WORM_NUQEL.S

This worm uses Windows Task Scheduler to create a scheduled task that executes the dropped copy.

It disables Task Manager, Registry Editor, and Folder Options.

It drops copies of itself in all drives. These dropped copies use the names of the folders located on the said drives for their file names. It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

It modifies the user's Internet Explorer home page into a certain website. This action allows the malware to point to a website which may contain malware, putting the affected computer at greater risk of malware infection.

Installation

This worm drops the following copies of itself into the affected system:

• %Windows%\chrome.exe
• %System%\chrome.exe

(Note: %Windows% is the Windows folder, which is usually C:\Windows.. %System% is the Windows system folder, which is usually C:\Windows\System32.)

It drops the following component file(s):

• %System%\autorun.ini
• %Windows%\Tasks\At1.job

(Note: %System% is the Windows system folder, which is usually C:\Windows\System32.. %Windows% is the Windows folder, which is usually C:\Windows.)

It adds the following processes:

• Google Talk
• Yahoo Messenger

It uses Windows Task Scheduler to create a scheduled task that executes the dropped copy.

Autostart Technique

This worm adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Yahoo Messengger = "%System%\chrome.exe"

It modifies the following registry entries to ensure it automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Winlogon
Shell = "Explorer.exe chrome.exe"

(Note: The default value data of the said registry entry is Explorer.exe.)

The scheduled task executes the malware every:

• 9:00 AM, weekly

Other System Modifications

This worm adds the following registry keys:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
System

HKEY_CURRENT_USER\Software\Policies\
Microsoft\Internet Explorer\Control Panel

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Internet Explorer

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Internet Explorer\Control Panel

It adds the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings
GlobalUserOffline = "0"

It modifies the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Main
Start Page = "http://h1.ripway.com/mygoogle0/index.html"

(Note: The default value data of the said registry entry is {default home page}.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Internet Explorer\Main
Default_Page_URL = "http://h1.ripway.com/mygoogle0/index.html"

(Note: The default value data of the said registry entry is {default home page}.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Internet Explorer\Main
Default_Search_URL = "http://h1.ripway.com/mygoogle0/index.html"

(Note: The default value data of the said registry entry is {default search page}.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Internet Explorer\Main
Search Page = "http://h1.ripway.com/mygoogle0/index.html"

(Note: The default value data of the said registry entry is {default search page}.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Internet Explorer\Main
Start Page = "http://h1.ripway.com/mygoogle0/index.html"

(Note: The default value data of the said registry entry is {default home page}.)

It creates the following registry entry(ies) to disable Task Manager, Registry Tools and Folder Options:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
System
DisableTaskMgr = "1"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
System
DisableRegistryTools = "1"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
Explorer
NofolderOptions = "1"

Propagation

This worm drops the following copies of itself in all physical and removable drives:

• {Drive Letter}\chrome.exe
• {Drive Letter}\New Folder.exe

It drops copies of itself in all drives. These dropped copies use the names of the folders located on the said drives for their file names.

It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

The said .INF file contains the following strings:

[Autorun]
Open=chrome.exe
Shellexecute=chrome.exe
Shell\Open\command=chrome.exe
Shell=Open

Web Browser Home Page and Search Page Modification

This worm modifies the user's Internet Explorer home page to the following websites:

• http://{BLOCKED}1.{BLOCKED}y.com/mygoogle0/index.html

Download Routine

This worm accesses the following websites to download files:

• http://www.{BLOCKED}1.{BLOCKED}y.com/sdbo/setting.ini

It saves the files it downloads using the following names:

• %System%\setting.ini

(Note: %System% is the Windows system folder, which is usually C:\Windows\System32.)