WORM_PEPEX.TRM

This Worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This Worm may arrive via network shares.

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Autostart Technique

This Worm adds and runs the following services:

• • ServiceName: wglmgr
  • DisplayName: Windows Genuine Logon Manager
  • ImagePath: cmd.exe /c \"net share admin$\"
• • ServiceName: wugdtr
  • DisplayName: Sound card driver update
  • ImagePath: %Windows%\weihp.exe

(Note: %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.)

Propagation

This Worm uses the following file names for the copies it drops into shared networks:

• %Windows%\weihp.exe

(Note: %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.)

Other Details

This Worm does the following:

• It scans the following to check for open port 445:
  • Randomly-generated IP address over the Internet or LAN
• If it finds a host either on the LAN/Internet with open port 445, it attempts to remotely create a service and drop its copy in the remote machine.