Submission Summary:

• Submission details:
• Submission received: 17 July 2012, 21:04:02
• Processing time: 13 min 14 sec
• Submitted sample:
• File MD5: 0x12549D555D135AEB22E689AA6EE5CC43
• File SHA-1: 0x8E8C0FE2916C05FFC5EB1DCA5270C0D42630F24B
• Filesize: 149,504 bytes

• Summary of the findings:

What's been found	Severity Level
Hosts file modification that may block access to the security web sites.
Creates a startup registry entry.

Technical Details:

File System Modifications

• The following file was created in the system:

#	Filename(s)	File Size	File Hash
1	%AppData%\xhqqvuzt2hha1fnhjffzshhwerxinnb22\svcnost.exe	149,504 bytes	MD5: 0x12549D555D135AEB22E689AA6EE5CC43 SHA-1: 0x8E8C0FE2916C05FFC5EB1DCA5270C0D42630F24B

• Note:
• %AppData% is a variable that refers to the file system directory that serves as a common repository for application-specific data. A typical path is C:\Documents and Settings\[UserName]\Application Data.

• The following files were modified:
• %AppData%\desktop.ini
• %System%\drivers\etc\hosts

• Notes:
• %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

• The following directory was created:
• %AppData%\xhqqvuzt2hha1fnhjffzshhwerxinnb22

Memory Modifications

• There were new processes created in the system:

Process Name	Process Filename	Main Module Size
svcnost.exe	%AppData%\xhqqvuzt2hha1fnhjffzshhwerxinnb22\svcnost.exe	286,720 bytes
[filename of the sample #1]	[file and pathname of the sample #1]	286,720 bytes

• Attention! The following processes were intentionally hidden from the user:

Registry Modifications

• The following Registry Key was created:
• HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\LowRegistry

• The newly created Registry Values are:
• [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\LowRegistry]
• SavedLegacySettingsML = 33 38 39 39 32 31 39 30 35
• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
• Windows Init = ""%AppData%\xhqqvuzt2hha1fnhjffzshhwerxinnb22\svcnost.exe""

so that svcnost.exe runs every time Windows starts

Other details

• To mark the presence in the system, the following Mutex object was created:
• LDR.ML.STARTED

• The HOSTS file was updated with the following URL-to-IP mappings:

• The following Host Names were requested from a host database:
• 89.149.242.127
• 217.20.115.72
• 89.149.243.234
• 89.149.242.245
• dmuj.ru