TROJ_DROPPER.WTH

This Trojan uses social engineering methods to lure users into performing certain actions that may, directly or indirectly, cause malicious routines to be performed. Specifically, it makes use of the Summit on the Development Issues of G-20 of Korea.

To get a one-glance comprehensive view of the behavior of this Trojan, refer to the Threat Diagram shown below.

It drops a file detected as TROJ_AGENT.JAAK.

It drops a non-malicious .DOC file. When the said file is opened, it executes an instance of Microsoft Word. MS Word then loads the file as a normal .DOC file.

This Trojan bears the file icons of certain applications to avoid easy detection and consequent removal. It executes then deletes itself afterward.

It executes the files it drops, prompting the affected system to exhibit the malicious routines they contain.

Arrival Details

This Trojan may be downloaded from the following remote sites:

• http://www.{BLOCKED}trickre.com/issues/G20IssuesPaper.zip

Installation

This Trojan bears the file icons of the following applications:

• Microsoft Word document

It executes then deletes itself afterward.

Autostart Technique

This Trojan creates the following registry entries to enable automatic execution of dropped component at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
AdobeUpdate = "%User Temp%\Wininet.exe"

Dropping Routine

This Trojan drops the following files:

• {malware path}\Korean G20 Development Issue Paper.doc - non-malicious file

It drops the following files:

• %User Temp%\Wininet.exe - detected as TROJ_AGENT.JAAK

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.)

It executes the files it drops, prompting the affected system to exhibit the malicious routines they contain.

Other Details

This Trojan opens the following files:

• {malware path}\Korean G20 Development Issue Paper.doc

It does the following:

• Executes an instance of Microsoft Word when the file {malware path}\Korean G20 Development Issue Paper.doc is opened. MS Word then loads the file as a normal .DOC file.