Submission Summary:

• Submission details:
• Submission received: 5 October 2012, 21:03:37
• Processing time: 8 min 15 sec
• Submitted sample:
• File MD5: 0x39A6FA3A4F02021F7FA1099CBB8B0878
• File SHA-1: 0x039E175F672CDFDEDB36EA5E6F67556C334F7903
• Filesize: 447,484 bytes
• Packer info: packed with: UPX [Kaspersky Lab]

• Summary of the findings:

What's been found	Severity Level
Downloads/requests other files from Internet.
Creates a startup registry entry.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! The following threat category was identified:

Threat Category	Description
	A malicious trojan horse or bot that may represent security risk for the compromised system and/or its network environment

File System Modifications

• The following files were created in the system:

• The following directory was created:
• c:\svchost

Memory Modifications

• There were new processes created in the system:

• There were new memory pages created in the address space of the system process(es):

Process Name	Process Filename	Allocated Size
lsass.exe	%System%\lsass.exe	319,488 bytes
svchost.exe	%System%\svchost.exe	319,488 bytes
svchost.exe	%System%\svchost.exe	319,488 bytes
svchost.exe	%System%\svchost.exe	319,488 bytes
svchost.exe	%System%\svchost.exe	319,488 bytes
svchost.exe	%System%\svchost.exe	319,488 bytes
alg.exe	%System%\alg.exe	319,488 bytes

• Note:
• %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

Registry Modifications

• The following Registry Keys were created:
• HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\PhishingFilter
• HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Recovery
• HKEY_CURRENT_USER\Software\Microsoft Windows

• The newly created Registry Values are:
• [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\PhishingFilter]
• EnabledV8 = 0x00000000
• ShownServiceDownBalloon = 0x00000000
• [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Recovery]
• ClearBrowsingHistoryOnExit = 0x00000000
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
• ProxyHttp1.1 = 0x00000001
• WarnOnPostRedirect = 0x00000000
• WarnOnIntranet = 0x00000000
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0]
• 1409 = 0x00000003
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1]
• 1409 = 0x00000003
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2]
• 1409 = 0x00000003
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3]
• 1409 = 0x00000003
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4]
• 1409 = 0x00000003
• [HKEY_CURRENT_USER\Software\Microsoft Windows]
• 00000046A305C62A = A0 D3 B1 E6 C8 C9 C9 C9 C9 CE CD CD CD CD CF CF CF CF C2 C2 C2 C2 B6 D9 F9 8D EC 8E E2 87 87 F5 90 E0 D1 A1 A3 A3 BA 9D 9D 9D 9D FF 90 E4 BB DC A9 C0 A4 A4 91 BF 8E A0 92 A4 94 A4 85 C6 89 C4 94 C1 95 D0 82 CC 8D C0 85 A4 94 A4 E7 A3 92 D3 E7 D7 AE A
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
• 3X1U3G4C4CUE4C7W = "C:\svchost\3D1A3642DAE.exe /q"

so that 3D1A3642DAE.exe runs every time Windows starts

• The following Registry Values were modified:
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
• WarnOnPost =
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1]
• 1406 =
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3]
• 1406 =
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4]
• 1406 =
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0]
• 1609 =
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1]
• 1406 =
• 1609 =
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2]
• 1609 =
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3]
• 1406 =
• 1609 =
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4]
• 1406 =
• 1609 =

Other details

• Analysis of the file resources indicate the following possible country of origin:

	United Kingdom

• To mark the presence in the system, the following Mutex objects were created:
• Global\svchost
• zXeRY3a_PtW
• Iexplore.XPExceptionFilter

• The following Host Names were requested from a host database:
• 192.5.5.241
• cybercartel.com.mx
• 91.121.82.210
• www.microsoft.com
• roroesjoto.com

• The following HTTP URL was started reading:
• http://www.microsoft.com/index.html