Submission Summary:

• Submission details:
• Submission received: 21 April 2011, 03:58:13
• Processing time: 12 min 0 sec
• Submitted sample:
• File MD5: 0x4DAEF1AA18A0B69FD7EF1711EBE9E362
• File SHA-1: 0xBB5157B34FA3BBC79C8B7CBA7506F9A2A189B528
• Filesize: 681,984 bytes
• Alias:
• W32.Imaut [Symantec]
• IM-Worm.Win32.Sohanad.qi [Kaspersky Lab]
• Trojan.Autoit [Ikarus]
• Dropper/Agent.617984 [AhnLab]

• Summary of the findings:

What's been found	Severity Level
Downloads/requests other files from Internet.
Modifies some system settings that may have negative impact on overall system security state.
Creates a startup registry entry.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! The following threat categories were identified:

Threat Category	Description
	A network-aware worm that attempts to replicate across the existing network(s)
	A malicious trojan horse or bot that may represent security risk for the compromised system and/or its network environment

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%Windir%\regsvr.exe %System%\regsvr.exe [file and pathname of the sample #1] %System%\svchost .exe	681,984 bytes	MD5: 0x4DAEF1AA18A0B69FD7EF1711EBE9E362 SHA-1: 0xBB5157B34FA3BBC79C8B7CBA7506F9A2A189B528	W32.Imaut [Symantec] IM-Worm.Win32.Sohanad.qi [Kaspersky Lab] Trojan.Autoit [Ikarus] Dropper/Agent.617984 [AhnLab]
2	%System%\28463\svchost.001	2,800 bytes	MD5: 0xC427F41A9EB12166C278DA8FED8A0C4A SHA-1: 0xE0E1D1C8F6B58675A544F1461997CFC37A2E6C63	IM-Worm.Win32.Sohanad.it [Kaspersky Lab] IM-Worm.Win32.Sohanad [Ikarus]
3	%System%\setting.ini	0 bytes	MD5: 0xD41D8CD98F00B204E9800998ECF8427E SHA-1: 0xDA39A3EE5E6B4B0D3255BFEF95601890AFD80709	(not available)
4	%System%\setup.ini	96 bytes	MD5: 0x9ECE103C47335F0CC777F1132B8D522F SHA-1: 0x63AFA171C64F86D99DB81723E1335E960E85FA43	Trojan.Win32.AutoRun.ke [Kaspersky Lab] Generic!atr [McAfee] Troj/Agent-GXM [Sophos] Trojan.Win32.AutoRun [Ikarus] TextImage/Autorun [AhnLab]
5	%Windir%\Tasks\At1.job	350 bytes	MD5: 0x89BE362D4B8460B542C04B5C6ED5B920 SHA-1: 0xA948A5A39CE0617A75D781B06D00DE4D87CF844A	(not available)
6	%Windir%\Tasks\At2.job	350 bytes	MD5: 0x4CFB344C22DFCCDF827A8AE8CD9F2EE1 SHA-1: 0xCFC2F68C447AE20A8B65743521AF235E30C9BC5E	(not available)

• Notes:
• %Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.
• %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

• The following directory was created:
• %System%\28463

Memory Modifications

• There were new processes created in the system:

Process Name	Process Filename	Main Module Size
[filename of the sample #1]	[file and pathname of the sample #1]	876,544 bytes
regsvr.exe	%System%\regsvr.exe	876,544 bytes
regsvr.exe	%Windir%\regsvr.exe	876,544 bytes

Registry Modifications

• The following Registry Key was created:
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System

• The newly created Registry Values are:
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
• NofolderOptions = 0x00000000
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
• DisableTaskMgr = 0x00000000
• DisableRegistryTools = 0x00000001

to disable the Windows registry editors (Regedt32.exe and Regedit.exe)

• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
• Msn Messsenger = "%System%\regsvr.exe"

so that regsvr.exe runs every time Windows starts

• The following Registry Value was modified:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
• Shell =

Other details

• Analysis of the file resources indicate the following possible country of origin:

	United Kingdom

• The following port was open in the system:

• There were registered attempts to establish connection with the remote hosts. The connection details are:

• The data identified by the following URLs was then requested from the remote web server:
• http://www.yahoo.com/setting.xls
• http://www.yahoo.com/setting.doc
• http://yahoo.com/setting.doc
• http://yahoo.com/setting.xls