Submission Summary:

• Submission details:
• Submission received: 18 September 2012, 14:12:55
• Processing time: 9 min 10 sec
• Submitted sample:
• File MD5: 0x50AB169A7FD24D84E089408F7AF8F012
• File SHA-1: 0x41F02D51DC87D0EDF7D06BF1A3CCDCD784B82FF2
• Filesize: 181,760 bytes
• Alias: VirTool:Win32/CeeInject.gen!HL [Microsoft]

• Summary of the findings:

What's been found	Severity Level
Downloads/requests other files from Internet.
Creates a startup registry entry.

Technical Details:

File System Modifications

• The following files were created in the system:

• Notes:
• %AppData% is a variable that refers to the file system directory that serves as a common repository for application-specific data. A typical path is C:\Documents and Settings\[UserName]\Application Data.
• %Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).

• The following directories were created:
• %AppData%\Faw
• %AppData%\Oqvimi

Memory Modifications

• There were new processes created in the system:

• There was a new memory page created in the address space of the system process(es):

Process Name	Process Filename	Allocated Size
cmd.exe	%System%\cmd.exe	163,840 bytes

• Notes:
• %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

Registry Modifications

• The following Registry Keys were created:
• HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Privacy
• HKEY_CURRENT_USER\Software\Microsoft\Cudo

• The newly created Registry Values are:
• [HKEY_CURRENT_USER\Identities]
• Identity Login = 0x00098053
• [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Privacy]
• CleanCookies = 0x00000000
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
• {62B3DC35-1B5E-2F74-5669-D35763A42610} = ""%AppData%\Faw\faelve.exe""

so that faelve.exe runs every time Windows starts

• [HKEY_CURRENT_USER\Software\Microsoft\Cudo]
• Okmuguw = 42 BB 4C C9 65 60 37 DB D9 63 71 7C D9 A7 F7 48 E0 7B 8F B8 8C 57 EC 5A BE 76 81 4D A7 82 8F C7 8F FA B1 7C E7 1B 1B 00 34 D4 FA 59 50 54 88 58 EC D9 C4 08 6B 81 78 53 1F 68 7E 64 1C 4F 0B A7 78 40 4F 57 4E 6C 00 73 8F 9E 3F 8F CF E8 AC 02 DE 46 DF E

• The following Registry Values were modified:
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0]
• 1609 =
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1]
• 1406 =
• 1609 =
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2]
• 1609 =
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3]
• 1406 =
• 1609 =
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4]
• 1406 =
• 1609 =

Other details

• To mark the presence in the system, the following Mutex object was created:
• Local\{1782C2D5-05BE-5A45-5669-D35763A42610}

• The following Internet Connection was established: