Submission Summary:

• Submission details:
• Submission received: 28 March 2018, 00:29:17
• Processing time: 5 min 41 sec
• Submitted sample:
• File MD5: 0x73088B5B25A0905F6B40AEE13B7972E4
• File SHA-1: 0x8CECFA9C766BD71BAC74DA8F4FC4A5C3434343A7
• Filesize: 240,640 bytes
• Alias & packer info:
• Suspicious.MH690 [Symantec]
• Generic BackDoor.yl [McAfee]
• Mal/Behav-024 [Sophos]
• Trojan:Win32/Delfsnif.DU [Microsoft]
• Backdoor.Win32.Fynloski [Ikarus]
• packed with: MPRESS [Kaspersky Lab]

• Summary of the findings:

What's been found	Severity Level
Modifies some system settings that may have negative impact on overall system security state.
Creates a startup registry entry.

Technical Details:

File System Modifications

• The following file was created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%System%\hidden.exe [file and pathname of the sample #1]	240,640 bytes	MD5: 0x73088B5B25A0905F6B40AEE13B7972E4 SHA-1: 0x8CECFA9C766BD71BAC74DA8F4FC4A5C3434343A7	Suspicious.MH690 [Symantec] Generic BackDoor.yl [McAfee] Mal/Behav-024 [Sophos] Trojan:Win32/Delfsnif.DU [Microsoft] Backdoor.Win32.Fynloski [Ikarus] packed with MPRESS [Kaspersky Lab]

• Note:
• %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

Memory Modifications

• There were new processes created in the system:

Process Name	Process Filename	Main Module Size
hidden.exe	%System%\hidden.exe	741,376 bytes
[filename of the sample #1]	[file and pathname of the sample #1]	741,376 bytes

Registry Modifications

• The following Registry Keys were created:
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\CurrentVersion
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\CurrentVersion\Explorern
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System
• HKEY_CURRENT_USER\Software\DC3_FEXEC

• The newly created Registry Values are:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
• AntiVirusDisableNotify = "1"
• UpdatesDisableNotify = "1"

to disable notification of firewall, antivirus and/or update status through the Windows Security Center

• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\CurrentVersion\Explorern]
• NoControlPanel = "1"
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
• EnableLUA = 0x00000000
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
• MicroUpdate = "%System%\hidden.exe"

so that hidden.exe runs every time Windows starts

• The following Registry Value was deleted:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
• AntiVirusDisableNotify = 0x00000001
• UpdatesDisableNotify = 0x00000001

• The following Registry Value was modified:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
• Userinit =

Other details

• Analysis of the file resources indicate the following possible country of origin:

	France

• To mark the presence in the system, the following Mutex object was created:
• DC_MUTEX-UY4BBES

• The following Host Name was requested from a host database:
• 192.5.5.241