Submission Summary:

• Submission details:
• Submission received: 3 November 2009, 15:51:09
• Processing time: 6 min 3 sec
• Submitted sample:
• File MD5: 0x450FEE9ADACEA4B4ACEC89E505AE8CDE
• File SHA-1: 0xA8BEA240FB6E4ED4087C4270C124922A40464E67
• Filesize: 720,173 bytes

• Summary of the findings:

What's been found	Severity Level
Produces outbound traffic.
Downloads/requests other files from Internet.
Creates a startup registry entry.

Technical Details:

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash
1	%CommonAppData%\Microsoft\WLSetup\Logs\2009-11-03_15-51_24c-5gle7m2w.log	2,060 bytes	MD5: 0x0FA637C0BA3D41C4A55F19AF8B39D8C6 SHA-1: 0x582A5E310C34BD03FFCF30C71E176A31811B6E44
2	%CommonAppData%\Microsoft\WLSetup\Logs\2009-11-03_15-53_3e0-ybcwkt7c.log	2,021 bytes	MD5: 0x9E564F7F055A7B7CDFEDCDAB6F635E6B SHA-1: 0xE597998F2406214A3648EF2CBA44E5781572E363
3	%CommonAppData%\Microsoft\WLSetup\Logs\2009-11-03_15-53_dc-fu98w8q2.log	1,914 bytes	MD5: 0x4604132DC6EC18623BE1FC12671144D2 SHA-1: 0x1D21AA260F1DBFC18D449438310BC90404AD37F3
4	%ProgramFiles%\MSN\ini.exe %Windir%\ini.exe	28,672 bytes	MD5: 0xFA423A2F20F6DC9095651EB98F36BA6A SHA-1: 0x2AF567575C22FCFB5B9E7110E75E50EC655C5C17
5	%ProgramFiles%\MSN\install.exe	1,161,040 bytes	MD5: 0x78E8C2ACAA0776123182C881D0BFD050 SHA-1: 0x59B48B4F19C603B079B4F008840B702A9057AB65
6	%ProgramFiles%\MSN\messenger.exe	81,920 bytes	MD5: 0x137F15418492191258E177DDC9E87090 SHA-1: 0x9464F7A2CDBE09771A17A1FD5C3F725D98C061B4
7	[file and pathname of the sample #1]	720,173 bytes	MD5: 0x450FEE9ADACEA4B4ACEC89E505AE8CDE SHA-1: 0xA8BEA240FB6E4ED4087C4270C124922A40464E67

• Notes:
• %CommonAppData% is a variable that refers to the file system directory containing application data for all users. A typical path is C:\Documents and Settings\All Users\Application Data.
• %ProgramFiles% is a variable that refers to the Program Files folder. A typical path is C:\Program Files.
• %Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.

• The following directories were created:
• %AppData%\Microsoft\Windows Live
• %CommonAppData%\Microsoft\WLSetup
• %CommonAppData%\Microsoft\WLSetup\Logs
• %AppData%\Microsoft\Windows Live\SqmApi

• Notes:
• %AppData% is a variable that refers to the file system directory that serves as a common repository for application-specific data. A typical path is C:\Documents and Settings\[UserName]\Application Data.

Memory Modifications

• There was a new process created in the system:

Process Name	Process Filename	Main Module Size
install.exe	%ProgramFiles%\msn\install.exe	1,179,648 bytes

Registry Modifications

• The following Registry Keys were created:
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient
• HKEY_CURRENT_USER\Software\Microsoft\SQMClient

• The newly created Registry Values are:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
• win = "%Windir%\ini.exe"

so that ini.exe runs every time Windows starts

• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient]
• MachineId = "{78C1DCC0-59D3-4B34-AEBD-318E15A9A7A8}"
• [HKEY_CURRENT_USER\Software\Microsoft\SQMClient]
• UserId = "{CA0D0709-775B-4CBA-A631-890447E52796}"

• The following Registry Values were modified:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main]
• Start Page =
• [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
• Start Page =

Other details

• Analysis of the file resources indicate the following possible countries of origin:

	Spain
	Russian Federation

• There were registered attempts to establish connection with the remote hosts. The connection details are:

• The data identified by the following URLs was then requested from the remote web server:
• http://crl.microsoft.com/pki/crl/products/CSPCA.crl
• http://crl.microsoft.com/pki/crl/products/tspca.crl
• http://sqm.microsoft.com/sqm/WindowsLive/sqmserver.dll

Outbound traffic (potentially malicious)

• There was an outbound traffic produced on port 80: