Submission Summary:

• Submission details:
• Submission received: 25 October 2012, 06:55:27
• Processing time: 10 min 34 sec
• Submitted sample:
• File MD5: 0x6759477AC0BDBE5E3A0F2FEC55AF2DD7
• File SHA-1: 0x2D95FF2E21E3A1F9BAB7A31011A98F7FABA31EBF
• Filesize: 3,524,339 bytes
• Alias: Worm.Win32.AutoIt [Ikarus]

• Summary of the findings:

What's been found	Severity Level
Creates a startup registry entry.

Technical Details:

• The new window was created, as shown below:

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	c:\! My Picutre.SCR %Temp%\Internet Explorer.exe %Temp%\Key.exe %Programs%\Startup\3e936482e28cca4a48b713452330a269.exe %Programs%\Startup\Key.exe	1,255,424 bytes	MD5: 0x36CB22A52AF5CB602D535D0E71C0FB75 SHA-1: 0x9A77556F776C35D443F757CD0E5CBE47626C685B	Win32.SuspectCrc [Ikarus] packed with PE_Patch.Enigma [Kaspersky Lab]
2	%Temp%\Internet Explorer.exe.tmp	0 bytes	MD5: 0xD41D8CD98F00B204E9800998ECF8427E SHA-1: 0xDA39A3EE5E6B4B0D3255BFEF95601890AFD80709	(not available)
3	%Temp%\Windows Loader.exe	3,752,639 bytes	MD5: 0x604B07BA2C3FBCD07CF2E84068CB6B1C SHA-1: 0xC20F5AA64BFD99571F1B0A7162D5187F1401D994	W32/AutoRun-BSY [Sophos] packed with UPX [Kaspersky Lab]
4	[file and pathname of the sample #1]	3,524,339 bytes	MD5: 0x6759477AC0BDBE5E3A0F2FEC55AF2DD7 SHA-1: 0x2D95FF2E21E3A1F9BAB7A31011A98F7FABA31EBF	Worm.Win32.AutoIt [Ikarus] packed with UPX [Kaspersky Lab]

• Notes:
• %Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).
• %Programs% is a variable that refers to the file system directory that contains the user's program groups. A typical path is C:\Documents and Settings\[UserName]\Start Menu\Programs.

Memory Modifications

• There were new processes created in the system:

Registry Modifications

• The following Registry Key was created:
• HKEY_CURRENT_USER\Software\3e936482e28cca4a48b713452330a269

• The newly created Registry Values are:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
• 3e936482e28cca4a48b713452330a269 = ""%Temp%\Internet Explorer.exe" .."

so that Internet Explorer.exe runs every time Windows starts

• [HKEY_CURRENT_USER\Environment]
• SEE_MASK_NOZONECHECKS = "1"
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
• 3e936482e28cca4a48b713452330a269 = ""%Temp%\Internet Explorer.exe" .."

so that Internet Explorer.exe runs every time Windows starts

• [HKEY_CURRENT_USER\Software\3e936482e28cca4a48b713452330a269]
• US = "@"

Other details

• Analysis of the file resources indicate the following possible country of origin:

	United Kingdom

• To mark the presence in the system, the following Mutex objects were created:
• 3e936482e28cca4a48b713452330a269
• WIN7LDRMU

• The following Host Name was requested from a host database:
• eoeox.no-ip.biz