Submission Summary:

• Submission details:
• Submission received: 26 May 2009, 14:21:37
• Processing time: 5 min 46 sec
• Submitted sample:
• File MD5: 0x3F7024069E873D52D525958E1E1C3008
• File SHA-1: 0xD35CDC440CE47F132EEBA63E80DD8E7C05916AAD
• Filesize: 336,719 bytes
• Alias:
• Worm.AutoIt.dn [PCTools]
• W32.Imaut [Symantec]
• IM-Worm.Win32.Sohanad.gen [Kaspersky Lab]
• W32/YahLover.worm.gen [McAfee]
• Mal/Sohana-B, Mal/Sohana-A [Sophos]
• Worm.Win32.AutoIt [Ikarus]
• Win32/Sohaned.worm.230400 [AhnLab]

• Summary of the findings:

What's been found	Severity Level
Downloads/requests other files from Internet.
Modifies some system settings that may have negative impact on overall system security state.
Creates a startup registry entry.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! Characteristics of the following security risk was identified in the system:

Security Risk

Description

Worm.IM.Sohanad

Worm.IM.Sohanad spreads via Yahoo Messenger and infects Windows. It sends a message to all Yahoo Messenger contacts of an infected user. The message contains a link enticing users to download the worm. The worm also disable certain Windows functionalities abd hijacks Internet Explorer homepage. It also downloads other maware and it will also attempt to propagate via the means of creating copies of itself onto removable devices such as USB flash and hard drives.

• Attention! The following threat category was identified:

Threat Category	Description
	A network-aware worm that attempts to replicate across the existing network(s)

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%Windir%\chrome.exe %System%\chrome.exe [file and pathname of the sample #1]	336,719 bytes	MD5: 0x3F7024069E873D52D525958E1E1C3008 SHA-1: 0xD35CDC440CE47F132EEBA63E80DD8E7C05916AAD	Worm.AutoIt.dn [PCTools] W32.Imaut [Symantec] IM-Worm.Win32.Sohanad.gen [Kaspersky Lab] W32/YahLover.worm.gen [McAfee] Mal/Sohana-B, Mal/Sohana-A [Sophos] Worm.Win32.AutoIt [Ikarus] Win32/Sohaned.worm.230400 [AhnLab]
2	%System%\autorun.ini	96 bytes	MD5: 0x5E378CDF3706EDCFF0170C387FB74EF5 SHA-1: 0x5DA4AB639930D07CF20A532AD983E1CA909B195C	W32/AutoRun-PU [Sophos] Worm.Autoit [Ikarus]

• Notes:
• %Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.
• %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

Memory Modifications

• There were new processes created in the system:

Process Name	Process Filename	Main Module Size
[filename of the sample #1]	[file and pathname of the sample #1]	708,608 bytes
chrome.exe	%System%\chrome.exe	708,608 bytes
chrome.exe	%Windir%\chrome.exe	708,608 bytes

Registry Modifications

• The following Registry Keys were created:
• HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Internet Explorer
• HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Internet Explorer\Control Panel
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System
• HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer
• HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Control Panel

• The newly created Registry Values are:
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
• NofolderOptions = 0x00000001

to remove the Folder Options item from all Windows Explorer menus and from Control Panel

• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
• DisableTaskMgr = 0x00000001
• DisableRegistryTools = 0x00000001

to prevent users from starting Task Manager (Taskmgr.exe)
to disable the Windows registry editors (Regedt32.exe and Regedit.exe)

• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
• Yahoo Messengger = "%System%\chrome.exe"

so that chrome.exe runs every time Windows starts

• The following Registry Values were modified:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main]
• Default_Page_URL = "http://h1.ripway.com/poojasharma/index.html"
• Default_Search_URL = "http://h1.ripway.com/poojasharma/index.html"
• Search Page = "http://h1.ripway.com/poojasharma/index.html"
• Start Page = "http://h1.ripway.com/poojasharma/index.html"
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
• Shell = "Explorer.exe chrome.exe"

so that chrome.exe runs every time Windows starts

• [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
• Start Page = "http://h1.ripway.com/poojasharma/index.html"

Other details

• Analysis of the file resources indicate the following possible country of origin:

	United Kingdom

• To mark the presence in the system, the following Mutex object was created:
• _!SHMSFTHISTORY!_

• The following Internet Connection was established:

• The following GET requests were made:
• poojasharma/index.html
• poojasharma1/setting.ini
• poojasharma/index.jpg
• poojasharma2/setting.ini
• poojasharma3/setting.ini
• poojasharma4/setting.ini
• poojasharma/setting.ini

• The data identified by the following URLs was then requested from the remote web server:
• http://h1.ripway.com/poojasharma1/setting.ini
• localhost
• http://h1.ripway.com/poojasharma2/setting.ini
• http://h1.ripway.com/poojasharma3/setting.ini
• http://h1.ripway.com/poojasharma4/setting.ini
• http://h1.ripway.com/poojasharma/setting.ini