WORM_RONTKBR.B

This worm arrives by connecting affected removable drives to a system. It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It uses the Windows Task Scheduler to add a scheduled task that executes the copies it drops.

Arrival Details

This worm arrives by connecting affected removable drives to a system.

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This worm drops the following copies of itself into the affected system:

• %AppDataLocal%\csrss.exe
• %AppDataLocal%\inetinfo.exe
• %AppDataLocal%\lsass.exe
• %AppDataLocal%\services.exe
• %AppDataLocal%\smss.exe
• %AppDataLocal%\winlogon.exe
• %Application Data%\Microsoft\Windows\Templates\WowTumpeh.com (Windows Vista and higher versions)
• %User Profile%\Templates\WowTumpeh.com (Versions lower than Windows Vista)
• %Windows%\eksplorasi.exe
• %Windows%\ShellNew\bronstab.exe
• %System%\{user name}-{host name}'s Setting.scr

It uses the Windows Task Scheduler to add a scheduled task that executes the copies it drops.

It creates the following folders:

• %AppDataLocal%\Bron.tok-{mm}-{dd}

(Note: %AppDataLocal% is the Application Data folder found in Local Settings, where it is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

Autostart Technique

This worm adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Tok-Cirrhatus = "%AppDataLocal%\smss.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Bron-Spizaetus = "%Windows%\ShellNew\bronstab.exe"

It modifies the following registry entry(ies) to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Winlogon
Shell = "Explorer.exe "%Windows%\eksplorasi.exe""

(Note: The default value data of the said registry entry is "Explorer.exe".)

It enables its automatic execution at every system startup by dropping the following copies of itself into the Windows Common Startup folder:

• %Start Menu%\Programs\Startup\Empty.pif

(Note: %Start Menu% is the Start Menu folder, where it usually is C:\Documents and Settings\{user name}\Start Menu on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming\Microsoft\Windows\Start Menu on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

Other System Modifications

This worm modifies the following file(s):

• %System Root%\AUTOEXEC.bat

(Note: %System Root% is the Windows root folder, where it usually is C:\ on all Windows operating system versions.)

It adds the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
System
DisableRegistryTools = "1"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
System
DisableCMD = "0"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
Explorer
NoFolderOptions = "1"

It modifies the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
Hidden = "0"

(Note: The default value data of the said registry entry is "1".)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
HideFileExt = "1"

(Note: The default value data of the said registry entry is "0".)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
ShowSuperHidden = "0"

(Note: The default value data of the said registry entry is "1".)

Propagation

This worm drops the following copy(ies) of itself in all removable drives:

• {removable drive letter}:\Data {user name}-{host name}.exe

Other Details

This worm connects to the following possibly malicious URL:

• http://www.{BLOCKED}ies.com/lrostabro2/Bron-ID10.txt
• http://www.{BLOCKED}ies.com/lrostabro2/BrontokInf10.txt
• http://www.{BLOCKED}ies.com/lrostabro2/Host10.txt
• http://www.{BLOCKED}ies.com/sjistabro1/BrontokInf10.txt
• http://www.{BLOCKED}ies.com/sjistabro1/Host10.txt