Submission Summary:

• Submission details:
• Submission received: 15 February 2011, 05:30:09
• Processing time: 8 min 9 sec
• Submitted sample:
• File MD5: 0x831AC51EA2A887936A1F60A10052D156
• File SHA-1: 0x37ED8C442095CC84EDCC46BE0FA35B3D92341711
• Filesize: 44,485 bytes
• Alias & packer info:
• Email-Worm.Rontokbro [PCTools]
• W32.Rontokbro.K@mm [Symantec]
• Email-Worm.Win32.Brontok.ai [Kaspersky Lab]
• W32/Rontokbro.gen@MM [McAfee]
• PE_BRONTOK.A [Trend Micro]
• W32/Brontok-DX [Sophos]
• Worm:Win32/Brontok.FF [Microsoft]
• Trojan.Matba [Ikarus]
• Win32/Brontok.worm.182784 [AhnLab]
• packed with: Polyene [Kaspersky Lab]

• Summary of the findings:

What's been found	Severity Level
Creates a startup registry entry.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! Characteristics of the following security risk was identified in the system:

Security Risk	Description
Email-Worm.Brontok!ct	Email-Worm.Brontok!ct is a mass-mailing application that propagates from one system to another by creating a new email message, attaching itself and then sending the message without user's consent

• Attention! The following threat categories were identified:

Threat Category	Description
	A network-aware worm that attempts to replicate across the existing network(s)
	A malicious trojan horse or bot that may represent security risk for the compromised system and/or its network environment

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%CommonPrograms%\Startup\Startup.exe %AppData%\%UserName%.exe %Windir%\Shell\explorer.exe %Windir%\Shell\Hide IP.exe %Windir%\Shell\iexplorer.exe [file and pathname of the sample #1] %System%\%UserName%'s Setting.scr	44,485 bytes	MD5: 0x831AC51EA2A887936A1F60A10052D156 SHA-1: 0x37ED8C442095CC84EDCC46BE0FA35B3D92341711	Email-Worm.Rontokbro [PCTools] W32.Rontokbro.K@mm [Symantec] Email-Worm.Win32.Brontok.ai [Kaspersky Lab] W32/Rontokbro.gen@MM [McAfee] PE_BRONTOK.A [Trend Micro] W32/Brontok-DX [Sophos] Worm:Win32/Brontok.FF [Microsoft] Trojan.Matba [Ikarus] Win32/Brontok.worm.182784 [AhnLab] packed with Polyene [Kaspersky Lab]
2	%DesktopDir%\about me.htm	320 bytes	MD5: 0x027B0F0597C01DEA9439E3F1845937CC SHA-1: 0x37CA20771D2DC7D76CCB5BFD6D07A67782E22EF8	HTML/Rontokbro [McAfee]
3	%AppData%\msvbvm60.dll %Windir%\Shell\msvbvm60.dll %Windir%\system\msvbvm60.dll	1,386,496 bytes	MD5: 0xF28EB5CBC3CA6D8C787F09F047D1F9C8 SHA-1: 0x70DB1FAC822974BC9B636A984BCC1DA2E67F8DE5	(not available)
4	%Windir%\Shell\Reaming.bat	81 bytes	MD5: 0x406EB82976BB1B571A751C679E6FB824 SHA-1: 0xE50677D8F86E1AFD9C0ECD73E72C0C74AAD78C84	Trojan.Generic [PCTools] Trojan Horse [Symantec] Bat/Rontokbro [McAfee] BAT.AddUser [Ikarus]

• Notes:
• %CommonPrograms% is a variable that refers to the file system directory that contains the directories for the common program groups that appear on the Start menu for all users. A typical path is C:\Documents and Settings\All Users\Start Menu\Programs (Windows NT/2000/XP).
• %AppData% is a variable that refers to the file system directory that serves as a common repository for application-specific data. A typical path is C:\Documents and Settings\[UserName]\Application Data.
• %Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.
• %UserName% is a variable that refers to the current user name.
• %DesktopDir% is a variable that refers to the file system directory used to physically store file objects on the desktop. A typical path is C:\Documents and Settings\[UserName]\Desktop.

• The following directory was created:
• %Windir%\Shell

Memory Modifications

• There were new processes created in the system:

• The following module was loaded into the address space of other process(es):

Module Name	Module Filename	Address Space Details
MSVBVM60.DLL	%AppData%\MSVBVM60.DLL	Process name: %UserName%.exe Process filename: %AppData%\%UserName%.exe Address space: 0x66000000 - 0x66152000

Registry Modifications

• The following Registry Keys were created:
• HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\NOD32krn
• HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Norman NJeeves
• HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Norman ZANDA
• HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\NOD32krn
• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NOD32krn
• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Norman NJeeves
• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Norman ZANDA

• The newly created Registry Values are:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
• smss = "%Windir%\Shell\explorer.exe"

so that explorer.exe runs every time Windows starts

• [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\NOD32krn]
• Start = 0x00000004
• [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Norman NJeeves]
• Start = 0x00000004
• [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Norman ZANDA]
• Start = 0x00000004
• [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\NOD32krn]
• Start = 0x00000004
• [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NOD32krn]
• Start = 0x00000004
• [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Norman NJeeves]
• Start = 0x00000004
• [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Norman ZANDA]
• Start = 0x00000004
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
• %UserName% = "%AppData%\%UserName%.exe"

so that %UserName%.exe runs every time Windows starts

• The following Registry Values were modified:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory]
• (Default) =
• [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile]
• (Default) =
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL]
• Type =
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\HideFileExt]
• Type =
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden]
• Type =
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
• Shell =