Submission Summary:

• Submission details:
• Submission received: 18 November 2009, 23:39:47
• Processing time: 7 min 13 sec
• Submitted sample:
• File MD5: 0xBF7B94900AD8DC95E33176DF43533092
• File SHA-1: 0x443C41BCCBEFF7A0C45D03A001DE29AED76DF362
• Filesize: 133,120 bytes
• Alias:
• Trojan-Downloader.Win32.FraudLoad.wvup [Kaspersky Lab]
• Trojan:Win32/FakeXPA [Microsoft]

• Summary of the findings:

What's been found	Severity Level
Contains characteristics of a rogue antispyware application that uses aggressive and deceptive advertising along with false reports of exaggerated system security threats to persuade users to download and purchase their product.
Attempts to use BITS (Background Intelligent Transfer Service). Some threats are known to use BITS to evade firewall filtering and download files without firewall inspection.
Downloads/requests other files from Internet.
Contains characteristics of an identified security risk.

Technical Details:

• The new window was created, as shown below:

Possible Security Risk

• Attention! The following threat category was identified:

Threat Category	Description
	A program that downloads files to the local computer that may represent security risk

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%CommonAppData%\Microsoft\Network\Downloader\qmgr0.dat	4,232 bytes	MD5: 0x2F7F274D50DC57E191107A4A3CE0EF25 SHA-1: 0x928C3C84D37A279789FA5D450118ADE37FBC1D1E	(not available)
2	%CommonAppData%\Microsoft\Network\Downloader\qmgr1.dat	5,126 bytes	MD5: 0xE69AAEC5D7D1FBACDFE868F4E0823031 SHA-1: 0x583DE9F16392943BD9E6A0B9966A361FBB21452F	(not available)
3	%ProgramFiles%\CSec\cs.exe.tmp4	0 bytes	MD5: 0xD41D8CD98F00B204E9800998ECF8427E SHA-1: 0xDA39A3EE5E6B4B0D3255BFEF95601890AFD80709	(not available)
4	[file and pathname of the sample #1]	133,120 bytes	MD5: 0xBF7B94900AD8DC95E33176DF43533092 SHA-1: 0x443C41BCCBEFF7A0C45D03A001DE29AED76DF362	Trojan-Downloader.Win32.FraudLoad.wvup [Kaspersky Lab] Trojan:Win32/FakeXPA [Microsoft]

• Notes:
• %CommonAppData% is a variable that refers to the file system directory containing application data for all users. A typical path is C:\Documents and Settings\All Users\Application Data.
• %ProgramFiles% is a variable that refers to the Program Files folder. A typical path is C:\Program Files.

• The following directories were created:
• %CommonAppData%\Microsoft\Network\Downloader
• %ProgramFiles%\CSec

Memory Modifications

• There was a new process created in the system:

• The following system service was modified:

• Notes:
• %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

Registry Modifications

• The following Registry Key was created:
• HKEY_LOCAL_MACHINE\SOFTWARE\036572811B10AEE34F7A01871D13AA85

• The newly created Registry Value is:
• [HKEY_LOCAL_MACHINE\SOFTWARE\036572811B10AEE34F7A01871D13AA85]
• gwbrammuhmt = "DuvKFOVtS!!"
• jxawt = "EnfrE!!"
• dfdwt = ":]>m>=FlEBrlGeBkx!!"
• owzxxrza = "DuFeR!!"
• usia = "FjwoWJO@X

Other details

• The following port was open in the system:

Heuristics Analysis

• Heuristically identified capability to use BITS (Background Intelligent Transfer Service) to schedule the following download task:
• http://windows-update3.com/download/timesroman.tif