Submission Summary:

• Submission details:
• Submission received: 14 September 2012, 01:49:35
• Processing time: 9 min 28 sec
• Submitted sample:
• File MD5: 0x3BD676C6383BF02C83E9051467CBBFC6
• File SHA-1: 0xC3D4855F3A0EB925989BB00C21C28180C517E6EF
• Filesize: 1,849,856 bytes
• Alias:
• Worm.Win32.AutoRun.dtbv [Kaspersky Lab]
• W32/Autorun.worm.f [McAfee]
• Mal/Sohana-A [Sophos]
• Virus.AutoIt [Ikarus]

Technical Details:

Possible Security Risk

• Attention! The following threat categories were identified:

Threat Category	Description
	A network-aware worm that attempts to replicate across the existing network(s)
	A spyware program that represents security risk for a local system
	A malicious trojan horse or bot that may represent security risk for the compromised system and/or its network environment

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%Windir%\regsvr.exe %System%\regsvr.exe [file and pathname of the sample #1] %System%\winhelp.exe	1,849,856 bytes	MD5: 0x3BD676C6383BF02C83E9051467CBBFC6 SHA-1: 0xC3D4855F3A0EB925989BB00C21C28180C517E6EF	Worm.Win32.AutoRun.dtbv [Kaspersky Lab] W32/Autorun.worm.f [McAfee] Mal/Sohana-A [Sophos] Virus.AutoIt [Ikarus]
2	%System%\rundll.exe	164,864 bytes	MD5: 0x19ECA722500302F159F9872FCFED19EE SHA-1: 0xB4ABA98FCE5FFFE45BB1DE10F5204BC34031BDAD	Spyware.007Spy [Symantec] not-a-virus:Monitor.Win32.007SpySoft.g [Kaspersky Lab] Generic Spy.e [McAfee] W32/Sohana-AX [Sophos] not-a-virus:Monitor.Win32.007SpySoft.342 [Ikarus] Win-Trojan/Xema.variant [AhnLab]
3	%System%\setup.ini	96 bytes	MD5: 0x9ECE103C47335F0CC777F1132B8D522F SHA-1: 0x63AFA171C64F86D99DB81723E1335E960E85FA43	Trojan.Win32.AutoRun.ke [Kaspersky Lab] Generic!atr [McAfee] Troj/Agent-GXM [Sophos] TextImage/Autorun [AhnLab]
4	%System%\ssdata\lgstat.ini	20 bytes	MD5: 0x441018525208457705BF09A8EE3C1093 SHA-1: 0x6768033E216468247BD031A0A2D9876D79818F8F	(not available)
5	%Windir%\Tasks\At1.job	348 bytes	MD5: 0xD136B62711D36C7F02BDA16682E369C6 SHA-1: 0xF0CA12629AE1F380D2C38C8A428095F91BB4CE2E	(not available)
6	%Windir%\Tasks\At2.job	348 bytes	MD5: 0xDE6524E6FEEF1E01F760D092311086AF SHA-1: 0x433C878A64D2A78FE68E853325CE40D3729DDE84	(not available)
7	%Windir%\Tasks\At3.job	348 bytes	MD5: 0xC1F0FCAFC5533FEFF946CBB0352FD6FC SHA-1: 0x5060D85E6864D893DA4754DDE7CEC05B3467CB20	(not available)
8	%Windir%\winhelp.ini	19,918 bytes	MD5: 0x7E3309AD9F7DD0FDE6C5A4E55ACFA6B5 SHA-1: 0x70FDFE65BA29B1E4F5769EE9DD619846793E76CB	Troj/Agent-GXM [Sophos]

• Notes:
• %Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.
• %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

• The following directories were created:
• %System%\ssdata
• %System%\ssdata\scrdata

Memory Modifications

• There were new processes created in the system:

Process Name	Process Filename	Main Module Size
[filename of the sample #1]	[file and pathname of the sample #1]	1,929,216 bytes
regsvr.exe	%System%\regsvr.exe	1,929,216 bytes
regsvr.exe	%Windir%\regsvr.exe	1,929,216 bytes
rundll.exe	%System%\rundll.exe	741,376 bytes
winhelp.exe	%System%\winhelp.exe	1,929,216 bytes

Registry Modifications

• The following Registry Key was created:
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System

• The newly created Registry Values are:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
• User Themes = "%System%\rundll.exe"

so that rundll.exe runs every time Windows starts

• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
• NofolderOptions = 0x00000000
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
• DisableTaskMgr = 0x00000000
• DisableRegistryTools = 0x00000001

to disable the Windows registry editors (Regedt32.exe and Regedit.exe)

• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
• Yahoo Messengger = "%System%\regsvr.exe"

so that regsvr.exe runs every time Windows starts

• The following Registry Value was modified:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
• Shell =
• System =

Other details

• Analysis of the file resources indicate the following possible country of origin:

	United Kingdom

• The data identified by the following URLs was then requested from the remote web server:
• http://www.crackspider.net/setting.doc
• localhost
• http://www.crackspider.net/setting.xls

• There was application-defined hook procedure installed into the hook chain (e.g. to monitor keystrokes). The installed hook is handled by the following module:
• %System%\rundll.exe