Temporary Internet Files.

• The following directory was created:
• %CommonAppData%\6F638C1AFE83369885976898E56C3425

Memory Modifications

• There was a new process created in the system:

• The following module was loaded into the address space of other process(es):

Module Name	Module Filename	Address Space Details
migpdump.dll	%System%\migpdump.dll	Process name: explorer.exe Process filename: %Windir%\explorer.exe Address space: 0x1E70000 - 0x1E81000

• Notes:
• %Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.

Registry Modifications

• The following Registry Keys were created:
• HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager\AppCertDlls
• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\AppCertDlls
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce
• HKEY_CURRENT_USER\Software\AppDataLow
• HKEY_CURRENT_USER\Software\AppDataLow\Software
• HKEY_CURRENT_USER\Software\AppDataLow\Software\Microsoft
• HKEY_CURRENT_USER\Software\AppDataLow\Software\Microsoft\Internet Explorer
• HKEY_CURRENT_USER\Software\AppDataLow\Software\Microsoft\Internet Explorer\Security
• HKEY_CURRENT_USER\Software\AppDataLow\Software\Microsoft\Internet Explorer\Security\AntiPhishing
• HKEY_CURRENT_USER\Software\AppDataLow\Software\Microsoft\Internet Explorer\Security\AntiPhishing\2EB8B042-32B9-3CC4-9653-2A3738FDEC81

• The newly created Registry Values are:
• [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager\AppCertDlls]
• csrspand = "%System%\migpdump.dll"
• [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\AppCertDlls]
• csrspand = "%System%\migpdump.dll"
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce]
• 6F638C1AFE83369885976898E56C3425 = "%CommonAppData%\6F638C1AFE83369885976898E56C3425\6F638C1AFE83369885976898E56C3425.exe"

so that 6F638C1AFE83369885976898E56C3425 runs every time Windows starts

• [HKEY_CURRENT_USER\Software\AppDataLow\Software\Microsoft\Internet Explorer\Security\AntiPhishing\2EB8B042-32B9-3CC4-9653-2A3738FDEC81]
• ID = 1D 23 DE 6D 28 D4 04 4C 82 B2 01 D7 6E A8 FB DC
• Group = 0x0000047A

Other details

• Analysis of the file resources indicate the following possible country of origin:

	Russian Federation

• There were registered attempts to establish connection with the remote hosts. The connection details are:

• The data identified by the following URLs was then requested from the remote web server:
• http://deks.oplipsies.com/api/urls/?ts=9ac678ac&affid=60830
• http://erse.oplipsies.com/f/notepad.exe?ts=9ac678ac&affid=6083