Submission Summary:

• Submission details:
• Submission received: 1 October 2012, 00:33:06
• Processing time: 9 min 39 sec
• Submitted sample:
• File MD5: 0x793CF02BFA5F50D5F7ADF2739D30709B
• File SHA-1: 0x8D2B694CEECC248A11A39BA8F0AC95B256E2F9F6
• Filesize: 1,769,472 bytes
• Alias:
• Trojan.Win32.Genome.aeytw [Kaspersky Lab]
• Mal/Generic-L [Sophos]
• Trojan:Win32/Malagent [Microsoft]
• Trojan.Win32.Sasfis [Ikarus]

• Summary of the findings:

What's been found	Severity Level
Capability to send out email message(s) with the built-in SMTP client engine.
Downloads/requests other files from Internet.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! The following threat category was identified:

Threat Category	Description
	A malicious trojan horse or bot that may represent security risk for the compromised system and/or its network environment

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	[file and pathname of the sample #1]	1,769,472 bytes	MD5: 0x793CF02BFA5F50D5F7ADF2739D30709B SHA-1: 0x8D2B694CEECC248A11A39BA8F0AC95B256E2F9F6	Trojan.Win32.Genome.aeytw [Kaspersky Lab] Mal/Generic-L [Sophos] Trojan:Win32/Malagent [Microsoft] Trojan.Win32.Sasfis [Ikarus]
2	%System%\superec.ProcessMemory.sys	3,712 bytes	MD5: 0x7FC8F430B830C119640C606DE9BB907C SHA-1: 0xD9344F89A9D0D6FDC4629F64E8387D86F67B76E0	Trojan Horse [Symantec] not-a-virus:RiskTool.Win32.ProcPatcher.a [Kaspersky Lab] Generic.dx!gxs [McAfee] Troj/DwnLdr-JCX [Sophos] Gen.Rootkit [Ikarus] Win-Trojan/Rootkit.3712.F [AhnLab]

• Note:
• %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

Memory Modifications

• There was a new process created in the system:

Registry Modifications

• The following Registry Keys were created:
• HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_IALDNWXF
• HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_IALDNWXF\0000
• HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_IALDNWXF\0000\Control
• HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ialdnwxf
• HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ialdnwxf\Security
• HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ialdnwxf\Enum
• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_IALDNWXF
• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_IALDNWXF\0000
• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_IALDNWXF\0000\Control
• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ialdnwxf
• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ialdnwxf\Security
• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ialdnwxf\Enum
• HKEY_CURRENT_USER\Software\Microsoft\Multimedia\DrawDib

• The newly created Registry Values are:
• [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_IALDNWXF\0000\Control]
• *NewlyCreated* = 0x00000000
• ActiveService = "ialdnwxf"
• [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_IALDNWXF\0000]
• Service = "ialdnwxf"
• Legacy = 0x00000001
• ConfigFlags = 0x00000000
• Class = "LegacyDriver"
• ClassGUID = "{8ECC055D-047F-11D1-A537-0000F8753ED1}"
• DeviceDesc = "ialdnwxf"
• [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_IALDNWXF]
• NextInstance = 0x00000001
• [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ialdnwxf\Enum]
• 0 = "Root\LEGACY_IALDNWXF\0000"
• Count = 0x00000001
• NextInstance = 0x00000001
• [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ialdnwxf\Security]
• Security = 01 00 14 80 90 00 00 00 9C 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 60 00 04 00 00 00 00 00 14 00 FD 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 18 00 FF 01 0F 0
• [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ialdnwxf]
• Type = 0x00000001
• Start = 0x00000003
• ErrorControl = 0x00000000
• ImagePath = "%System%\superec.ProcessMemory.sys"
• DisplayName = "ialdnwxf"
• [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_IALDNWXF\0000\Control]
• *NewlyCreated* = 0x00000000
• ActiveService = "ialdnwxf"
• [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_IALDNWXF\0000]
• Service = "ialdnwxf"
• Legacy = 0x00000001
• ConfigFlags = 0x00000000
• Class = "LegacyDriver"
• ClassGUID = "{8ECC055D-047F-11D1-A537-0000F8753ED1}"
• DeviceDesc = "ialdnwxf"
• [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_IALDNWXF]
• NextInstance = 0x00000001
• [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ialdnwxf\Enum]
• 0 = "Root\LEGACY_IALDNWXF\0000"
• Count = 0x00000001
• NextInstance = 0x00000001
• [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ialdnwxf\Security]
• Security = 01 00 14 80 90 00 00 00 9C 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 60 00 04 00 00 00 00 00 14 00 FD 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 18 00 FF 01 0F 0
• [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ialdnwxf]
• Type = 0x00000001
• Start = 0x00000003
• ErrorControl = 0x00000000
• ImagePath = "%System%\superec.ProcessMemory.sys"
• DisplayName = "ialdnwxf"
• [HKEY_CURRENT_USER\Software\Microsoft\Multimedia\DrawDib]
• vga.drv 640x480x32(BGR 0) = "31,31,31,31"

Other details

• Analysis of the file resources indicate the following possible country of origin:

	China

• To mark the presence in the system, the following Mutex object was created:
• _!SHMSFTHISTORY!_

• The following ports were open in the system:

• The following Internet Connections were established:

• The following GET requests were made:
• %8C%ADk%D1%A7%CF%B0%BB%F9%B5%D8/blog/item/9e54f22f2ef462e0e7cd403a.html
• user/admin/lincer
• user/admin/index.jpg