Submission Summary:

• Submission details:
• Submission received: 13 September 2012, 14:47:10
• Processing time: 10 min 18 sec
• Submitted sample:
• File MD5: 0x6F03595A5367BB497D8FD54E788675CE
• File SHA-1: 0x88C093FAB3BB77E7B6052748896248D3D0349B10
• Filesize: 1,078,784 bytes
• Alias:
• Worm.Win32.AutoRun.fnc [Kaspersky Lab]
• W32/Tupym.worm [McAfee]
• W32/AutoRun-BUC [Sophos]
• Worm.Win32.AutoIt [Ikarus]

• Summary of the findings:

What's been found	Severity Level
Downloads/requests other files from Internet.
Creates a startup registry entry.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! The following threat category was identified:

Threat Category	Description
	A network-aware worm that attempts to replicate across the existing network(s)

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%System%\autorun.ini	102 bytes	MD5: 0x948C74CD98911B420FF89DAC13399BCB SHA-1: 0x76DFC73518F003953923B1B4F2B973F4BB56A411	W32.Svich [Symantec] Worm.Win32.AutoRun.gmp [Kaspersky Lab] W32/Tupym.worm!inf [McAfee] W32/AutoRun-AOA [Sophos]
2	[file and pathname of the sample #1] %System%\system3_.exe %Windir%\system3_.exe	1,078,784 bytes	MD5: 0x6F03595A5367BB497D8FD54E788675CE SHA-1: 0x88C093FAB3BB77E7B6052748896248D3D0349B10	Worm.Win32.AutoRun.fnc [Kaspersky Lab] W32/Tupym.worm [McAfee] W32/AutoRun-BUC [Sophos] Worm.Win32.AutoIt [Ikarus]

• Notes:
• %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).
• %Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.

Memory Modifications

• There were new processes created in the system:

Process Name	Process Filename	Main Module Size
[filename of the sample #1]	[file and pathname of the sample #1]	1,167,360 bytes
system3_.exe	%System%\system3_.exe	1,167,360 bytes
system3_.exe	%Windir%\system3_.exe	1,167,360 bytes

Registry Modifications

• The following Registry Keys were created:
• HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Internet Explorer
• HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Internet Explorer\Control Panel
• HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer
• HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Control Panel

• The newly created Registry Value is:
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
• Yahoo Messengger = "%System%\system3_.exe"

so that system3_.exe runs every time Windows starts

• The following Registry Values were modified:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main]
• Default_Page_URL =
• Default_Search_URL =
• Search Page =
• Start Page =
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
• Shell =
• [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
• Start Page =

Other details

• Analysis of the file resources indicate the following possible country of origin:

	United Kingdom

• To mark the presence in the system, the following Mutex object was created:
• _!SHMSFTHISTORY!_

• The following Internet Connections were established:

• The following GET requests were made:
• asdb000/setting.ini
• index.html
• set/setting.ini
• asdb002/setting.ini
• asdb004/setting.ini
• asdb006/setting.ini
• asdb008/setting.ini
• asdb010/setting.ini
• asdb012/setting.ini
• index.jpg
• asdb014/setting.ini
• asdb016/setting.ini
• asdb018/setting.ini
• asdb020/setting.ini
• asdb022/setting.ini
• asdb024/setting.ini
• asdb026/setting.ini
• asdb028/setting.ini
• asdb030/setting.ini
• asdb032/setting.ini
• asdb034/setting.ini
• asdb036/setting.ini
• asdb038/setting.ini
• asdb040/setting.ini
• asdb042/setting.ini
• asdb044/setting.ini
• asdb046/setting.ini
• asdb048/setting.ini
• asdb050/setting.ini