ThreatExpert Report

Visit ThreatExpert web site

Close Report

Submission Summary:

Submission details:

Submission received: 3 August 2012, 22:51:20
Processing time: 5 min 48 sec
Submitted sample:

File MD5: 0x66B63969ACD0689E88D45D8EEEC2E46B
File SHA-1: 0x221640DE002A3C64FE05EA1460CE4679442ABB20
Filesize: 66,029 bytes

Technical Details:

File System Modifications

The following files were created in the system:

#	Filename(s)	File Size	File Hash
1	%AppData%\addons.dat	25,138 bytes	MD5: 0x3F564E86C95E71987EBF814BEA2FB19D SHA-1: 0xB6B2CC20250282ECCA3C92A915716CB649794E27
2	%System%\Microsoft\logg.dat	0 bytes	MD5: 0xD41D8CD98F00B204E9800998ECF8427E SHA-1: 0xDA39A3EE5E6B4B0D3255BFEF95601890AFD80709
3	%System%\Microsoft\windows.exe [file and pathname of the sample #1]	66,029 bytes	MD5: 0x66B63969ACD0689E88D45D8EEEC2E46B SHA-1: 0x221640DE002A3C64FE05EA1460CE4679442ABB20

Notes:

%AppData% is a variable that refers to the file system directory that serves as a common repository for application-specific data. A typical path is C:\Documents and Settings\[UserName]\Application Data.
%System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

Memory Modifications

There were new processes created in the system:

Process Name	Process Filename	Main Module Size
windows.exe	%System%\microsoft\windows.exe	53,248 bytes
[filename of the sample #1]	[file and pathname of the sample #1]	53,248 bytes

There were new memory pages created in the address space of the system process(es):

Process Name	Process Filename	Allocated Size
IEXPLORE.EXE	%ProgramFiles%\internet explorer\iexplore.exe	344,064 bytes
IEXPLORE.EXE	%ProgramFiles%\internet explorer\iexplore.exe	344,064 bytes
IEXPLORE.EXE	%ProgramFiles%\internet explorer\iexplore.exe	344,064 bytes
IEXPLORE.EXE	%ProgramFiles%\internet explorer\iexplore.exe	344,064 bytes
IEXPLORE.EXE	%ProgramFiles%\internet explorer\iexplore.exe	344,064 bytes
IEXPLORE.EXE	%ProgramFiles%\internet explorer\iexplore.exe	344,064 bytes
IEXPLORE.EXE	%ProgramFiles%\internet explorer\iexplore.exe	344,064 bytes
IEXPLORE.EXE	%ProgramFiles%\internet explorer\iexplore.exe	344,064 bytes
IEXPLORE.EXE	%ProgramFiles%\internet explorer\iexplore.exe	344,064 bytes
IEXPLORE.EXE	%ProgramFiles%\internet explorer\iexplore.exe	344,064 bytes
IEXPLORE.EXE	%ProgramFiles%\internet explorer\iexplore.exe	344,064 bytes
IEXPLORE.EXE	%ProgramFiles%\internet explorer\iexplore.exe	344,064 bytes
IEXPLORE.EXE	%ProgramFiles%\internet explorer\iexplore.exe	344,064 bytes
IEXPLORE.EXE	%ProgramFiles%\internet explorer\iexplore.exe	344,064 bytes
IEXPLORE.EXE	%ProgramFiles%\internet explorer\iexplore.exe	344,064 bytes
IEXPLORE.EXE	%ProgramFiles%\internet explorer\iexplore.exe	344,064 bytes
IEXPLORE.EXE	%ProgramFiles%\internet explorer\iexplore.exe	344,064 bytes
IEXPLORE.EXE	%ProgramFiles%\internet explorer\iexplore.exe	344,064 bytes
IEXPLORE.EXE	%ProgramFiles%\internet explorer\iexplore.exe	344,064 bytes
IEXPLORE.EXE	%ProgramFiles%\internet explorer\iexplore.exe	344,064 bytes
IEXPLORE.EXE	%ProgramFiles%\internet explorer\iexplore.exe	344,064 bytes
IEXPLORE.EXE	%ProgramFiles%\internet explorer\iexplore.exe	344,064 bytes
IEXPLORE.EXE	%ProgramFiles%\internet explorer\iexplore.exe	344,064 bytes
IEXPLORE.EXE	%ProgramFiles%\internet explorer\iexplore.exe	344,064 bytes
IEXPLORE.EXE	%ProgramFiles%\internet explorer\iexplore.exe	344,064 bytes
IEXPLORE.EXE	%ProgramFiles%\internet explorer\iexplore.exe	344,064 bytes

Notes:

%ProgramFiles% is a variable that refers to the Program Files folder. A typical path is C:\Program Files.

Registry Modifications

The following Registry Keys were created:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9D71D88C-C598-4935-C5D1-43AA4DB90836}
HKEY_LOCAL_MACHINE\SOFTWARE\Bifrost
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\MediaResources\msvideo
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\MediaResources\msvideo
HKEY_CURRENT_USER\Software\Bifrost

The newly created Registry Values are:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9D71D88C-C598-4935-C5D1-43AA4DB90836}]

stubpath = "%System%\microsoft\windows.exe s"

so that windows.exe runs every time Windows starts

[HKEY_LOCAL_MACHINE\SOFTWARE\Bifrost]

nck = D9 12 E1 21 A9 71 9B 32 74 C3 CD 74 FA 93 5B 67

[HKEY_CURRENT_USER\Software\Bifrost]

klg = 01
plg1 = EA 44 DC 02 A3 27 D7 5F 11 AD B9 07 DA F2 35 03 2A 35 8E 58 1B 0E 11 94 D4 F9 28 1F 11 4D 98 BC D2 64 44 8E CD F9 B9 BA 23 BD 45 ED 15 A6 77 AF B8 7C 04 4D 90 91 58 5F 81 61 19 72 00 4E 53 7A E1 AB E6 8B 30 CA 34 56 F9 AD AD F8 4D 41 0F F6 9F 90 A2 1

Other details

To mark the presence in the system, the following Mutex object was created:

Bif1432

The following Host Name was requested from a host database:

chouaibio.no-ip.biz

There was registered attempt to establish connection with the remote host. The connection details are:

Remote Host	Port Number
chouaibio.no-ip.biz	88

There was application-defined hook procedure installed into the hook chain (e.g. to monitor keystrokes). The installed hook is handled by the following module:

%ProgramFiles%\Internet Explorer\iexplore.exe

Outbound traffic (potentially malicious)

There was an outbound traffic produced on port 88:

All content ("Information") contained in this report is the copyrighted work of Threat Expert Ltd and its associated companies ("ThreatExpert") and may not be copied without the express permission of ThreatExpert.

The Information is provided on an "as is" basis. ThreatExpert disclaims all warranties, whether express or implied, to the maximum extent permitted by law, including the implied warranties that the Information is merchantable, of satisfactory quality, accurate, fit for a particular purpose or need, or non-infringing, unless such implied warranties are legally incapable of exclusion. Further, ThreatExpert does not warrant or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise.