ThreatExpert Report: not-a-virus.Keygen.AVGInternetSecurity, HackTool.Win32.Kiser, Trojan Horse..

Submission Summary:

Submission details:

Submission received: 11 September 2012, 00:53:18
Processing time: 13 min 13 sec
Submitted sample:

File MD5: 0xFC2581A82DE3E8887F7EBCB504B7692D
File SHA-1: 0xC3A51F71E0B07DC4B273D67217F5CBD03A879620
Filesize: 3,231,172 bytes
Alias: not-a-virus.Keygen.AVGInternetSecurity [Ikarus]

Summary of the findings:

What's been found	Severity Level
Downloads/requests other files from Internet.
Contains characteristics of an identified security risk.

Technical Details:

The new window was created, as shown below:

NOTICE: The content shown in the above window is captured automatically and is not controlled or endorsed by ThreatExpert.
Please contact us on this link should any material be offensive or inappropriate and we will ensure any such content is blocked from future viewers of the report.

Possible Security Risk

Attention! The following threat category was identified:

Threat Category	Description
	A malicious trojan horse or bot that may represent security risk for the compromised system and/or its network environment

File System Modifications

The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%AppData%\KW\unrar.dll	82,944 bytes	MD5: 0x69AA9F2BEE8409F2D1810A30945E7F4A SHA-1: 0x1FA9CBC1022167DA2F11F3718FA383EDBBA0C155	packed with UPX [Kaspersky Lab]
2	%Temp%\1.exe	1,017,344 bytes	MD5: 0xD21173B574E62C53F1D8797FF7C17F92 SHA-1: 0x15A0494EC379FD07B831381B52743890DEF61BD0	HackTool.Win32.Kiser [Ikarus]
3	%Temp%\2.exe	2,474,608 bytes	MD5: 0x9C85F494132CC6027762D8DDF1DD5A12 SHA-1: 0x97CEB28F52652BA548D3E1082BB931B9D6B8B086	(not available)
4	%Temp%\3.exe	325,120 bytes	MD5: 0x5619BE55D01C1E196DCD1547F4FDA891 SHA-1: 0x8613EECD77A110D378403816742D08B4BED821B5	Trojan Horse [Symantec] Generic.dx!noo [McAfee] Mal/Cracker-B [Sophos] HackTool:Win32/Keygen [Microsoft] not-a-virus.Keygen.AVGInternetSecurity [Ikarus]
5	%Temp%\rld.dll	198,144 bytes	MD5: 0xD69351C075052761DB14E4CDD17801BC SHA-1: 0x0750C30CF1E036174A4E34A385388C3BF658D70F	Mal/Obfus-D [Sophos]
6	%Temp%\SetupHelper.exe	37,752 bytes	MD5: 0xB6FCCDCDB41B33331CD0A05249FD03B4 SHA-1: 0xD3B18FC2F0BFA4AB5B3B9E9BA321AD838339C64E	(not available)
7	%Temp%\steam_api.dll	121,984 bytes	MD5: 0xD1953334ED302B2BE3C509336E5C53B3 SHA-1: 0x20867924FEAB62E443E90F841822A9B43C8C8B12	(not available)
8	%Temp%\unins000.exe	1,507,257 bytes	MD5: 0xDDD65EFB0F659C795EE8F16843050E29 SHA-1: 0x338138662943E2E1B5B02A3DCEDE7050FEE3D68B	(not available)
9	[file and pathname of the sample #1]	3,231,172 bytes	MD5: 0xFC2581A82DE3E8887F7EBCB504B7692D SHA-1: 0xC3A51F71E0B07DC4B273D67217F5CBD03A879620	not-a-virus.Keygen.AVGInternetSecurity [Ikarus]

Notes:

%AppData% is a variable that refers to the file system directory that serves as a common repository for application-specific data. A typical path is C:\Documents and Settings\[UserName]\Application Data.
%Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).

The following directories were created:

%AppData%\KW
%Temp%\rundll32_Data_DFE

Memory Modifications

There were new processes created in the system:

Process Name	Process Filename	Main Module Size
[generic host process]	[generic host process filename]	20,480 bytes
unins000.exe	%Temp%\unins000.exe	1,536,000 bytes

Notes:

[generic host process filename] is a full path filename of [generic host process].

Registry Modifications

The following Registry Keys were created:

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{3A1380F4-708F-49DE-B2EF-04D25EB009D5}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{3A1380F4-708F-49DE-B2EF-04D25EB009D5}\Properties
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_PROCMON23
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_PROCMON23\0000
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\PROCMON23
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\PROCMON23\Instances
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\PROCMON23\Instances\Process Monitor 23 Instance
HKEY_CURRENT_USER\Software\Sysinternals\Process Monitor
HKEY_CURRENT_USER\Software\Slipknot Corp.
HKEY_CURRENT_USER\Software\Slipknot Corp.\KKL

The newly created Registry Values are:

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{3A1380F4-708F-49DE-B2EF-04D25EB009D5}]

Class = "PROCMON23"
NoDisplayClass = "1"
NoUseClass = "1"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_PROCMON23\0000]

Service = "PROCMON23"
Legacy = 0x00000001
ConfigFlags = 0x00000000
Class = "LegacyDriver"
ClassGUID = "{8ECC055D-047F-11D1-A537-0000F8753ED1}"
DeviceDesc = "PROCMON23"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_PROCMON23]

NextInstance = 0x00000001

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\PROCMON23\Instances\Process Monitor 23 Instance]

Altitude = "385200"
Flags = 0x00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\PROCMON23\Instances]

DefaultInstance = "Process Monitor 23 Instance"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\PROCMON23]

SupportedFeatures = 0x00000003

[HKEY_CURRENT_USER\Software\Sysinternals\Process Monitor]

EulaAccepted = 0x00000001

[HKEY_CURRENT_USER\Software\Slipknot Corp.\KKL]

MainLang = "English"
dwnb = "1"
readbl = "1"
OfflineMode = "0"
ShowWizard = "0"
KId = "{B18966DF-B913-4E38-AE2D-1303845ECC74}"

Other details

Analysis of the file resources indicate the following possible countries of origin:

	Ukraine
	China

To mark the presence in the system, the following Mutex object was created:

The data identified by the following URLs was then requested from the remote web server:

http://snowonthetree.narod2.ru/kw/update.ini
localhost

All content ("Information") contained in this report is the copyrighted work of Threat Expert Ltd and its associated companies ("ThreatExpert") and may not be copied without the express permission of ThreatExpert.

The Information is provided on an "as is" basis. ThreatExpert disclaims all warranties, whether express or implied, to the maximum extent permitted by law, including the implied warranties that the Information is merchantable, of satisfactory quality, accurate, fit for a particular purpose or need, or non-infringing, unless such implied warranties are legally incapable of exclusion. Further, ThreatExpert does not warrant or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise.