Analysis of PROGX
Executive Summary
Provenance
This program, named Lab03-04.exe was downloaded from the Practical Malware Analysis website.

Static Analysis
The MD5 hash of the file downloaded is b94af4a4d4af6eac81fc135abda1c40c

The DLLs used by the program include KERNEL32.DLL, from which it imports file manipulation functions, and ADVAPI32.DLL, from which it imports functions to manipulate services and the registry. It also imports the function ShellExecuteA from SHELL32.DLL.

16 virus scanners at VirusTotal.com identify this file as infected

Is the program packed? No, PeiD does not think it is packed, and it has several strings visible.  Some of the interesting strings in the file include –cc, -re, and –in, which may command line arguments, and “cmd.exe”, the name of the command shell, as well as the URL http://www.practicalmalwareanalysis.com. There is also what looks like a registry key SOFTWARE\Microsoft \XPS, and the strings UPLOAD, DOWNLOAD, and GET. 
There appears to be no resources in the file, which is bit unusual.

Dynamic Behavior

When run, the program seems to immediately delete itself and terminate.  The program adds 11 keys to the registry under HKU\S-1-5-21-1060284298-688789844-725345543-500\Software\Microsoft\Windows\