Submission Summary:

• Submission details:
• Submission received: 24 September 2012, 09:49:10
• Processing time: 8 min 13 sec
• Submitted sample:
• File MD5: 0x8908B9EE26538EB705982259F68191BF
• File SHA-1: 0xD15BA6B74EE85A1E7F30EE62C4B0690EDD6AB168
• Filesize: 147,837 bytes
• Alias:
• W32.Sality.AE [Symantec]
• Virus.Win32.Sality.ag [Kaspersky Lab]
• W32/Sality.gen.z [McAfee]
• Mal/Sality-D [Sophos]
• Virus:Win32/Sality.AT [Microsoft]
• Virus.Win32.Virut [Ikarus]
• Win32/Kashu.E [AhnLab]

• Summary of the findings:

What's been found	Severity Level
Produces outbound traffic.
Creates a startup registry entry.
Contains characteristics of an identified security risk.

Technical Details:

• The new window was created, as shown below:

Possible Security Risk

• Attention! Characteristics of the following security risk was identified in the system:

Security Risk	Description
Backdoor.Generic	These common components have files and keys that are in different threats but the threats are not related to one another in that the author of the signature is not the same. It is recommended that all these entries be removed.

• Attention! The following threat category was identified:

Threat Category	Description
	A virus capable to modify other files by infecting, prepending, or overwriting them them with its own body

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%Temp%\24092012-094914182.BMP	921,654 bytes	MD5: 0x69286F8E63CAAE3DDFB7457F872D4C5A SHA-1: 0xAE743B062FF44D604CDBF1F5A3D436BA5A155472	(not available)
2	%Temp%\24092012-094914182.JPG	29,771 bytes	MD5: 0x984D730EE9F007681461EB453A5DF9B0 SHA-1: 0xBF39CBD23118A41D53B819029E4A8548FC93B2BE	(not available)
3	%Temp%\24092012-094914182.TXT	426 bytes	MD5: 0xFC74EBB05A9D7B21DCE7099C0836A8AA SHA-1: 0xDCE84D3E96AD7511AB985CC98A440B705B49956D	(not available)
4	%Temp%\rose.JPG	16,549 bytes	MD5: 0xEA0FB3401ABA8E0CE1D0BD80F135B795 SHA-1: 0x9E2B99DD154A7D3D4A1CF5AAE2C9DAAA3CC82EB9	(not available)
5	[file and pathname of the sample #1] %System%\winlgon.exe	147,837 bytes	MD5: 0x8908B9EE26538EB705982259F68191BF SHA-1: 0xD15BA6B74EE85A1E7F30EE62C4B0690EDD6AB168	W32.Sality.AE [Symantec] Virus.Win32.Sality.ag [Kaspersky Lab] W32/Sality.gen.z [McAfee] Mal/Sality-D [Sophos] Virus:Win32/Sality.AT [Microsoft] Virus.Win32.Virut [Ikarus] Win32/Kashu.E [AhnLab]

• Notes:
• %Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).
• %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

Memory Modifications

• There were new processes created in the system:

Process Name	Process Filename	Main Module Size
winlgon.exe	%System%\winlgon.exe	155,648 bytes
[filename of the sample #1]	[file and pathname of the sample #1]	155,648 bytes

Registry Modifications

• The following Registry Keys were created:
• HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\MediaResources\msvideo
• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\MediaResources\msvideo
• HKEY_CURRENT_USER\Software\Microsoft\Multimedia\DrawDib

• The newly created Registry Values are:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
• winlgon.exe = "%System%\winlgon.exe"

so that winlgon.exe runs every time Windows starts

• [HKEY_CURRENT_USER\Software\Microsoft\Multimedia\DrawDib]
• vga.drv 640x480x32(BGR 0) = "31,31,31,31"

Other details

• To mark the presence in the system, the following Mutex object was created:
• uxJLpe1m

• The following Host Names were requested from a host database:
• 192.5.5.241
• yahhelper.no-ip.org

• There was registered attempt to establish connection with the remote host. The connection details are:

• There was application-defined hook procedure installed into the hook chain (e.g. to monitor keystrokes). The installed hook is handled by the following module:
• %System%\winlgon.exe

Outbound traffic (potentially malicious)

• There was an outbound traffic produced on port 27020: