Submission Summary:

• Submission details:
• Submission received: 14 January 2008, 06:34:23
• Processing time: 3 min 26 sec
• Submitted sample:
• File MD5: 0x48156F1CCF199FF8588C1FB477C6DF47
• Filesize: 824,320 bytes
• Alias:
• Win32.Trats.Gen [PCTools]
• Trojan-Dropper.Win32.Agent.dgo [Kaspersky Lab]
• W32/Trats [McAfee]
• PE_TRATS.A [Trend Micro]

• Summary of the findings:

What's been found	Severity Level
Contains characteristics of an identified security risk.

Technical Details:

• The new window was created, as shown below:

Possible Security Risk

• Attention! Characteristics of the following security risks were identified in the system:

Security Risk	Description
Adware.Joltid_P2P_Networking	Part of the Altnet suite of Promotional supported software which displays advertisements and pop-ups.
Trojan.Virtumonde	Virtumonde modifies the Windows Internet connection mechanism and display various pop-up advertisements.

• Attention! The following threat categories were identified:

Threat Category	Description
	A potentially unwanted adware program designed to deliver various advertisements to the users' systems
	A malicious trojan horse or bot that may represent security risk for the compromised system and/or its network environment

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%Temp%\P2P Networking.ENG	9,205 bytes	MD5: 0x6684267191E3A22B69920F443102D894	Adware.Joltid_P2P_Networking [PCTools]
2	%System%\awtst.dll	335,360 bytes	MD5: 0x0C5C2AE8412D031121A7548FCB03DB41	Adware.Vundo.V.Gen [PCTools] Trojan.Vundo [Symantec]
3	[part of the sample filename]1 .exe	468,152 bytes	MD5: 0x3E1D143C28BB5119CA6B72468E65A152	Adware.Joltid_P2P_Networking [PCTools] Adware-P2PNet [McAfee]
4	[file and pathname of the sample #1]	824,320 bytes	MD5: 0x48156F1CCF199FF8588C1FB477C6DF47	Win32.Trats.Gen [PCTools] Trojan-Dropper.Win32.Agent.dgo [Kaspersky Lab] W32/Trats [McAfee] PE_TRATS.A [Trend Micro]

• Notes:
• %Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).
• %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

Memory Modifications

• There were new processes created in the system:

Registry Modifications

• The following Registry Keys were created:
• HKEY_LOCAL_MACHINE\SOFTWARE\P2P Networking
• HKEY_LOCAL_MACHINE\SOFTWARE\P2P Networking\Installation History
• HKEY_LOCAL_MACHINE\SOFTWARE\P2P Networking\Installation History\Files
• HKEY_LOCAL_MACHINE\SOFTWARE\P2P Networking\Installation History\P2P Chunks

• The newly created Registry Values are:
• [HKEY_LOCAL_MACHINE\SOFTWARE\P2P Networking\Installation History\P2P Chunks]
• ENG Language File = "%Temp%\P2P Networking.ENG"
• [HKEY_LOCAL_MACHINE\SOFTWARE\P2P Networking\Installation History\Files]
• %Temp%\P2P Networking.ENG = "%Temp%\P2P Networking.ENG"

• The following Registry Values were modified:
• [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa]
• Authentication Packages = "msv1_0 C:\\WINDOWS\\system32\\awtst"
• [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
• Authentication Packages = "msv1_0 C:\\WINDOWS\\system32\\awtst"

Other details

• Analysis of the file resources indicate the following possible country of origin:

	Estonia

• To mark the presence in the system, the following Mutex object was created:
• P2P Installer Mutex

• There was application-defined hook procedure installed into the hook chain (e.g. to monitor keystrokes). The installed hook is handled by the following module:
• %System%\awtst.dll