ThreatExpert Report

Visit ThreatExpert web site

Close Report

Submission Summary:

Submission details:

Submission received: 16 April 2009, 00:00:27
Processing time: 4 min 25 sec
Submitted sample:

File MD5: 0x876D5346D3BF209C0F593178ABDF6D45
File SHA-1: 0x8F9296FFAB07FC22D90E191AF6BA0BFD81B5C4AF
Filesize: 122,880 bytes

Technical Details:

File System Modifications

The following files were created in the system:

#	Filename(s)	File Size	File Hash
1	%CommonAppData%\Microsoft\Network\Downloader\qmgr0.dat	5,314 bytes	MD5: 0xF8190F57CC5417D160B887780955A6B8 SHA-1: 0xD033CED4E875784B3E77FB503F52FC5D89157C2B
2	%CommonAppData%\Microsoft\Network\Downloader\qmgr1.dat	5,314 bytes	MD5: 0x46391E833CECA4D8F2F8FB93F72E62AC SHA-1: 0x76F61779C8C1E42988B141317A2BF04925DC6260
3	%AppData%\BIT3.tmp	0 bytes	MD5: 0xD41D8CD98F00B204E9800998ECF8427E SHA-1: 0xDA39A3EE5E6B4B0D3255BFEF95601890AFD80709
4	%AppData%\iexplorer.exe [file and pathname of the sample #1]	122,880 bytes	MD5: 0x876D5346D3BF209C0F593178ABDF6D45 SHA-1: 0x8F9296FFAB07FC22D90E191AF6BA0BFD81B5C4AF

Notes:

%CommonAppData% is a variable that refers to the file system directory containing application data for all users. A typical path is C:\Documents and Settings\All Users\Application Data.
%AppData% is a variable that refers to the file system directory that serves as a common repository for application-specific data. A typical path is C:\Documents and Settings\[UserName]\Application Data.

The following directory was created:

%CommonAppData%\Microsoft\Network\Downloader

Memory Modifications

There were new processes created in the system:

Process Name	Process Filename	Main Module Size
iexplorer.exe	%AppData%\iexplorer.exe	126,976 bytes
IEXPLORE.EXE	%ProgramFiles%\Internet Explorer\IEXPLORE.EXE	102,400 bytes
[filename of the sample #1]	[file and pathname of the sample #1]	126,976 bytes

Notes:

%ProgramFiles% is a variable that refers to the Program Files folder. A typical path is C:\Program Files.

The following system service was modified:

Service Name	Display Name	New Status	Service Filename
BITS	Background Intelligent Transfer Service	"Running"	%System%\svchost.exe -k netsvcs

Notes:

%System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

Registry Modifications

The following Registry Keys were created:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run

The newly created Registry Values are:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run]

Internet Explorer = "%AppData%\iexplorer.exe"

so that iexplorer.exe runs every time Windows starts

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]

TInst = "yes"
TCmc = "yes"
TUID = "cd1a40"
TVer = "8"
TLCMPD = "net"

Other details

To mark the presence in the system, the following Mutex objects were created:

traff
_SHuassist.mtx

Heuristics Analysis

Heuristically identified capability to use BITS (Background Intelligent Transfer Service) to schedule the following download task:

http://download.microsoft.com/download/win95upg/update/6/w95/en-us/ww1138.exe

Downloaded File Summary:

Download details:

Download retrieved: 16 April 2009 00:08:42
Processing time: 3 min 53 sec
Downloaded sample:

File MD5: 0x32582D85875D9AE3CF17127B1930CDEC
File SHA-1: 0xA1A3CC29661D1B36EA8293FA3ECDB28CCB98C9B8
Filesize: 41,480 bytes

Technical Details:

File System Modifications

The following file was created in the system:

#	Filename(s)	File Size	File Hash
1	[file and pathname of the sample #1]	41,480 bytes	MD5: 0x32582D85875D9AE3CF17127B1930CDEC SHA-1: 0xA1A3CC29661D1B36EA8293FA3ECDB28CCB98C9B8

All content ("Information") contained in this report is the copyrighted work of Threat Expert Ltd and its associated companies ("ThreatExpert") and may not be copied without the express permission of ThreatExpert.

The Information is provided on an "as is" basis. ThreatExpert disclaims all warranties, whether express or implied, to the maximum extent permitted by law, including the implied warranties that the Information is merchantable, of satisfactory quality, accurate, fit for a particular purpose or need, or non-infringing, unless such implied warranties are legally incapable of exclusion. Further, ThreatExpert does not warrant or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise.