Submission Summary:

• Submission details:
• Submission received: 24 September 2012, 08:40:20
• Processing time: 7 min 47 sec
• Submitted sample:
• File MD5: 0x3D527DE910A6A7EEDF8498DB69B123CC
• File SHA-1: 0xA2233FDEFE39A99F2EA0B83C9ECEBACD8A740F4D
• Filesize: 78,205 bytes
• Alias: Mal/Behav-010 [Sophos]

Technical Details:

• The new window was created, as shown below:

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%Temp%\24092012-084024282.BMP	921,654 bytes	MD5: 0xE097283A6A60C32B5339BF5B00461490 SHA-1: 0x2F8E6417B7A1F4E2BE68BF46EAB1FBC5AA0D7793	(not available)
2	%Temp%\24092012-084024282.JPG	29,771 bytes	MD5: 0x984D730EE9F007681461EB453A5DF9B0 SHA-1: 0xBF39CBD23118A41D53B819029E4A8548FC93B2BE	(not available)
3	%Temp%\24092012-084024282.TXT	426 bytes	MD5: 0x3B0A7A760B6BB4AED8A964A3C2E24267 SHA-1: 0x5047516DBE461353682882ABD80EFFF0C0627D11	(not available)
4	%Temp%\rose.JPG	16,549 bytes	MD5: 0xEA0FB3401ABA8E0CE1D0BD80F135B795 SHA-1: 0x9E2B99DD154A7D3D4A1CF5AAE2C9DAAA3CC82EB9	(not available)
5	[file and pathname of the sample #1] %System%\winlgon.exe	78,205 bytes	MD5: 0x3D527DE910A6A7EEDF8498DB69B123CC SHA-1: 0xA2233FDEFE39A99F2EA0B83C9ECEBACD8A740F4D	Mal/Behav-010 [Sophos]

• Notes:
• %Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).
• %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

Memory Modifications

• There were new processes created in the system:

Process Name	Process Filename	Main Module Size
winlgon.exe	%System%\winlgon.exe	86,016 bytes
[filename of the sample #1]	[file and pathname of the sample #1]	86,016 bytes

Registry Modifications

• The following Registry Keys were created:
• HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\MediaResources\msvideo
• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\MediaResources\msvideo
• HKEY_CURRENT_USER\Software\Microsoft\Multimedia\DrawDib

• The newly created Registry Values are:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
• winlgon.exe = "%System%\winlgon.exe"

so that winlgon.exe runs every time Windows starts

• [HKEY_CURRENT_USER\Software\Microsoft\Multimedia\DrawDib]
• vga.drv 640x480x32(BGR 0) = "31,31,31,31"

Other details

• The following Host Name was requested from a host database:
• yahhelper.no-ip.org

• There was registered attempt to establish connection with the remote host. The connection details are:

• There was application-defined hook procedure installed into the hook chain (e.g. to monitor keystrokes). The installed hook is handled by the following module:
• %System%\winlgon.exe

Outbound traffic (potentially malicious)

• There was an outbound traffic produced on port 27020: