Submission Summary:

• Submission details:
• Submission received: 1 August 2012, 07:10:50
• Processing time: 9 min 21 sec
• Submitted sample:
• File MD5: 0xF61CE3651B97D42E2ED7E7D6EDE9E549
• File SHA-1: 0xCC07EABEF0C5941186395E90C30F713560679B9E
• Filesize: 95,232 bytes
• Alias:
• Suspicious.MLApp [Symantec]
• Trojan-Ransom.Win32.Gimemo.algj [Kaspersky Lab]
• Trojan:Win32/Meredrop [Microsoft]
• Trojan.ATRAPS [Ikarus]

• Summary of the findings:

What's been found	Severity Level
Downloads/requests other files from Internet.

Technical Details:

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%Profiles%\NetworkService\Local Settings\Temp\Temporary Internet Files\Content.IE5\1PMTVKG7\desktop.ini %Profiles%\NetworkService\Local Settings\Temp\Temporary Internet Files\Content.IE5\A26GZOYE\desktop.ini %Profiles%\NetworkService\Local Settings\Temp\Temporary Internet Files\Content.IE5\desktop.ini %Profiles%\NetworkService\Local Settings\Temp\Temporary Internet Files\Content.IE5\F1ZODT3D\desktop.ini %Profiles%\NetworkService\Local Settings\Temp\Temporary Internet Files\Content.IE5\WR1ZIAQ3\desktop.ini	67 bytes	MD5: 0x4A3DEB274BB5F0212C2419D3D8D08612 SHA-1: 0xFA52F823B821155CF0EC527D52CE9B1390EC615E	(not available)
2	%Profiles%\NetworkService\Local Settings\Temp\Temporary Internet Files\Content.IE5\index.dat	32,768 bytes	MD5: 0x3B1E726188636ABC1BE15CF8904F0582 SHA-1: 0x5F8591A6DDF283539CDA791C37CA345294BD02E1	(not available)
3	[file and pathname of the sample #1]	95,232 bytes	MD5: 0xF61CE3651B97D42E2ED7E7D6EDE9E549 SHA-1: 0xCC07EABEF0C5941186395E90C30F713560679B9E	Suspicious.MLApp [Symantec] Trojan-Ransom.Win32.Gimemo.algj [Kaspersky Lab] Trojan:Win32/Meredrop [Microsoft] Trojan.ATRAPS [Ikarus]

• Note:
• %Profiles% is a variable that refers to the file system directory containing user profile folders. A typical path is C:\Documents and Settings.

• The following directories were created:
• %Profiles%\NetworkService\Local Settings\Temp\Cookies
• %Profiles%\NetworkService\Local Settings\Temp\History
• %Profiles%\NetworkService\Local Settings\Temp\History\History.IE5
• %Profiles%\NetworkService\Local Settings\Temp\Temporary Internet Files
• %Profiles%\NetworkService\Local Settings\Temp\Temporary Internet Files\Content.IE5
• %Profiles%\NetworkService\Local Settings\Temp\Temporary Internet Files\Content.IE5\1PMTVKG7
• %Profiles%\NetworkService\Local Settings\Temp\Temporary Internet Files\Content.IE5\A26GZOYE
• %Profiles%\NetworkService\Local Settings\Temp\Temporary Internet Files\Content.IE5\F1ZODT3D
• %Profiles%\NetworkService\Local Settings\Temp\Temporary Internet Files\Content.IE5\WR1ZIAQ3

Memory Modifications

• There was a new process created in the system:

Registry Modifications

• The following Registry Key was created:
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{10CD6860-CD68-6860-CD68-0CD610CD6860}

• The following Registry Value was modified:
• [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
• Cookies =
• Cache =
• History =

Other details

• The data identified by the following URLs was then requested from the remote web server:
• http://5.9.52.12/f/i.html?n=3&i=10CD6860&s=1944C&g=203&r=0.51102000.2600.1.0.1.0pid696tid1928
• http://5.9.52.12/f/i.html?n=1&i=10CD6860&s=1944C&g=203&c=10CD6860
• http://64.191.47.181/f/i.html?n=3&i=10CD6860&s=1944C&g=203&r=0.51102000.2600.1.0.1.0pid696tid1928
• http://64.191.47.181/f/i.html?n=1&i=10CD6860&s=1944C&g=203&c=10CD6860
• http://46.183.217.133/f/i.html?n=3&i=10CD6860&s=1944C&g=203&r=0.51102000.2600.1.0.1.0pid696tid1928
• http://46.183.217.133/f/i.html?n=1&i=10CD6860&s=1944C&g=203&c=10CD6860
• http://5.9.52.12/f/i.html?n=3&i=10CD6860&s=1944C&g=203&r=0.51102000.2600.1.0.1.0pid812tid1916
• http://64.191.47.181/f/i.html?n=3&i=10CD6860&s=1944C&g=203&r=0.51102000.2600.1.0.1.0pid812tid1916
• http://46.183.217.133/f/i.html?n=3&i=10CD6860&s=1944C&g=203&r=0.51102000.2600.1.0.1.0pid812tid1916