Submission Summary:

• Submission details:
• Submission received: 15 August 2012, 23:11:49
• Processing time: 7 min 46 sec
• Submitted sample:
• File MD5: 0x1EBA7F5DF146867B837E909A2FF9CF74
• File SHA-1: 0x70117AEBEF9942B0599E26B3765324181877135B
• Filesize: 224,776 bytes
• Alias: Win32.SuspectCrc [Ikarus]

• Summary of the findings:

What's been found	Severity Level
Downloads/requests other files from Internet.
Creates a startup registry entry.

Technical Details:

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%AppData%\Dyug\woixi.efp	1,277 bytes	MD5: 0xC179ED07E2974BF81EA5A958D97D43D1 SHA-1: 0x61CECE8D22376697DDDDDE1E7AF776773F4F8212	(not available)
2	%AppData%\Dyug\woixi.tmp	0 bytes	MD5: 0xD41D8CD98F00B204E9800998ECF8427E SHA-1: 0xDA39A3EE5E6B4B0D3255BFEF95601890AFD80709	(not available)
3	%AppData%\Xiuhca\oluhk.exe	224,776 bytes	MD5: 0x3352E9DC689C04352E2263E1F0FC2DFC SHA-1: 0x895C060AE169FC67E3AB8B18C589CA4A167124F8	Win32.SuspectCrc [Ikarus]
4	%Temp%\tmp05f3662b.bat	168 bytes	MD5: 0x87A69B5C50EE59435BB8AE6C0202960C SHA-1: 0x1BBD277729E7967BCE55C1FFC8B1FCA731DD2A76	(not available)
5	[file and pathname of the sample #1]	224,776 bytes	MD5: 0x1EBA7F5DF146867B837E909A2FF9CF74 SHA-1: 0x70117AEBEF9942B0599E26B3765324181877135B	Win32.SuspectCrc [Ikarus]

• Notes:
• %AppData% is a variable that refers to the file system directory that serves as a common repository for application-specific data. A typical path is C:\Documents and Settings\[UserName]\Application Data.
• %Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).

• The following directories were created:
• %AppData%\Dyug
• %AppData%\Xiuhca

Memory Modifications

• There were new processes created in the system:

• There was a new memory page created in the address space of the system process(es):

Process Name	Process Filename	Allocated Size
cmd.exe	%System%\cmd.exe	159,744 bytes

• Notes:
• %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

Registry Modifications

• The following Registry Keys were created:
• HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Privacy
• HKEY_CURRENT_USER\Software\Microsoft\Gomui

• The newly created Registry Values are:
• [HKEY_CURRENT_USER\Identities]
• Identity Login = 0x00098053
• [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Privacy]
• CleanCookies = 0x00000000
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
• {B5D7CA47-9DA3-6D6E-6A14-D979C54E8119} = ""%AppData%\Xiuhca\oluhk.exe""

so that oluhk.exe runs every time Windows starts

• [HKEY_CURRENT_USER\Software\Microsoft\Gomui]
• Zeduqio = E3 E3 B2 6A DD 8F 73 BE 78 92 8E 61 C1 FE 53 6F 88 24 A4 71 C3 3B 8E DF A9 DE 9E 9F 2E 67 A5 F2 5B 7E 0E DC F7 D5 C9 E0 ED 4E 50 BD 0A 11 63 F1 6D D3 97 AE 51 BA 71 66 74 9D 65 21 03 7D 07 D6 06 43 46 1B CB 2E 5C 18 FE 6D 1D BE 72 FA 61 14 9B CC D8 3

• The following Registry Values were modified:
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0]
• 1609 =
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1]
• 1406 =
• 1609 =
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2]
• 1609 =
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3]
• 1406 =
• 1609 =
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4]
• 1406 =
• 1609 =

Other details

• Analysis of the file resources indicate the following possible country of origin:

	Georgia

• To mark the presence in the system, the following Mutex object was created:
• Local\{7865D35E-84BA-A0DC-6A14-D979C54E8119}

• The following Internet Connection was established:

• The following GET request was made:
• alpha/config.bin