ThreatExpert Report: Mal/VIP-A

Visit ThreatExpert web site

Close Report

Submission Summary:

Submission details:

Submission received: 29 August 2012, 21:13:00
Processing time: 8 min 10 sec
Submitted sample:

File MD5: 0xE673E86E250BB84E788D5DBC5610FA47
File SHA-1: 0x7C44ECFD8C5481F1A6DF2B4AAAB84DFF99A871B1
Filesize: 129,536 bytes
Alias: Mal/VIP-A [Sophos]

Technical Details:

File System Modifications

The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%Temp%\00.bat	209 bytes	MD5: 0x1E2ADAC61C6EF8F7C700AEB112C85470 SHA-1: 0x0CB5C946231C2B5FF2B7BEDD1044394C5C9B870C	(not available)
2	%Temp%\11.bat	209 bytes	MD5: 0xB7FE83D15ACE7AFA662E6603A098DBB7 SHA-1: 0xDF098E867ADB25A976B94EF1EB81044DE81A5BAD	(not available)
3	[file and pathname of the sample #1] %System%\win342046c.dll	129,536 bytes	MD5: 0xE673E86E250BB84E788D5DBC5610FA47 SHA-1: 0x7C44ECFD8C5481F1A6DF2B4AAAB84DFF99A871B1	Mal/VIP-A [Sophos]

Notes:

%Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).
%System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

Memory Modifications

There was a new process created in the system:

Process Name	Process Filename	Main Module Size
[generic host process]	[generic host process filename]	20,480 bytes

Notes:

[generic host process filename] is a full path filename of [generic host process].

The following modules were loaded into the address space of other process(es):

Module Name	Module Filename	Address Space Details
[filename of the sample #1]	[file and pathname of the sample #1]	Process name: [generic host process] Process filename: [generic host process filename] Address space: 0xB50000 - 0xB79000
[filename of the sample #1]	[file and pathname of the sample #1]	Process name: [generic host process] Process filename: [generic host process filename] Address space: 0xB10000 - 0xB39000
win342046c.dll	%System%\win342046c.dll	Process name: svchost.exe Process filename: %System%\svchost.exe Address space: 0xA90000 - 0xAB9000

There was a new service created in the system:

Service Name	Display Name	Status	Service Filename
Serverqe	Provides system and desktop level support to the NVIDIA displays driversqe	"Running"	%System%\svchost.exe -k "Serverqe"

Registry Modifications

The following Registry Keys were created:

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\MediaResources\msvideo
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SERVERQE
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SERVERQE\0000
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SERVERQE\0000\Control
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Serverqe
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Serverqe\Parameters
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Serverqe\Security
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Serverqe\Enum
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\MediaResources\msvideo
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SERVERQE
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SERVERQE\0000
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SERVERQE\0000\Control
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Serverqe
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Serverqe\Parameters
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Serverqe\Security
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Serverqe\Enum

The newly created Registry Values are:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

UserFaultCheck = "%System%\dumprep 0 -u"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup]

ID = "726F71"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost]

Serverqe = 53 65 72 76 65 72 71 65 00

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SERVERQE\0000\Control]

*NewlyCreated* = 0x00000000
ActiveService = "Serverqe"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SERVERQE\0000]

Service = "Serverqe"
Legacy = 0x00000001
ConfigFlags = 0x00000000
Class = "LegacyDriver"
ClassGUID = "{8ECC055D-047F-11D1-A537-0000F8753ED1}"
DeviceDesc = "Provides system and desktop level support to the NVIDIA displays driversqe"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SERVERQE]

NextInstance = 0x00000001

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Serverqe\Enum]

0 = "Root\LEGACY_SERVERQE\0000"
Count = 0x00000001
NextInstance = 0x00000001

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Serverqe\Security]

Security = 01 00 14 80 90 00 00 00 9C 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 60 00 04 00 00 00 00 00 14 00 FD 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 18 00 FF 01 0F 0

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Serverqe\Parameters]

ServiceDll = 43 3A 5C 57 49 4E 44 4F 57 53 5C 73 79 73 74 65 6D 33 32 5C 77 69 6E 33 34 32 30 34 36 63 2E 64 6C 6C 00 00 51 05 91 7C B8 0C 09 00 6D 05 91 7C E4 2B DD 77 0E FD 07 00 A4 16 DD 77 2A 00 00 00 9C FC 07 00 D3 9B 91 7C 0E FD 07 00 A3 02 00 00 00 00 DD 7

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Serverqe]

Type = 0x00000110
Start = 0x00000002
ErrorControl = 0x00000001
ImagePath = "%System%\svchost.exe -k "Serverqe""
DisplayName = "Provides system and desktop level support to the NVIDIA displays driversqe"
ObjectName = "LocalSystem"
Description = "NVIDIA Display Driver Services qe"
FailureActions = 80 51 01 00 00 00 00 00 00 00 00 00 03 00 00 00 53 00 65 00 01 00 00 00 60 EA 00 00 01 00 00 00 60 EA 00 00 00 00 00 00 60 EA 00 00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SERVERQE\0000\Control]

*NewlyCreated* = 0x00000000
ActiveService = "Serverqe"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SERVERQE\0000]

Service = "Serverqe"
Legacy = 0x00000001
ConfigFlags = 0x00000000
Class = "LegacyDriver"
ClassGUID = "{8ECC055D-047F-11D1-A537-0000F8753ED1}"
DeviceDesc = "Provides system and desktop level support to the NVIDIA displays driversqe"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SERVERQE]

NextInstance = 0x00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Serverqe\Enum]

0 = "Root\LEGACY_SERVERQE\0000"
Count = 0x00000001
NextInstance = 0x00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Serverqe\Security]

Security = 01 00 14 80 90 00 00 00 9C 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 60 00 04 00 00 00 00 00 14 00 FD 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 18 00 FF 01 0F 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Serverqe\Parameters]

ServiceDll = 43 3A 5C 57 49 4E 44 4F 57 53 5C 73 79 73 74 65 6D 33 32 5C 77 69 6E 33 34 32 30 34 36 63 2E 64 6C 6C 00 00 51 05 91 7C B8 0C 09 00 6D 05 91 7C E4 2B DD 77 0E FD 07 00 A4 16 DD 77 2A 00 00 00 9C FC 07 00 D3 9B 91 7C 0E FD 07 00 A3 02 00 00 00 00 DD 7

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Serverqe]

Type = 0x00000110
Start = 0x00000002
ErrorControl = 0x00000001
ImagePath = "%System%\svchost.exe -k "Serverqe""
DisplayName = "Provides system and desktop level support to the NVIDIA displays driversqe"
ObjectName = "LocalSystem"
Description = "NVIDIA Display Driver Services qe"
FailureActions = 80 51 01 00 00 00 00 00 00 00 00 00 03 00 00 00 53 00 65 00 01 00 00 00 60 EA 00 00 01 00 00 00 60 EA 00 00 00 00 00 00 60 EA 00 00

The following Registry Values were modified:

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ServiceCurrent]

(Default) =

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ServiceCurrent]

(Default) =

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]

Cookies =
History =

Other details

The data identified by the following URL was then requested from the remote web server:

http://14.206.4.59/ip/yiki1.txt

Outbound traffic (potentially malicious)

There was an outbound traffic produced on port 0:

00000000 | A103 0000 3132 372E 302E 302E 3100 0000 | ....127.0.0.1...
00000010 | 0000 0000 0000 007A 7A7A 0000 0000 0000 | .......zzz......
00000020 | 0000 0000 0000 0000 0000 0000 0000 0000 | ................
00000030 | 0000 0000 0000 0000 0000 0000 0000 0000 | ................
00000040 | 0000 0000 0000 0000 0000 0000 0000 0000 | ................
00000050 | 0000 0000 0000 0000 0000 0000 0000 0000 | ................
00000060 | 0000 0000 0000 0000 0000 0000 0000 0000 | ................
00000070 | 0000 0000 0000 0000 0000 0000 0000 0000 | ................
00000080 | 0000 0000 0000 0000 0000 0000 0000 0000 | ................
00000090 | 0000 0000 0000 0000 0000 0000 0000 0000 | ................
000000A0 | 0000 0000 0000 0000 0000 0000 0000 0000 | ................
000000B0 | 0000 0000 0000 0000 0000 0000 0000 0000 | ................
000000C0 | 0000 0000 0000 0000 0000 0000 0000 0000 | ................
000000D0 | 0000 0000 0000 0000 0000 0000 0000 0000 | ................
000000E0 | 0000 0000 0000 0000 0000 0000 0000 0000 | ................
000000F0 | 0000 0000 0000 0000 0000 0000 0000 0000 | ................
00000100 | 0000 0000 0000 0000 0000 0000 0000 0000 | ................
00000110 | 0000 0000 0000 0000 0000 0000 0000 0000 | ................
00000120 | 0000 0000 0000 0000 0000 0000 0000 0000 | ................
00000130 | 0000 0000 0000 0000 0000 0000 0000 0000 | ................
00000140 | 0000 0000 554E 4B4E 4F57 4E20 5553 4552 | ....UNKNOWN USER
00000150 | 0000 0000 0000 0000 0000 0000 0000 0000 | ................
00000160 | 0000 0000 0000 0000 0000 0000 0000 0000 | ................
00000170 | 0000 0000 0000 0000 0000 0000 0000 0000 | ................
00000180 | 0000 0000 0000 0000 0000 0000 0000 0000 | ................
00000190 | 0000 0000 0000 0000 0000 0000 0000 0000 | ................
000001A0 | 0000 0000 0000 0000 0000 0000 0000 0000 | ................
000001B0 | 0000 0000 0000 0000 0000 0000 0000 0000 | ................
000001C0 | 0000 0000 0000 0000 0000 0000 0000 0000 | ................
000001D0 | 0000 0000 0000 0000 0000 0094 0000 0005 | ................
000001E0 | 0000 0001 0000 0028 0A00 0002 0000 0053 | .......(.......S
000001F0 | 6572 7669 6365 2050 6163 6B20 3200 0000 | ervice Pack 2...
00000200 | 0000 0000 0000 0000 0000 0000 0000 0000 | ................
00000210 | 0000 0000 0000 0000 0000 0000 0000 0000 | ................
00000220 | 0000 0000 0000 0000 0000 0000 0000 0000 | ................
00000230 | 0000 0000 0000 0000 0000 0000 0000 0000 | ................
00000240 | 0000 0000 0000 0000 0000 0000 0000 0000 | ................
00000250 | 0000 0000 0000 0000 0000 0000 0000 0000 | ................
00000260 | 0000 0000 0000 0000 0000 0000 0000 0033 | ...............3
00000270 | 2E30 0000 0000 0000 0000 0000 0000 0000 | .0..............
00000280 | 0000 0000 0000 0000 0000 0000 0000 0000 | ................
00000290 | 0000 0000 0000 0000 0000 0000 0000 0000 | ................
000002A0 | 0000 0000 0000 0000 0000 0000 0000 0000 | ................
000002B0 | 0000 0000 0000 0000 0000 0000 0000 0000 | ................
000002C0 | 0000 0000 0000 0000 0000 0000 0000 0000 | ................
000002D0 | 0000 0000 0000 0000 0000 0000 0000 0000 | ................
000002E0 | 0000 0000 0000 0000 0000 0000 0000 0000 | ................
000002F0 | 0000 0000 0000 0000 0000 0000 0000 0000 | ................
00000300 | 0000 0000 0000 0000 0000 0000 0000 0000 | ................
00000310 | 0000 0000 0000 0000 0000 0000 0000 0000 | ................
00000320 | 0000 0000 0000 0000 0000 0000 0000 0000 | ................
00000330 | 0000 0000 0000 0000 0000 0000 0000 0000 | ................
00000340 | 0000 0000 0000 0000 0000 0000 0000 0000 | ................
00000350 | 0000 0000 0000 0000 0000 0000 0000 0000 | ................
00000360 | 0000 0000 0000 0000 0000 0000 0000 0000 | ................
00000370 | 0000 0000 0000 0000 0000 0000 0000 0000 | ................
00000380 | 0000 0000 0000 0000 0000 0000 0000 0000 | ................
00000390 | 0000 0000 0000 0000 0000 0000 0000 0000 | ................
000003A0 | 0000 0000 00                            | .....

All content ("Information") contained in this report is the copyrighted work of Threat Expert Ltd and its associated companies ("ThreatExpert") and may not be copied without the express permission of ThreatExpert.

The Information is provided on an "as is" basis. ThreatExpert disclaims all warranties, whether express or implied, to the maximum extent permitted by law, including the implied warranties that the Information is merchantable, of satisfactory quality, accurate, fit for a particular purpose or need, or non-infringing, unless such implied warranties are legally incapable of exclusion. Further, ThreatExpert does not warrant or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise.