ThreatExpert Report: Generic Exploit!g, Mal/Generic-A, Exploit:Win32/MS08067.gen!A..

Submission Summary:

Submission details:

Submission received: 16 November 2009, 01:55:46
Processing time: 8 min 39 sec
Submitted sample:

File MD5: 0xA9E91BC2D4D8ED59AF12D9CAF491D472
File SHA-1: 0x39D7CC597188918E66855F14CBFAFC2B38C05E7E
Filesize: 310,272 bytes

Summary of the findings:

What's been found	Severity Level
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

Attention! Characteristics of the following security risk was identified in the system:

Security Risk	Description
Adware.Component.Unrelated	These common components have files and keys that are in different threats but the threats are not related to one another in that the author of the signature is not the same. It is recommended that all these entries be removed.

File System Modifications

The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%Temp%\1.BAT	113 bytes	MD5: 0x2B8813932A301DED61E70D43DD31A17E SHA-1: 0x42DEF48F0FEA210B9F3565AAEAECF0681E9FC70A	(not available)
2	%Temp%\1.tmp %Temp%\2.tmp %Temp%\5.tmp %Windir%\Temp\3.tmp	0 bytes	MD5: 0xD41D8CD98F00B204E9800998ECF8427E SHA-1: 0xDA39A3EE5E6B4B0D3255BFEF95601890AFD80709	(not available)
3	%Temp%\2.BAT	101 bytes	MD5: 0xBE7C73C3720AA378DF779AECE4D8354A SHA-1: 0xE32D08855007465E05EE0198EB2BF9B67359CE5B	(not available)
4	%System%\Add.txt %System%\drivers\usbbak.sys	19 bytes	MD5: 0x3A3A56D6EB19B3C3C59051575E6827E5 SHA-1: 0x5C850817CA734D5B74837717542C8A55A8581BF3	(not available)
5	%System%\dllcache\tlntsvr.exe	68,096 bytes	MD5: 0xE7B985036A2E1560353CCAC8B17AAB47 SHA-1: 0x4F27EAC2D14AB50021A5F5DA5C0028E5CDBC03F1	(not available)
6	%System%\drivers\usbboot.sys	94,720 bytes	MD5: 0x61BD6F40C87B4E8C70268FFC682E4A6C SHA-1: 0x9F3CF12C5FCB493AA54C3CFAE185DC8B71FBFAF9	(not available)
7	%System%\drivers\usbdisk.sys	56,832 bytes	MD5: 0x1671C5B29BA0262D0F2A6C87E87F84FF SHA-1: 0xB4D72F49661E5AD2FAA68951E82C192CD1271FB6	(not available)
8	%System%\drivers\usbspeed.sys	29,614 bytes	MD5: 0x1ADED6DC27851F0FE4797D292A9F6B28 SHA-1: 0xF06090F9776A5E2D7FF6349E71C867848040B533	(not available)
9	%System%\expolrer.exe	94,720 bytes	MD5: 0x6A6F07EB50AF47134F74B38E7ACA4854 SHA-1: 0x2035F638A2EBA831776B672E6D27ED1EAE4B15C5	(not available)
10	%System%\map.txt	29,614 bytes	MD5: 0x70D3BF3DAE4C85A9F7AA8C4ED4541F43 SHA-1: 0x20623A0CC0C737DEDAF82FC447D3D35E7DC63997	(not available)
11	[file and pathname of the sample #1]	310,272 bytes	MD5: 0xA9E91BC2D4D8ED59AF12D9CAF491D472 SHA-1: 0x39D7CC597188918E66855F14CBFAFC2B38C05E7E	(not available)
12	%System%\scvhost.exe	56,832 bytes	MD5: 0x11AFFA90A91024E39E6F3EC862828873 SHA-1: 0x59916B45DF3E904AE1958A42FDD43757333D0C69	Generic Exploit!g [McAfee] Mal/Generic-A [Sophos] Exploit:Win32/MS08067.gen!A [Microsoft] Exploit.Win32.MS08067 [Ikarus]
13	%System%\wbem\Performance\WmiApRpl_new.h	357 bytes	MD5: 0x52DF6A809F7BA7A7ABF1252F292B4E25 SHA-1: 0x3703531F953FE8B6FE72931BECFCFEC5C146669A	(not available)

Notes:

%Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).
%Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.
%System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

The following file was modified:

%System%\tlntsvr.exe

Memory Modifications

There were new processes created in the system:

Process Name	Process Filename	Main Module Size
expolrer.exe	%System%\expolrer.exe	4,112,384 bytes
tlntsvr.exe	%System%\dllcache\tlntsvr.exe	86,016 bytes
[filename of the sample #1]	[file and pathname of the sample #1]	335,872 bytes

The following system services were modified:

Service Name	Display Name	New Status	Service Filename
ALG	Application Layer Gateway Service	"Stopped"	%System%\alg.exe
SharedAccess	Windows Firewall/Internet Connection Sharing (ICS)	"Stopped"	%System%\svchost.exe -k netsvcs
TlntSvr	Telnet	"Running"	%System%\tlntsvr.exe

Registry Modifications

The following Registry Keys were created:

HKEY_LOCAL_MACHINE\SAM\SAM\Domains
HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account
HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Aliases
HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Aliases\000003E9
HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Aliases\Members
HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Aliases\Members\S-1-5-21-606747145-764733703-839522115
HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Aliases\Members\S-1-5-21-606747145-764733703-839522115\000003EA
HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Aliases\Names
HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Aliases\Names\HelpServicesGroup
HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Groups
HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Groups\00000201
HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Groups\Names
HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Groups\Names\None
HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users
HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users\000001F4
HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users\000001F5
HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users\000003E8
HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users\000003EA
HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users\000003EB
HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users\Names
HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users\Names\Administrator
HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users\Names\Guest
HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users\Names\HelpAssistant
HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users\Names\SUPPORT_388945a0
HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users\Names\%UserName%
HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Builtin
HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Builtin\Aliases
HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Builtin\Aliases\00000220
HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Builtin\Aliases\00000221
HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Builtin\Aliases\00000222
HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Builtin\Aliases\00000223
HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Builtin\Aliases\00000227
HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Builtin\Aliases\00000228
HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Builtin\Aliases\0000022B
HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Builtin\Aliases\0000022C
HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Builtin\Aliases\Members
HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Builtin\Aliases\Members\S-1-5
HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Builtin\Aliases\Members\S-1-5\00000004
HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Builtin\Aliases\Members\S-1-5\0000000B
HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Builtin\Aliases\Members\S-1-5-21-606747145-764733703-839522115
HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Builtin\Aliases\Members\S-1-5-21-606747145-764733703-839522115\000001F4
HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Builtin\Aliases\Members\S-1-5-21-606747145-764733703-839522115\000001F5
HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Builtin\Aliases\Members\S-1-5-21-606747145-764733703-839522115\000003EB
HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Builtin\Aliases\Names
HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Builtin\Aliases\Names\Administrators
HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Builtin\Aliases\Names\Backup Operators
HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Builtin\Aliases\Names\Guests
HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Builtin\Aliases\Names\Network Configuration Operators
HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Builtin\Aliases\Names\Power Users
HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Builtin\Aliases\Names\Remote Desktop Users
HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Builtin\Aliases\Names\Replicator
HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Builtin\Aliases\Names\Users
HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Builtin\Groups
HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Builtin\Groups\Names
HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Builtin\Users
HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Builtin\Users\Names
HKEY_LOCAL_MACHINE\SAM\SAM\RXACT
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_TLNTSVR
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_TLNTSVR\0000
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_TLNTSVR\0000\Control
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_TLNTSVR
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_TLNTSVR\0000
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_TLNTSVR\0000\Control

Notes:

%UserName% is a variable that refers to the current user name.

The newly created Registry Values are:

[HKEY_LOCAL_MACHINE\SAM\SAM]

C = 07 00 01 00 00 00 00 00 98 00 00 00 02 00 01 00 01 00 14 80 78 00 00 00 88 00 00 00 14 00 00 00 44 00 00 00 02 00 30 00 02 00 00 00 02 C0 14 00 0E 00 05 01 01 01 00 00 00 00 00 01 00 00 00 00 02 C0 14 00 FF FF 1F 00 01 01 00 00 00 00 00 05 07 00 00 0

[HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Aliases\Members\S-1-5-21-606747145-764733703-839522115\000003EA]

(Default) = "?"

[HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Aliases\Members\S-1-5-21-606747145-764733703-839522115]

(Default) = ""

[HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Aliases\Names\HelpServicesGroup]

(Default) = (zero-length binary value)

[HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Aliases\Names]

(Default) = (zero-length binary value)

[HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Aliases\Members]

(Default) = (zero-length binary value)

[HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Aliases\000003E9]

C = E9 03 00 00 00 00 00 00 B0 00 00 00 02 00 01 00 B0 00 00 00 22 00 00 00 00 00 00 00 D4 00 00 00 4A 00 00 00 00 00 00 00 20 01 00 00 1C 00 00 00 01 00 00 00 01 00 14 80 90 00 00 00 A0 00 00 00 14 00 00 00 44 00 00 00 02 00 30 00 02 00 00 00 02 C0 14 0

[HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Groups\Names\None]

(Default) = (zero-length binary value)

[HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Groups\Names]

(Default) = (zero-length binary value)

[HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Groups\00000201]

C = 02 00 01 00 01 02 00 00 07 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 B0 00 00 00 02 00 01 00 B0 00 00 00 08 00 00 00 00 00 00 00 B8 00 00 00 1C 00 00 00 00 00 00 00 D4 00 00 00 64 00 00 00 05 00 00 00 01 00 14 80 90 00 00 00 A0 00 00 00 14 00 00 0

[HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users\Names\%UserName%]

(Default) = (zero-length binary value)

[HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users\Names\SUPPORT_388945a0]

(Default) = (zero-length binary value)

[HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users\Names\HelpAssistant]

(Default) = (zero-length binary value)

[HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users\Names\Guest]

(Default) = (zero-length binary value)

[HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users\Names\Administrator]

(Default) = (zero-length binary value)

[HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users\Names]

(Default) = (zero-length binary value)

[HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users\000003EB]

F = 02 00 01 00 00 00 00 00 EA FB 41 67 0F 3B CA 01 00 00 00 00 00 00 00 00 8A 76 25 38 01 CE C6 01 FF FF FF FF FF FF FF 7F 00 00 00 00 00 00 00 00 EB 03 00 00 01 02 00 00 10 02 00 00 00 00 00 00 00 00 76 01 01 00 00 00 00 00 E7 77 00 00 09 00
V = 00 00 00 00 BC 00 00 00 02 00 01 00 BC 00 00 00 10 00 00 00 00 00 00 00 CC 00 00 00 00 00 00 00 00 00 00 00 CC 00 00 00 00 00 00 00 00 00 00 00 CC 00 00 00 00 00 00 00 00 00 00 00 CC 00 00 00 00 00 00 00 00 00 00 00 CC 00 00 00 00 00 00 00 00 00 00 0

[HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users\000003EA]

F = 02 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 94 71 47 44 00 CE C6 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 EA 03 00 00 01 02 00 00 11 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 FF FF EB 06 91 7C
V = 00 00 00 00 D4 00 00 00 02 00 01 00 D4 00 00 00 20 00 00 00 00 00 00 00 F4 00 00 00 68 00 00 00 00 00 00 00 5C 01 00 00 76 00 00 00 00 00 00 00 D4 01 00 00 00 00 00 00 00 00 00 00 D4 01 00 00 00 00 00 00 00 00 00 00 D4 01 00 00 00 00 00 00 00 00 00 0

[HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users\000003E8]

F = 02 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 C4 3A 37 06 00 CE C6 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E8 03 00 00 01 02 00 00 11 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 FF FF EB 06 91 7C
V = 00 00 00 00 D4 00 00 00 02 00 01 00 D4 00 00 00 1A 00 00 00 00 00 00 00 F0 00 00 00 4A 00 00 00 00 00 00 00 3C 01 00 00 4E 00 00 00 00 00 00 00 8C 01 00 00 00 00 00 00 00 00 00 00 8C 01 00 00 00 00 00 00 00 00 00 00 8C 01 00 00 00 00 00 00 00 00 00 0

[HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users\000001F5]

F = 02 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 92 DD 90 21 C5 CD C6 01 FF FF FF FF FF FF FF 7F 00 00 00 00 00 00 00 00 F4 01 00 00 01 02 00 00 10 02 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 0D 00 0A 00 00 00
V = 00 00 00 00 B0 00 00 00 02 00 01 00 B0 00 00 00 0A 00 00 00 00 00 00 00 BC 00 00 00 00 00 00 00 00 00 00 00 BC 00 00 00 70 00 00 00 00 00 00 00 2C 01 00 00 00 00 00 00 00 00 00 00 2C 01 00 00 00 00 00 00 00 00 00 00 2C 01 00 00 00 00 00 00 00 00 00 0

[HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users\000001F4]

F = 02 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 92 DD 90 21 C5 CD C6 01 FF FF FF FF FF FF FF 7F 00 00 00 00 00 00 00 00 F4 01 00 00 01 02 00 00 10 02 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 0D 00 0A 00 00 00
V = 00 00 00 00 BC 00 00 00 02 00 01 00 BC 00 00 00 1A 00 00 00 00 00 00 00 D8 00 00 00 00 00 00 00 00 00 00 00 D8 00 00 00 6C 00 00 00 00 00 00 00 44 01 00 00 00 00 00 00 00 00 00 00 44 01 00 00 00 00 00 00 00 00 00 00 44 01 00 00 00 00 00 00 00 00 00 0

[HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users]

(Default) = (zero-length binary value)

[HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Groups]

(Default) = ""

[HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Aliases]

(Default) = ""

[HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Builtin\Aliases\Members\S-1-5\0000000B]

(Default) = "?"

[HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Builtin\Aliases\Members\S-1-5\00000004]

(Default) = "?"

[HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Builtin\Aliases\Members\S-1-5-21-606747145-764733703-839522115\000003EB]

(Default) = "?"

[HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Builtin\Aliases\Members\S-1-5-21-606747145-764733703-839522115\000001F5]

(Default) = "?"

[HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Builtin\Aliases\Members\S-1-5-21-606747145-764733703-839522115\000001F4]

(Default) = "?"

[HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Builtin\Aliases\Members\S-1-5-21-606747145-764733703-839522115]

(Default) = (zero-length binary value)

[HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Builtin\Aliases\Members\S-1-5]

(Default) = ""

[HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Builtin\Aliases\Names\Users]

(Default) = (zero-length binary value)

[HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Builtin\Aliases\Names\Replicator]

(Default) = (zero-length binary value)

[HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Builtin\Aliases\Names\Remote Desktop Users]

(Default) = (zero-length binary value)

[HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Builtin\Aliases\Names\Power Users]

(Default) = (zero-length binary value)

[HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Builtin\Aliases\Names\Network Configuration Operators]

(Default) = (zero-length binary value)

[HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Builtin\Aliases\Names\Guests]

(Default) = (zero-length binary value)

[HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Builtin\Aliases\Names\Backup Operators]

(Default) = (zero-length binary value)

[HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Builtin\Aliases\Names\Administrators]

(Default) = (zero-length binary value)

[HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Builtin\Aliases\Names]

(Default) = (zero-length binary value)

[HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Builtin\Aliases\Members]

(Default) = ""

[HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Builtin\Aliases\0000022C]

C = 2C 02 00 00 00 00 00 00 B0 00 00 00 02 00 01 00 B0 00 00 00 3E 00 00 00 00 00 00 00 F0 00 00 00 D8 00 00 00 00 00 00 00 C8 01 00 00 00 00 00 00 00 00 00 00 01 00 14 80 90 00 00 00 A0 00 00 00 14 00 00 00 44 00 00 00 02 00 30 00 02 00 00 00 02 C0 14 0

[HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Builtin\Aliases\0000022B]

C = 2B 02 00 00 00 00 00 00 B0 00 00 00 02 00 01 00 B0 00 00 00 28 00 00 00 00 00 00 00 D8 00 00 00 7A 00 00 00 00 00 00 00 54 01 00 00 00 00 00 00 00 00 00 00 01 00 14 80 90 00 00 00 A0 00 00 00 14 00 00 00 44 00 00 00 02 00 30 00 02 00 00 00 02 C0 14 0

[HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Builtin\Aliases\00000228]

C = 28 02 00 00 00 00 00 00 B0 00 00 00 02 00 01 00 B0 00 00 00 14 00 00 00 00 00 00 00 C4 00 00 00 4A 00 00 00 00 00 00 00 10 01 00 00 00 00 00 00 00 00 00 00 01 00 14 80 90 00 00 00 A0 00 00 00 14 00 00 00 44 00 00 00 02 00 30 00 02 00 00 00 02 C0 14 0

[HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Builtin\Aliases\00000227]

C = 27 02 00 00 00 00 00 00 98 00 00 00 02 00 01 00 98 00 00 00 20 00 00 00 00 00 00 00 B8 00 00 00 D2 00 00 00 00 00 00 00 8C 01 00 00 00 00 00 00 00 00 00 00 01 00 14 80 78 00 00 00 88 00 00 00 14 00 00 00 44 00 00 00 02 00 30 00 02 00 00 00 02 C0 14 0

[HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Builtin\Aliases\00000223]

C = 23 02 00 00 00 00 00 00 C8 00 00 00 02 00 01 00 C8 00 00 00 16 00 00 00 00 00 00 00 E0 00 00 00 36 01 00 00 00 00 00 00 18 02 00 00 00 00 00 00 00 00 00 00 01 00 14 80 A8 00 00 00 B8 00 00 00 14 00 00 00 44 00 00 00 02 00 30 00 02 00 00 00 02 C0 14 0

[HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Builtin\Aliases\00000222]

C = 22 02 00 00 00 00 00 00 C8 00 00 00 02 00 01 00 C8 00 00 00 0C 00 00 00 00 00 00 00 D4 00 00 00 FC 00 00 00 00 00 00 00 D0 01 00 00 1C 00 00 00 01 00 00 00 01 00 14 80 A8 00 00 00 B8 00 00 00 14 00 00 00 44 00 00 00 02 00 30 00 02 00 00 00 02 C0 14 0

[HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Builtin\Aliases\00000221]

C = 21 02 00 00 00 00 00 00 C8 00 00 00 02 00 01 00 C8 00 00 00 0A 00 00 00 00 00 00 00 D4 00 00 00 38 01 00 00 00 00 00 00 0C 02 00 00 18 00 00 00 02 00 00 00 01 00 14 80 A8 00 00 00 B8 00 00 00 14 00 00 00 44 00 00 00 02 00 30 00 02 00 00 00 02 C0 14 0

[HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Builtin\Aliases\00000220]

C = 20 02 00 00 00 00 00 00 98 00 00 00 02 00 01 00 98 00 00 00 1C 00 00 00 00 00 00 00 B4 00 00 00 96 00 00 00 00 00 00 00 4C 01 00 00 38 00 00 00 02 00 00 00 01 00 14 80 78 00 00 00 88 00 00 00 14 00 00 00 44 00 00 00 02 00 30 00 02 00 00 00 02 C0 14 0

[HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Builtin\Groups\Names]

(Default) = (zero-length binary value)

[HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Builtin\Users\Names]

(Default) = (zero-length binary value)

[HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Builtin\Users]

(Default) = (zero-length binary value)

[HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Builtin\Groups]

(Default) = (zero-length binary value)

[HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Builtin\Aliases]

(Default) = (zero-length binary value)

[HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Builtin]

F = 02 00 01 00 00 00 00 00 98 FA 53 5A C4 CD C6 01 07 00 00 00 00 00 00 00 00 00 00 00 40 DE FF FF 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 CC 1D CF FB FF FF FF 00 CC 1D CF FB FF FF FF 00 00 00 00 00 00 00 00 E8 03 00 00 00 00 00 00 00 00 00 0
V = 00 00 00 00 98 00 00 00 02 00 01 00 98 00 00 00 0C 00 00 00 00 00 00 00 A4 00 00 00 00 00 00 00 00 00 00 00 A4 00 00 00 00 00 00 00 00 00 00 00 01 00 14 80 78 00 00 00 88 00 00 00 14 00 00 00 44 00 00 00 02 00 30 00 02 00 00 00 02 C0 14 00 7A 04 05 0

[HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account]

F = 02 00 01 00 00 00 00 00 4C BF 58 5A C4 CD C6 01 13 00 00 00 00 00 00 00 00 00 00 00 40 DE FF FF 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 CC 1D CF FB FF FF FF 00 CC 1D CF FB FF FF FF 00 00 00 00 00 00 00 00 EC 03 00 00 00 00 00 00 00 00 00 0
V = 00 00 00 00 E0 00 00 00 02 00 01 00 E0 00 00 00 18 00 00 00 00 00 00 00 F8 00 00 00 00 00 00 00 00 00 00 00 F8 00 00 00 00 00 00 00 00 00 00 00 01 00 14 80 C0 00 00 00 D0 00 00 00 14 00 00 00 44 00 00 00 02 00 30 00 02 00 00 00 02 C0 14 00 7A 04 05 0

[HKEY_LOCAL_MACHINE\SAM\SAM\RXACT]

(Default) = 01 00 00 00 6D 05 91 7C 50 57 49 74

[HKEY_LOCAL_MACHINE\SAM\SAM\Domains]

(Default) = (zero-length binary value)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\TelnetServer]

TempFile = "%Temp%\5.tmp"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]

SFCScan = 0x00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_TLNTSVR\0000\Control]

*NewlyCreated* = 0x00000000
ActiveService = "TlntSvr"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_TLNTSVR\0000]

Service = "TlntSvr"
Legacy = 0x00000001
ConfigFlags = 0x00000000
Class = "LegacyDriver"
ClassGUID = "{8ECC055D-047F-11D1-A537-0000F8753ED1}"
DeviceDesc = "Telnet"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_TLNTSVR]

NextInstance = 0x00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_TLNTSVR\0000\Control]

*NewlyCreated* = 0x00000000
ActiveService = "TlntSvr"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_TLNTSVR\0000]

Service = "TlntSvr"
Legacy = 0x00000001
ConfigFlags = 0x00000000
Class = "LegacyDriver"
ClassGUID = "{8ECC055D-047F-11D1-A537-0000F8753ED1}"
DeviceDesc = "Telnet"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_TLNTSVR]

NextInstance = 0x00000001

The following Registry Values were modified:

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ServiceCurrent]

(Default) =

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ServiceCurrent]

(Default) =

Other details

Analysis of the file resources indicate the following possible country of origin:

China

The following ports were open in the system:

Port	Protocol	Process
3183	TCP	expolrer.exe (%System%\expolrer.exe)
3184	TCP	expolrer.exe (%System%\expolrer.exe)
3185	TCP	expolrer.exe (%System%\expolrer.exe)
3186	TCP	expolrer.exe (%System%\expolrer.exe)
3187	TCP	expolrer.exe (%System%\expolrer.exe)
3188	TCP	expolrer.exe (%System%\expolrer.exe)
3189	TCP	expolrer.exe (%System%\expolrer.exe)
3190	TCP	expolrer.exe (%System%\expolrer.exe)
3191	TCP	expolrer.exe (%System%\expolrer.exe)
3192	TCP	expolrer.exe (%System%\expolrer.exe)
3193	TCP	expolrer.exe (%System%\expolrer.exe)
3194	TCP	expolrer.exe (%System%\expolrer.exe)
3195	TCP	expolrer.exe (%System%\expolrer.exe)
3196	TCP	expolrer.exe (%System%\expolrer.exe)
3197	TCP	expolrer.exe (%System%\expolrer.exe)
3198	TCP	expolrer.exe (%System%\expolrer.exe)
3199	TCP	expolrer.exe (%System%\expolrer.exe)
3200	TCP	expolrer.exe (%System%\expolrer.exe)
3201	TCP	expolrer.exe (%System%\expolrer.exe)
3202	TCP	expolrer.exe (%System%\expolrer.exe)
3203	TCP	expolrer.exe (%System%\expolrer.exe)
3204	TCP	expolrer.exe (%System%\expolrer.exe)
3205	TCP	expolrer.exe (%System%\expolrer.exe)
3206	TCP	expolrer.exe (%System%\expolrer.exe)
3207	TCP	expolrer.exe (%System%\expolrer.exe)
3208	TCP	expolrer.exe (%System%\expolrer.exe)
3209	TCP	expolrer.exe (%System%\expolrer.exe)
3210	TCP	expolrer.exe (%System%\expolrer.exe)
3211	TCP	expolrer.exe (%System%\expolrer.exe)
3212	TCP	expolrer.exe (%System%\expolrer.exe)
3213	TCP	expolrer.exe (%System%\expolrer.exe)
3214	TCP	expolrer.exe (%System%\expolrer.exe)
3215	TCP	expolrer.exe (%System%\expolrer.exe)
3216	TCP	expolrer.exe (%System%\expolrer.exe)
3217	TCP	expolrer.exe (%System%\expolrer.exe)
3218	TCP	expolrer.exe (%System%\expolrer.exe)
3219	TCP	expolrer.exe (%System%\expolrer.exe)
3220	TCP	expolrer.exe (%System%\expolrer.exe)
3221	TCP	expolrer.exe (%System%\expolrer.exe)
3222	TCP	expolrer.exe (%System%\expolrer.exe)
3223	TCP	expolrer.exe (%System%\expolrer.exe)
3224	TCP	expolrer.exe (%System%\expolrer.exe)
3225	TCP	expolrer.exe (%System%\expolrer.exe)
3226	TCP	expolrer.exe (%System%\expolrer.exe)
3227	TCP	expolrer.exe (%System%\expolrer.exe)
3228	TCP	expolrer.exe (%System%\expolrer.exe)
3229	TCP	expolrer.exe (%System%\expolrer.exe)
3230	TCP	expolrer.exe (%System%\expolrer.exe)
3231	TCP	expolrer.exe (%System%\expolrer.exe)
3232	TCP	expolrer.exe (%System%\expolrer.exe)
3233	TCP	expolrer.exe (%System%\expolrer.exe)
3234	TCP	expolrer.exe (%System%\expolrer.exe)
3235	TCP	expolrer.exe (%System%\expolrer.exe)
3236	TCP	expolrer.exe (%System%\expolrer.exe)
3237	TCP	expolrer.exe (%System%\expolrer.exe)
3238	TCP	expolrer.exe (%System%\expolrer.exe)
3239	TCP	expolrer.exe (%System%\expolrer.exe)
3240	TCP	expolrer.exe (%System%\expolrer.exe)
3241	TCP	expolrer.exe (%System%\expolrer.exe)
3242	TCP	expolrer.exe (%System%\expolrer.exe)
3243	TCP	expolrer.exe (%System%\expolrer.exe)
3244	TCP	expolrer.exe (%System%\expolrer.exe)
3245	TCP	expolrer.exe (%System%\expolrer.exe)
3246	TCP	expolrer.exe (%System%\expolrer.exe)
3247	TCP	expolrer.exe (%System%\expolrer.exe)
3248	TCP	expolrer.exe (%System%\expolrer.exe)
3249	TCP	expolrer.exe (%System%\expolrer.exe)
3250	TCP	expolrer.exe (%System%\expolrer.exe)
3251	TCP	expolrer.exe (%System%\expolrer.exe)
3252	TCP	expolrer.exe (%System%\expolrer.exe)
3253	TCP	expolrer.exe (%System%\expolrer.exe)
3254	TCP	expolrer.exe (%System%\expolrer.exe)
3255	TCP	expolrer.exe (%System%\expolrer.exe)
3256	TCP	expolrer.exe (%System%\expolrer.exe)
3257	TCP	expolrer.exe (%System%\expolrer.exe)
3258	TCP	expolrer.exe (%System%\expolrer.exe)
3259	TCP	expolrer.exe (%System%\expolrer.exe)
3260	TCP	expolrer.exe (%System%\expolrer.exe)
3261	TCP	expolrer.exe (%System%\expolrer.exe)
3262	TCP	expolrer.exe (%System%\expolrer.exe)
3263	TCP	expolrer.exe (%System%\expolrer.exe)
3264	TCP	expolrer.exe (%System%\expolrer.exe)
3265	TCP	expolrer.exe (%System%\expolrer.exe)
3266	TCP	expolrer.exe (%System%\expolrer.exe)
3267	TCP	expolrer.exe (%System%\expolrer.exe)
3268	TCP	expolrer.exe (%System%\expolrer.exe)
3269	TCP	expolrer.exe (%System%\expolrer.exe)
3270	TCP	expolrer.exe (%System%\expolrer.exe)
3271	TCP	expolrer.exe (%System%\expolrer.exe)
3272	TCP	expolrer.exe (%System%\expolrer.exe)
3273	TCP	expolrer.exe (%System%\expolrer.exe)
3274	TCP	expolrer.exe (%System%\expolrer.exe)
3275	TCP	expolrer.exe (%System%\expolrer.exe)
3276	TCP	expolrer.exe (%System%\expolrer.exe)
3277	TCP	expolrer.exe (%System%\expolrer.exe)
3278	TCP	expolrer.exe (%System%\expolrer.exe)
3279	TCP	expolrer.exe (%System%\expolrer.exe)
3280	TCP	expolrer.exe (%System%\expolrer.exe)
3281	TCP	expolrer.exe (%System%\expolrer.exe)
3282	TCP	expolrer.exe (%System%\expolrer.exe)

The following Host Names were requested from a host database:

61.232.0.0
61.235.255.255
61.236.0.0
61.237.255.255
110.96.0.0
110.127.255.255
110.192.0.0
110.223.255.255
122.64.0.0
122.95.255.255
123.64.0.0
123.95.255.255
203.90.160.0
203.90.191.255
211.98.0.0
211.99.255.255
221.172.0.0
221.175.255.255
222.32.0.0
222.63.255.255
58.14.0.0
58.15.255.255
58.30.0.0
58.31.255.255
58.66.0.0
58.67.255.255
58.68.128.0
58.68.255.255
58.82.0.0
58.83.255.255
58.87.64.0
58.87.127.255
58.99.128.0
58.99.255.255
58.116.0.0
58.119.255.255
58.128.0.0
58.135.255.255
58.154.0.0
58.155.255.255
58.192.0.0
58.207.255.255
59.64.0.0
59.79.255.255
59.80.0.0
59.83.255.255
59.107.0.0
59.107.255.255
59.108.0.0
59.111.255.255
59.151.0.0
59.151.127.255
59.155.0.0
59.155.255.255
59.191.0.0
59.191.127.255
59.191.240.0
59.191.255.255
59.192.0.0
59.255.255.255
60.55.0.0
60.55.255.255
60.200.0.0
60.203.255.255
60.205.0.0
60.205.255.255
60.232.0.0
60.233.255.255
60.245.128.0
60.245.255.255
60.247.0.0
60.247.255.255
60.252.0.0
60.252.255.255
60.253.128.0
60.253.255.255
61.4.80.0
61.4.83.255
61.4.176.0
61.4.191.255
61.8.160.0
61.8.175.255
61.28.0.0
61.28.127.255
61.29.128.0
61.29.255.255
61.45.128.0
61.45.191.255
61.47.128.0
61.47.191.255
61.87.192.0
61.87.255.255
61.240.0.0
61.243.255.255
110.40.0.0
110.43.255.255
110.48.0.0
110.48.255.255
110.51.0.0
110.51.255.255

There were registered attempts to establish connection with the remote hosts. The connection details are:

Remote Host	Port Number
127.0.0.0	445
127.0.0.2	445
127.0.0.3	445
127.0.0.4	445
127.0.0.5	445
127.0.0.6	445
127.0.0.7	445
127.0.0.8	445
127.0.0.9	445
127.0.0.10	445

All content ("Information") contained in this report is the copyrighted work of Threat Expert Ltd and its associated companies ("ThreatExpert") and may not be copied without the express permission of ThreatExpert.

The Information is provided on an "as is" basis. ThreatExpert disclaims all warranties, whether express or implied, to the maximum extent permitted by law, including the implied warranties that the Information is merchantable, of satisfactory quality, accurate, fit for a particular purpose or need, or non-infringing, unless such implied warranties are legally incapable of exclusion. Further, ThreatExpert does not warrant or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise.