ThreatExpert Report: Mal/EncPk-JB

Submission Summary:

Submission details:

Submission received: 24 July 2009, 21:09:58
Processing time: 5 min 34 sec
Submitted sample:

File MD5: 0x348BA619AAB3A92B99701335F95FE2A7
File SHA-1: 0x0D349443338CEA889962B599F81ED40C78C5AD0C
Filesize: 35,840 bytes
Alias: Mal/EncPk-JB [Sophos]

Summary of the findings:

What's been found	Severity Level
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

Attention! Characteristics of the following security risk was identified in the system:

Security Risk	Description
Trojan-Downloader.Small.GEN	Trojan-Downloader.Small.GEN contacts remote servers in order to download additional malware onto a users computer without their knowledge.

File System Modifications

The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%Temp%\WER7cfe.dir00\appcompat.txt	16,296 bytes	MD5: 0xF560A82E9385739415E085B4553CBA8F SHA-1: 0x958B55E9517896C07D689F6BDDED4EF10D0718A9	(not available)
2	%Temp%\WER7cfe.dir00\explorer.exe.hdmp	0 bytes	MD5: 0xD41D8CD98F00B204E9800998ECF8427E SHA-1: 0xDA39A3EE5E6B4B0D3255BFEF95601890AFD80709	(not available)
3	%Temp%\WER7cfe.dir00\explorer.exe.mdmp	60,049 bytes	MD5: 0x8CFABCD5648E179909EC62107271CB5C SHA-1: 0xF6DC140CF23CA02CFBBFBE225ACF12D4A6E6E4A7	(not available)
4	%Temp%\WER7cfe.dir00\manifest.txt	1,980 bytes	MD5: 0x4144B70656A4EA6332181658B8F81A4A SHA-1: 0x5F8BE1988B04B5C977CC5914B28371C0024AE741	(not available)
5	%System%\wbem\proquota.exe	35,840 bytes	MD5: 0x348BA619AAB3A92B99701335F95FE2A7 SHA-1: 0x0D349443338CEA889962B599F81ED40C78C5AD0C	Mal/EncPk-JB [Sophos]

Notes:

%Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).
%System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

The following file was deleted:

%System%\proquota.exe

The following directory was created:

%Temp%\WER7cfe.dir00

Memory Modifications

There was a new process created in the system:

Process Name	Process Filename	Main Module Size
[filename of the sample #1]	[file and pathname of the sample #1]	61,440 bytes

There were new memory pages created in the address space of the system process(es):

Process Name	Process Filename	Allocated Size
svchost.exe	%System%\svchost.exe	65,536 bytes
svchost.exe	%System%\svchost.exe	65,536 bytes

Registry Modifications

The following Registry Keys were created:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System

The newly created Registry Values are:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers]

%Windir%\explorer.exe = "EnableNXShowUI"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]

EnableProfileQuota = 0x00000001

The following Registry Values were modified:

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager\AppCompatibility]

AppCompatCache = EF BE AD DE 60 00 00 00 00 00 00 00 00 00 00 00 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF F

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatibility]

AppCompatCache = EF BE AD DE 60 00 00 00 00 00 00 00 00 00 00 00 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF F

Other details

Analysis of the file resources indicate the following possible country of origin:

Russian Federation

The following Host Name was requested from a host database:

squatead.com

All content ("Information") contained in this report is the copyrighted work of Threat Expert Ltd and its associated companies ("ThreatExpert") and may not be copied without the express permission of ThreatExpert.

The Information is provided on an "as is" basis. ThreatExpert disclaims all warranties, whether express or implied, to the maximum extent permitted by law, including the implied warranties that the Information is merchantable, of satisfactory quality, accurate, fit for a particular purpose or need, or non-infringing, unless such implied warranties are legally incapable of exclusion. Further, ThreatExpert does not warrant or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise.