WORM_SOHANAD.SU

This worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Other System Modifications

This worm deletes the following files:

• %Program Files%\Intern~1\IEXPLORES.EXE
• %User Temp%\tmp.exe
• %Program Files%\Intern~1\IEXPLORERSS.BAK
• %Program Files%\Intern~1\IEXPLORERS.EXE
• %Program Files%\Intern~1\IEXPLORESX.EXE
• %User Temp%\1306061934.tmp
• %User Temp%\1306061933.tmp
• %User Temp%\1306061932.tmp
• %User Temp%\1306061931.tmp
• %User Temp%\1306061930.tmp
• %User Temp%\1306061929.tmp
• %User Temp%\1306061928.tmp
• %User Temp%\1306061927.tmp
• %User Temp%\1306061926.tmp
• %User Temp%\1306061925.tmp
• %User Temp%\1306061924.tmp
• %User Temp%\1306061923.tmp
• %User Temp%\1306061922.tmp
• %User Temp%\1306061921.tmp
• %User Temp%\1306061920.tmp
• %User Temp%\1306061919.tmp
• %User Temp%\1306061918.tmp
• %User Temp%\1306061917.tmp
• %User Temp%\1306061916.tmp
• %User Temp%\1306061915.tmp
• %User Temp%\1306061914.tmp
• %User Temp%\1306061913.tmp
• %User Temp%\1306061912.tmp
• %User Temp%\1306061911.tmp
• %User Temp%\1306061910.tmp
• %User Temp%\1306061909.tmp
• %User Temp%\1306061908.tmp
• %User Temp%\1306061907.tmp
• %User Temp%\1306061906.tmp
• %Temp%\scsA.tmp
• %Temp%\scsD.tmp

(Note: %Program Files% is the default Program Files folder, usually C:\Program Files in Windows 2000, Server 2003, and XP (32-bit), Vista (32-bit), and 7 (32-bit), or C:\Program Files (x86) in Windows XP (64-bit), Vista (64-bit), and 7 (64-bit).. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.. %Temp% is the Windows Temporary folder, which is usually C:\Windows\Temp.)

It adds the following registry keys:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\tydown

It adds the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
ShowSuperHidden = "0"

It modifies the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced\Folder\Hidden\
SHOWALL
Checkedvalue = "0"

(Note: The default value data of the said registry entry is 1.)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
Hidden = "2"

(Note: The default value data of the said registry entry is 2.)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
HideFileExt = "1"

(Note: The default value data of the said registry entry is 1.)

Dropping Routine

This worm drops the following files:

• %User Temp%\1306061936.exe
• %User Temp%\1306061936.tmp
• %System Root%\Documents and Settings.exe
• %Program Files%.exe
• %Windows%.exe

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.. %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.. %Program Files% is the default Program Files folder, usually C:\Program Files in Windows 2000, Server 2003, and XP (32-bit), Vista (32-bit), and 7 (32-bit), or C:\Program Files (x86) in Windows XP (64-bit), Vista (64-bit), and 7 (64-bit).. %Windows% is the Windows folder, which is usually C:\Windows.)

This report is generated via an automated analysis system.