WORM_UTOTI.KH

Infection Channel:

Propagates via removable drives

This worm arrives as an attachment to email messages spammed by other malware/grayware or malicious users. It may be downloaded by other malware/grayware/spyware from remote sites.

It uses the Windows Task Scheduler to add a scheduled task that executes the copies it drops.

It modifies registry entries to hide files with System and Read-only attributes.

It drops copies of itself into network drives. It drops copies of itself in all removable drives.

File Size:

581,120 bytes

File Type:

PE

Memory Resident:

Yes

Initial Samples Received Date:

29 Nov 2010

Payload:

Hides files and processes

Arrival Details

This worm arrives as an attachment to email messages spammed by other malware/grayware or malicious users.

It may be downloaded by other malware/grayware/spyware from remote sites.

Installation

This worm drops the following copies of itself into the affected system:

%System Root%\KHATRA.exe
%Windows%\Xplorer.exe
%Windows%\KHATARNAKH.exe
%System%\KHATRA.exe
%Windows%\system\gHost.exe
%Application Data%\Microsoft\CD Burning\KHATRA.exe
%Application Data%\Microsoft\CD Burning\winxp.exe
%Application Data%\Microsoft\CD Burning\New Folder(3).exe

(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.. %Windows% is the Windows folder, which is usually C:\Windows or C:\WINNT.. %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.. %Application Data% is the current user's Application Data folder, which is usually C:\Windows\Profiles\{user name}\Application Data on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Application Data on Windows NT, and C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, XP, and Server 2003.)

It drops the following non-malicious file:

%Windows%\inf\Autoplay.inF

(Note: %Windows% is the Windows folder, which is usually C:\Windows or C:\WINNT.)

It uses the Windows Task Scheduler to add a scheduled task that executes the copies it drops.

Autostart Technique

This worm adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\policies\
Explorer\Run
G_Host = %Windows%\System\gHost.exe /Reproduce

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Xplorer = ""%Windows%\Xplorer.exe" /Windows"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Winlogon
Taskman = "%System%\KHATRA.exe"

It modifies the following registry entries to ensure it automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows NT\CurrentVersion\Windows
load = "%System%\KHATRA.exe"

(Note: The default value data of the said registry entry is "".)

Other System Modifications

This worm adds the following registry entries as part of its installation routine:

HKEY_CURRENT_USER\Software\Nico Mak Computing\
WinZip\caution
NoUnsafeTypeCautionForSCR = "1"

HKEY_CURRENT_USER\Software\Nico Mak Computing\
WinZip\caution
NoUnsafeTypeCautionForEXE = "1"

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Main
Window Title = "Internet Exploiter"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
System
DisableRegistryTools = 1

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
Explorer
NoControlPanel = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Tracing\FWCFG
EnableFileTracing = 0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Tracing\FWCFG
EnableConsoleTracing = 0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Tracing\FWCFG
FileTracingMask = dword:ffff0000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Tracing\FWCFG
ConsoleTracingMask = ffff0000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Tracing\FWCFG
MaxFileSize = 00100000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\Schedule
AtTaskMaxHours = 0

It modifies the following registry key(s)/entry(ies) as part of its installation routine:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
Explorer
NoDriveTypeAutoRun = ff

(Note: The default value data of the said registry entry is 91.)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\mnmsrvc
Start = 2