WORM_MUMU.B

This worm executes the files it drops, prompting the affected system to exhibit the malicious routines they contain.

Arrival Details

This worm may arrive via network shares.

Installation

This worm drops the following copies of itself into the affected system:

• %System%\mumu.exe

(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)

It drops the following component file(s):

• %System%\IPCPass.txt

(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)

It drops the following non-malicious file:

• %System%\psexec.exe

(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• qjinfo2mutex
• qjinfo1mutex

Other System Modifications

This worm adds the following registry entries as part of its installation routine:

HKEY_LOCAL_MACHINE\SOFTWARE\mumu
{first 3 octet of the machine's IP address} = "{random hex} "

It adds the following registry keys as part of its installation routine:

HKEY_LOCAL_MACHINE\SOFTWARE\mumu

Dropping Routine

This worm drops the following files:

• %System%\kavfind.exe - detected as TROJ_HACLINE.A
• %System%\last.exe - detected as TROJ_MUMUBOY.C

(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)

It executes the files it drops, prompting the affected system to exhibit the malicious routines they contain.

NOTES:

Once it found a vulnerable machine from the network, it copies itslef to Admin$\system32 as mumu.exe.

It uses the legitimate program PSEXEC.EXE from Sysinternals to remotely run the copied program using the following command:

• start /i /min /wait /B psexec \\%target_pc% -u %username% -p %password% -d mumu.exe

This time, %username% and %password% are the ones saved in IPCFind.txt from TROJ_HACLINE.A. The program runs non-interactively with the switch d.

It deletes the log file IPCFind.txt afterwards.

Aside from IP scanning for target machines, it also tries to replicate on connected machines, usually those locally attached to the infected system. It executes the following command for one minute to get the established connections and saves to A.TMP file:

• CMD /c netstat -n|find \":\" >A.TMP

It sends a PING command to every machine and considers the string reply as a success reply. The PING output is temporarily saved to B.TMP file.

When connection is successful, it copies the worm to other machines as Admin$\Winnt\MUMU.EXE and runs it. It deletes the A.TMP and B.TMP files after the routine.

It opens the file QJINFO.INI from TROJ_MUMUBOY.C. If the file is not empty, it sleeps for 5 seconds before it maps the file in Windows memory for easy access. It then proceeds to its SMTP routine. The worm lacks some error checking in SMTP routine, causing it to crash once in a while if certain error occurs.

The worm contains SMTP (Simple Mail Transfer Protocol) commands to connect to the SMTP server, smtp.{BLOCKED}a.com.cn.

It generates an email with the following details:

To: {BLOCKED}0.student@sina.com
From: {BLOCKED}il2.student@sina.com
Subject: {random number}{Computer Name}
Date: {Current Date}

It also creates a pop-up child window with the class name, SYSTARY and then modifies the registry as follows:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run