Submission Summary:

• Submission details:
• Submission received: 22 October 2012, 16:45:28
• Processing time: 10 min 21 sec
• Submitted sample:
• File MD5: 0xD6568DA03B88649E46776B58B5E03A2F
• File SHA-1: 0x0CC7A68BACD8F95F0CF44CD0EEACD858D0EF33DA
• Filesize: 16,930 bytes
• Alias:
• Trojan Horse [Symantec]
• Worm.Win32.AutoRun.akfu [Kaspersky Lab]
• W32/Hamweq.worm.f [McAfee]
• W32/Autoham-Fam [Sophos]
• Worm:Win32/Hamweq.A [Microsoft]
• Worm.Win32.AutoRun [Ikarus]
• Win32/Autorun.worm.12800.P [AhnLab]

• Summary of the findings:

What's been found	Severity Level
Creates a startup registry entry.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

• Attention! The following threat categories were identified:

Threat Category	Description
	A network-aware worm that attempts to replicate across the existing network(s)
	A malicious trojan horse or bot that may represent security risk for the compromised system and/or its network environment

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	c:\RESTORE\k-1-3542-4232123213-7676767-8888886\Desktop.ini	62 bytes	MD5: 0x7457A5DF1FF47C957ACF1FA000D7D9AD SHA-1: 0x69D2BBA827FD4DE0169419A0FDA280252B348514	(not available)
2	c:\RESTORE\k-1-3542-4232123213-7676767-8888886\Devrgm.exe [file and pathname of the sample #1]	16,930 bytes	MD5: 0xD6568DA03B88649E46776B58B5E03A2F SHA-1: 0x0CC7A68BACD8F95F0CF44CD0EEACD858D0EF33DA	Trojan Horse [Symantec] Worm.Win32.AutoRun.akfu [Kaspersky Lab] W32/Hamweq.worm.f [McAfee] W32/Autoham-Fam [Sophos] Worm:Win32/Hamweq.A [Microsoft] Worm.Win32.AutoRun [Ikarus] Win32/Autorun.worm.12800.P [AhnLab]

• The following directories were created:
• c:\RESTORE
• c:\RESTORE\k-1-3542-4232123213-7676767-8888886

Memory Modifications

• There were new processes created in the system:

Process Name	Process Filename	Main Module Size
devrgm.exe	c:\restore\k-1-3542-4232123213-7676767-8888886\devrgm.exe	28,672 bytes
[filename of the sample #1]	[file and pathname of the sample #1]	28,672 bytes

Registry Modifications

• The following Registry Key was created:
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{67KLN5J0-4OPM-00WE-AAX5-77EF1D187563}

• The newly created Registry Value is:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{67KLN5J0-4OPM-00WE-AAX5-77EF1D187563}]
• StubPath = "c:\RESTORE\k-1-3542-4232123213-7676767-8888886\Devrgm.exe"

so that Devrgm.exe runs every time Windows starts

Other details

• The following Host Names were requested from a host database:
• www.topgameland.com
• www.genesisstore.sk