TROJ64_WHAIM.A

マルウェアは、他のマルウェアに作成され、コンピュータに侵入します。

侵入方法

マルウェアは、以下のマルウェアに作成され、コンピュータに侵入します。

• TROJ_WHAIM.A

インストール

マルウェアは、感染したコンピュータ内に以下のように自身のコピーを作成します。

• %System%\{random file name}.dll
  where {random file name} can be any of the following:
  • bddsvc.dll
  • iconsvc.dll
  • ehressvc.dll
  • netstsvc.dll
  • pnas.dll
  • pnrpmchname.dll
  • pwpsvc.dll
  • pcssvc.dll
  • rregconf.dll
  • scardmngsvc.dll
  • tcpmsvc.dll
  • tschmng.dll
  • mmthread.dll
  • wcmngsvc.dll
  • coladj.dll
  • wndmodmng.dll
  • timesyncsvc.dll
  • wiredconfsvc.dll
  • wlanconf.dll
  • wstmng.dll

(註：%System%フォルダは、システムフォルダで、いずれのオペレーティングシステム(OS)でも通常、"C:\Windows\System32" です。.)

自動実行方法

マルウェアは、作成されたコンポーネントをシステムサービスとして登録し、Windows起動時に自動実行されるよう以下のレジストリ値を追加します。

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{service name}
ImagePath = "%SystemRoot%\System32\svchost.exe -k {random service name}"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{service name}
DisplayName = "{display name}"
where {display name} can be any of the following:

• BitLocker Drive Decryption Service
• Internet Connection Service
• Media Center Service
• Network Storage Service
• Peer Networking Address
• PNRP Machine Name
• Power Policy
• Program Compatibility Service
• Remote Registry Configuration
• Smart Card Management Service
• Tablet PC Management Service
• Task Schedule Manager
• Thread Ordering Service
• WebClient Manage Service
• Windows Color Adjustment
• Windows Modules Management
• Windows Time Synchronization
• Wired Config Service
• WLAN Config Service
• Workstation management

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{service name}
Description = "{service description}"
where {service description} can be any of the following:

• BDESVC hosts the BitLocker Drive Decryption service.
• Provides network address translation, addressing, name resolution and/or intrusion prevention services for a home or small office network.
• Allows Media Center to locate and connect to the computer.
• This service delivers network notifications (e.
• Enables multi-party communication using Peer-to-Peer Connecting.
• This service publishes a machine name using the Peer Name Resolution Protocol.
• Manages power policy and power policy notification delivery.
• This service provides support for the Program Compatibility Assistant (PCA).
• Enables remote users to modify registry configurations on this computer.
• Manages access to smart cards read by this computer.
• Enables Tablet PC pen and ink functionality
• Enables a user to configure and schedule automated tasks on this computer.
• Provides ordered execution for a group of threads within a specific period of time.
• Enables Windows-based programs to create, access, and modify Internet-based files.
• The WcasPlugInService service hosts third-party Windows Color System color device model and gamut map model plug-in modules.
• Enables installation, modification, and removal of Windows updates and optional components.
• Maintains date and time synchronization on all clients and servers in the network.
• The Wired AutoConfig (DOT3SVC) service is responsible for performing IEEE 802.1X
• Creates and maintains client network connections to remote server using the SMB protocol

その他

{random file name}は、以下のいずれかとなる可能性があります。

• bddsvc.dll
• iconsvc.dll
• ehressvc.dll
• netstsvc.dll
• pnas.dll
• pnrpmchname.dll
• pwpsvc.dll
• pcssvc.dll
• rregconf.dll
• scardmngsvc.dll
• tcpmsvc.dll
• tschmng.dll
• mmthread.dll
• wcmngsvc.dll
• coladj.dll
• wndmodmng.dll
• timesyncsvc.dll
• wiredconfsvc.dll
• wlanconf.dll
• wstmng.dll

{display name}は、以下のいずれかとなる可能性があります。

• BitLocker Drive Decryption Service
• Internet Connection Service
• Media Center Service
• Network Storage Service
• Peer Networking Address
• PNRP Machine Name
• Power Policy
• Program Compatibility Service
• Remote Registry Configuration
• Smart Card Management Service
• Tablet PC Management Service
• Task Schedule Manager
• Thread Ordering Service
• WebClient Manage Service
• Windows Color Adjustment
• Windows Modules Management
• Windows Time Synchronization
• Wired Config Service
• WLAN Config Service
• Workstation management

{service description}は、以下のいずれかとなる可能性があります。

• BDESVC hosts the BitLocker Drive Decryption service.
• Provides network address translation, addressing, name resolution and/or intrusion prevention services for a home or small office network.
• Allows Media Center to locate and connect to the computer.
• This service delivers network notifications (e.
• Enables multi-party communication using Peer-to-Peer Connecting.
• This service publishes a machine name using the Peer Name Resolution Protocol.
• Manages power policy and power policy notification delivery.
• This service provides support for the Program Compatibility Assistant (PCA).
• Enables remote users to modify registry configurations on this computer.
• Manages access to smart cards read by this computer.
• Enables Tablet PC pen and ink functionality
• Enables a user to configure and schedule automated tasks on this computer.
• Provides ordered execution for a group of threads within a specific period of time.
• Enables Windows-based programs to create, access, and modify Internet-based files.
• The WcasPlugInService service hosts third-party Windows Color System color device model and gamut map model plug-in modules.
• Enables installation, modification, and removal of Windows updates and optional components.
• Maintains date and time synchronization on all clients and servers in the network.
• The Wired AutoConfig (DOT3SVC) service is responsible for performing IEEE 802.1X
• Creates and maintains client network connections to remote server using the SMB protocol

{service name}は、以下のいずれかとなる可能性があります。

• blockcom
• iconcom
• mcsvccom
• nssvccom
• pnacom
• pnrpcom
• ppolcom
• pcompcom
• rregcom
• scardcom
• tpcmcom
• tschcom
• mmthcom
• wcmngcom
• wndcolcom
• wndmodcom
• wndtimecom
• wconfcom
• wlanconfcom
• wstcom

マルウェアは、感染コンピュータの「マスター・ブート・レコード（MBR）」を上書きします。

このマルウェアは、コンピュータが64ビット版でオペレーティングシステム（OS）が Windows vistaまたはそれ以上の場合に、「TROJ_WHAIM.A」によって作成されます。