Submission Summary:

• Submission details:
• Submission received: 29 February 2012, 06:10:39
• Processing time: 9 min 35 sec
• Submitted sample:
• File MD5: 0x449D05D60ADAE02BFAB0F20CDF9D439B
• File SHA-1: 0x809164C96B87B7139790C16E620616E8F16A1F05
• Filesize: 192,512 bytes

• Summary of the findings:

What's been found	Severity Level
Produces outbound traffic.
Downloads/requests other files from Internet.
Creates a startup registry entry.

Technical Details:

File System Modifications

• The following files were created in the system:

• Notes:
• %AppData% is a variable that refers to the file system directory that serves as a common repository for application-specific data. A typical path is C:\Documents and Settings\[UserName]\Application Data.
• %Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).

• The following directories were created:
• %AppData%\Erg
• %AppData%\Vizy
• %Temp%\tmp20df4e88
• %Windir%\$NtUninstallKB2064$
• %Windir%\assembly\GAC

• Notes:
• %Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.

Memory Modifications

• There were new memory pages created in the address space of the system process(es):

Process Name	Process Filename	Allocated Size
svchost.exe	%System%\svchost.exe	32,768 bytes
cmd.exe	%System%\cmd.exe	159,744 bytes

• Notes:
• %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

Registry Modifications

• The following Registry Keys were created:
• HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Privacy
• HKEY_CURRENT_USER\Software\Microsoft\Iser

• The newly created Registry Values are:
• [HKEY_CURRENT_USER\Identities]
• Identity Login = 0x00098053
• [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Privacy]
• CleanCookies = 0x00000000
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
• {A160743F-529F-E233-7B84-F3E1DA70A293} = ""%AppData%\Erg\owebeqy.exe""

so that owebeqy.exe runs every time Windows starts

• [HKEY_CURRENT_USER\Software\Microsoft\Iser]
• Ispay = 01 57 B7 7C 0E E3 26 B0 6B A4 62 DF D1 05 E2 A2 BC DE B7 E2 19 84 39 7B CA 36 08 E4 BE 4D 4B F2 9E CB E4 70 FD 3F 6F 77 AE 0E C6 06 05 CC 3F 92 9C C9 17 F8 40 C9 45 DF 1F D8 10 B1 A7 7E 5A 28 19 E7 B6 FF 75 77 6E 6D 7C 53 A4 0F 5B C6 25 B9 23 E6 61 C
• Aqiqo = A7 46 F0 89 0D 8A A4 9C C2 1A 87 43 B6 4C 19 47 4A FA 2A 92 5C 06 BB F9 48 B4 8A 66 0A F9 FF 46 92 3F 44 38 15 98 5B 12 8E 47 C8 3D 28 BC 83 1E 31 2A 03 6F A3 2A A6 2C E8 2F E7 46 54 8D A9 DB EA 11 42 0A A2 EE F7 F4 E5 CA 3D 86 CC 51 B2 2E AA 6F E8 4
• Okzy = 7C E1 D3 C3 EA F1 5C 73 86 04 48 51 30 96 41 DA B7 0C B1 ED 46 DB 66 24 95 69 57 BB E0 13 15 AC F7 49 D9 65 FA 8F 5A A9 C2 22 90 27 5C 85 E5 11 1E 4B 62 0E C2 4B C7 7D AD 6A A2 03 05 DC F8 8A 98 1A 6F 41 84 39 1D F1 1C 2B DD D8 85 55 3B 72

• The following Registry Values were modified:
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0]
• 1609 =
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1]
• 1406 =
• 1609 =
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2]
• 1609 =
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3]
• 1406 =
• 1609 =
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4]
• 1406 =
• 1609 =

Other details

• There were registered attempts to establish connection with the remote hosts. The connection details are:

• The data identified by the following URLs was then requested from the remote web server:
• http://negygtgs.cn/stat2.php?w=30461&i=000000000000000000000000433ae001&a=5
• http://negygtgs.cn/stat2.php?w=30461&i=000000000000000000000000433ae001&a=6
• http://negygtgs.cn/stat2.php?w=30461&i=000000000000000000000000433ae001&a=7
• http://negygtgs.cn/stat2.php?w=30461&i=000000000000000000000000433ae001&a=8
• http://negygtgs.cn/stat2.php?w=30461&i=000000000000000000000000433ae001&a=23
• http://negygtgs.cn/stat2.php?w=30461&i=000000000000000000000000433ae001&a=24
• http://negygtgs.cn/stat2.php?w=30461&i=000000000000000000000000433ae001&a=25
• http://negygtgs.cn/stat2.php?w=30461&i=000000000000000000000000433ae001&a=26
• http://negygtgs.cn/stat2.php?w=30461&i=000000000000000000000000433ae001&a=27
• http://negygtgs.cn/stat2.php?w=30461&i=000000000000000000000000433ae001&a=11
• http://negygtgs.cn/stat2.php?w=30461&i=000000000000000000000000433ae001&a=1
• http://negygtgs.cn/stat2.php?w=30461&i=000000000000000000000000433ae001&a=19
• http://negygtgs.cn/stat2.php?w=30461&i=000000000000000000000000433ae001&a=21
• http://negygtgs.cn/stat2.php?w=30461&i=000000000000000000000000433ae001&a=4
• http://shenleygardendesigns.co.uk/podm.exe
• http://promos.fling.com/geo/txt/city.php
• http://westdirect.net/static/ch.php
• http://mediacoif.com/hg/do.php

Outbound traffic (potentially malicious)

• There was an outbound traffic produced on port 34354: