Submission Summary:

• Submission details:
• Submission received: 17 August 2012, 18:49:27
• Processing time: 7 min 27 sec
• Submitted sample:
• File MD5: 0xC492E98CFE7F1A5B3F9792DAB0DD7DE7
• File SHA-1: 0x9648E103EF95FC9FD5D2D4B70D074FC7CDC68D60
• Filesize: 72,704 bytes
• Alias:
• Trojan-Dropper.Win32.Dorifel.emo [Kaspersky Lab]
• FakeAlert-KS.gen.ah [McAfee]
• Mal/EncpkLEE-B [Sophos]
• Trojan:Win32/Claretore [Microsoft]
• Trojan.Crypt [Ikarus]

• Summary of the findings:

What's been found	Severity Level
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! The following threat category was identified:

Threat Category	Description
	A malicious trojan horse or bot that may represent security risk for the compromised system and/or its network environment

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%Temp%\35ba0e50-0.tmp %Temp%\dd1cc920-0.tmp	72,704 bytes	MD5: 0x03D23F31AF1A91D3B8D75248B91F128C SHA-1: 0x93BA9CEB9AAA5E9BB0436B41648F800CBD76196C	Trojan-Dropper.Win32.Dorifel.enr [Kaspersky Lab] Generic.dx!b2vc [McAfee] Mal/Encpk-ADD [Sophos] Trojan:Win32/Claretore [Microsoft] Win32.SuspectCrc [Ikarus]
2	%Temp%\466C90C197.tmp %Temp%\83E57A2FF5.tmp	72,704 bytes	MD5: 0xC492E98CFE7F1A5B3F9792DAB0DD7DE7 SHA-1: 0x9648E103EF95FC9FD5D2D4B70D074FC7CDC68D60	Trojan-Dropper.Win32.Dorifel.emo [Kaspersky Lab] FakeAlert-KS.gen.ah [McAfee] Mal/EncpkLEE-B [Sophos] Trojan:Win32/Claretore [Microsoft] Trojan.Crypt [Ikarus]

• Note:
• %Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).

Memory Modifications

• There were new processes created in the system:

• Notes:
• [generic host process filename] is a full path filename of [generic host process].
• %UserProfile% is a variable that specifies the current user's profile folder. By default, this is C:\Documents and Settings\[UserName] (Windows NT/2000/XP).

• There was a new memory page created in the address space of the system process(es):

Process Name	Process Filename	Allocated Size
svchost.exe	%System%\svchost.exe	8,192 bytes

• Notes:
• %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

Registry Modifications

• The following Registry Keys were created:
• HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_MODEM
• HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_MODEM\0000
• HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_MODEM\0000\Control
• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MODEM
• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MODEM\0000
• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MODEM\0000\Control

• The newly created Registry Values are:
• [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_MODEM\0000\Control]
• *NewlyCreated* = 0x00000000
• [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_MODEM\0000]
• Service = "modem"
• Legacy = 0x00000001
• ConfigFlags = 0x00000000
• Class = "LegacyDriver"
• ClassGUID = "{8ECC055D-047F-11D1-A537-0000F8753ED1}"
• DeviceDesc = "modem"
• [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_MODEM]
• NextInstance = 0x00000001
• [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MODEM\0000\Control]
• *NewlyCreated* = 0x00000000
• [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MODEM\0000]
• Service = "modem"
• Legacy = 0x00000001
• ConfigFlags = 0x00000000
• Class = "LegacyDriver"
• ClassGUID = "{8ECC055D-047F-11D1-A537-0000F8753ED1}"
• DeviceDesc = "modem"
• [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MODEM]
• NextInstance = 0x00000001

Other details

• To mark the presence in the system, the following Mutex objects were created:
• DDrawWindowListMutex
• DDrawDriverObjectListMutex
• __DDrawExclMode__