WORM_TRAXG.AC

This worm arrives as attachment to mass-mailed email messages. It arrives via removable drives.

It uses the default Windows folder icon to trick users into opening the file. Double-clicking the file executes this malware.

However, as of this writing, the said sites are inaccessible.

Arrival Details

This worm arrives as attachment to mass-mailed email messages.

It arrives via removable drives.

It may arrive via network shares.

Installation

This worm drops the following component file(s):

• D:\net.txt

It drops the following copies of itself into the affected system:

• %Windows%\Fonts\{random characters}.com
• %Windows%\Help\{random characters}.com
• %Windows%\System\{random characters}.com
• %Windows%\Temp\{random characters}.com

It displays the following fake error messages:

Warning
This Folder Has Been Damage!

It uses the default Windows folder icon to trick users into opening the file. Double-clicking the file executes this malware.

Autostart Technique

This worm adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
TempCom = "%Windows%\{created folder name}\{malware file name}"

Other System Modifications

This worm modifies the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
Hidden = "0"

(Note: The default value data of the said registry entry is 1.)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
HideFileExt = "1"

(Note: The default value data of the said registry entry is 0.)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
CabinetState
FullPath = "1"

(Note: The default value data of the said registry entry is 0.)

Other Details

This worm attempts to access the following websites to download files, which are possibly malicious:

• utenti.{BLOCKED}os.it/vx9/dl.exe

However, as of this writing, the said sites are inaccessible.

NOTES:

It also drops copies itself into subfolders using the folder name as its file name.

It also drops a copy of itself as WINDOWS.EXE and a copy of a Trojan script named FOLDER.HTT into the Web folder located in the Windows folder. It then creates a file named DESKTOP.INI in the folder where this worm is originally executed. The said .INI file sets the current folder view settings specified in FOLDER.HTT. If Web Content is enabled in the folder where this worm is executed, the .HTT and .INI files are copied into every folder opened using Windows Explorer. In effect, this worm is executed. Trend Micro detects the malicious .HTT file as HTML_TRAXG.A.

Propagation via Email

This worm propagates via email messages using a Messaging Application Programming Interface (MAPI) in Microsoft Outlook. It sends a copy of itself to all email addresses listed in the address book of the said application.

From: Mywoman@{BLOCKED}3.com
To: {Microsoft Outlook contact address}
Subject: {random characters}
Message body: {random characters}
Attachment: {random characters}.exe

Propagation via Network Shares, Removable Drives, and Shared Drives

This worm also propagates by dropping a copy of itself into network shares, removable drives, and shared drives using the following file names:

• Ghost.bat
• WINDOWS.EXE

Furthermore, it also drops a malicious script file named NETHOOD.HTM, which Trend Micro detects as HTML_TRAXG.A, in all available drives.