WORM_COMITSPRO.J

This worm arrives via removable drives. It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes commands from a remote malicious user, effectively compromising the affected system.

Arrival Details

This worm arrives via removable drives.

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This worm drops the following copies of itself into the affected system:

• %User Temp%\system.exe
• %User Startup%\12ce4e06a81e8d54fd01d9b762f1b1bb.exe

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.. %User Startup% is the current user's Startup folder, which is usually C:\Windows\Profiles\{user name}\Start Menu\Programs\Startup on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Start Menu\Programs\Startup on Windows NT, and C:\Documents and Settings\{User name}\Start Menu\Programs\Startup.)

Autostart Technique

This worm adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
12ce4e06a81e8d54fd01d9b762f1b1bb = "%User Startup%\12ce4e06a81e8d54fd01d9b762f1b1bb.exe"

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Run
12ce4e06a81e8d54fd01d9b762f1b1bb = "%User Startup%\12ce4e06a81e8d54fd01d9b762f1b1bb.exe"

Other System Modifications

This worm adds the following registry keys:

HKEY_CURRENT_USER\Software\12ce4e06a81e8d54fd01d9b762f1b1bb

It adds the following registry entries:

HKEY_CURRENT_USER\Software\12ce4e06a81e8d54fd01d9b762f1b1bb
US = "{Default}"

HKEY_CURRENT_USER\Environment
SEE_MASK_NOZONECHECKS = "1"

Propagation

This worm drops the following copy(ies) of itself in all removable drives:

• {Removable Drive Letter}:\12ce4e06a81e8d54fd01d9b762f1b1bb.exe (hidden)

Backdoor Routine

This worm executes the following commands from a remote malicious user:

• Log Keystrokes
• Shutdown computer
• Manage Windows
• Monitors mouse activities
• Get System Information
• Download and execute files

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• {BLOCKED}.220.110:77

NOTES:
This worm creates shortcut files on the removable drive pointing to the malware copy. These shortcut files use the names of the existing files on the removable drives.

It does not have rootkit capabilities.

It does not exploit any vulnerability.