WORM_OTORUN

This description is based on the compiled analysis of several variants of WORM_OTORUN. Note that specific data such as file names and registry values may vary for each variant.

This worm arrives by connecting affected removable drives to a system. It arrives via removable drives. It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

Arrival Details

This worm arrives by connecting affected removable drives to a system.

It arrives via removable drives.

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This worm drops the following files:

• %User Temp%\E_N4\eAPI.fne
• %User Temp%\E_N4\eImgConverter.fne
• %User Temp%\E_N4\krnln.fnr
• %User Temp%\E_N4\PBShell.fne
• %User Temp%\E_N4\shell.fne
• %System Root%\OGa\RD\DesKTop.ini
• %User Temp%\srv{random}.ini
• %User Temp%\rstimgr.inf

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.. %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.)

It drops the following copies of itself into the affected system:

• %System%\smsc.exe
• %System%\svchoct.exe
• %User Temp%\srv{3 random hexadecimal digits}.tmp
• %System Root%\OGa\RD\GOx.exe
• %Windows%\dllmgr.exe
• %Application Data%\Microsoft\IME\V2005\PHIME2002A.exe
• %User Temp%\srv{random}.tmp
• {Shared Folder}\setup50045.fon

(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.. %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.. %Windows% is the Windows folder, which is usually C:\Windows or C:\WINNT.. %Application Data% is the current user's Application Data folder, which is usually C:\Windows\Profiles\{user name}\Application Data on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Application Data on Windows NT, and C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, XP, and Server 2003.)

It creates the following folders:

• %User Temp%\E_N4
• %System Root%\OGa
• %System Root%\OGa\RD
• %System Root%\RECYCLER\{SID}

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.. %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.)

It injects itself into the following processes as part of its memory residency routine:

• spoolsv.exe
• explorer.exe

Autostart Technique

This worm registers itself as a system service to ensure its automatic execution at every system startup by adding the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\PrtSmanm
ImagePath = "{malware path and file name}"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\srv{random hexadecimal number}
ImagePath = "{malware path and file name}"

It adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
{malware-defined name} = "{malware-defined entry name}

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\srv{random}\parameters
{malware-defined name} = "{malware path and file name}"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
{malware-defined name} = "{malware path and file name}"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
{malware-defined name} = {malware path and file name}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Active Setup\Installed Components\{random CLSID}
StubPath = "{malware path and file name}"

It adds the following keys to allow itself to run on safe mode:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Minimal\
srv{random hexadecimal number}

Other System Modifications

This worm adds the following registry entries as part of its installation routine:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Shell Extensions
{malware-defined name} = "{malware-defined entry name}"

It modifies the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile
EnableFirewall = "0"

(Note: The default value data of the said registry entry is 1.)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\wscsvc
Start = "4"

(Note: The default value data of the said registry entry is 2.)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\wuauserv
Start = "4"

(Note: The default value data of the said registry entry is 2.)

It creates the following registry entry(ies) to bypass Windows Firewall:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\GloballyOpenPorts\
List
{malware-defined name} = "{malware-defined entry name}"

Propagation

This worm creates the following folders in all removable drives:

• RECYCLER\S-1-5-21-2214276341-3544434524-6043330-4321
• OGa
• {Removable drive} letter:\{random characters}

It drops the following copy(ies) of itself in all removable drives:

• {drive}:\RECYCLER\S-1-5-21-2214276341-3544434524-6043330-4321\update.exe
• {space}.exe
• setup1911.fon
• {Removable drive letter}:\{random characters}\{random characters}.exe

It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

Other Details

This worm connects to the following possibly malicious URL:

• http://{BLOCKED}.{BLOCKED}.89.121/X
• http://{BLOCKED}.{BLOCKED}.89.121/exe
• http://{BLOCKED}.{BLOCKED}.48.173
• http://{BLOCKED}.{BLOCKED}.193.21
• http://{BLOCKED}.{BLOCKED}.88.10
• http://{base url}/bin/read_a.php?a1={some encrypted data}

NOTES:

Some variants of WORM_OTORUN have backdoor routines. These variants connect to certain Internet Relay Chat (IRC) servers to communicate and receive commands from a remote user.

Other variants may use network drives or software vulnerabilities to further propagate across a network.

This description is based on the compiled analysis of several variants of WORM_OTORUN. Note that specific data such as file names and registry values may vary for each variant.