Submission Summary:

• Submission details:
• Submission received: 13 August 2012, 15:38:05
• Processing time: 7 min 43 sec
• Submitted sample:
• File MD5: 0xD4B3A09349963B520E6DEB9B9F9E50CE
• File SHA-1: 0xCEA0EA74BAD8F8A137DF8D309D5A30221B374C79
• Filesize: 418,816 bytes
• Alias:
• Medfos.j [McAfee]
• Trojan:Win32/Medfos.B [Microsoft]

• Summary of the findings:

What's been found	Severity Level
Creates a startup registry entry.

Technical Details:

File System Modifications

• The following file was created in the system:

Memory Modifications

• There was a new process created in the system:

• Note:
• [generic host process filename] is a full path filename of [generic host process].

• The following modules were loaded into the address space of other process(es):

Module Name	Module Filename	Address Space Details
[filename of the sample #1]	[file and pathname of the sample #1]	Process name: [generic host process] Process filename: [generic host process filename] Address space: 0xB50000 - 0xBBA000
[filename of the sample #1]	[file and pathname of the sample #1]	Process name: [generic host process] Process filename: [generic host process filename] Address space: 0xB10000 - 0xB7A000
[filename of the sample #1]	[file and pathname of the sample #1]	Process name: IEXPLORE.EXE Process filename: %ProgramFiles%\internet explorer\iexplore.exe Address space: 0x1C90000 - 0x1CFA000

• Notes:
• %ProgramFiles% is a variable that refers to the Program Files folder. A typical path is C:\Program Files.

Registry Modifications

• The newly created Registry Value is:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
• [filename of the sample #1 without extension] = ""%System%\rundll32.exe" "[file and pathname of the sample #1]",LoadVolumeFromResourceW"

so that [file and pathname of the sample #1] runs every time Windows starts

Other details

• To mark the presence in the system, the following Mutex object was created:
• {22222222-2222-2222-2222-222222222222}

• There was application-defined hook procedure installed into the hook chain (e.g. to monitor keystrokes). The installed hook is handled by the following module:
• [file and pathname of the sample #1]
• the hook is handled by its export "MatrixMultiplyTranspose()"