Trojan.W97M.JASCREX.BSUB

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

However, as of this writing, the said sites are inaccessible.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan adds the following folders:

• %System Root%\MyMusic

(Note: %System Root% is the Windows root folder, where it usually is C:\ on all Windows operating system versions.)

It drops the following files:

• %System Root%\MyMusic\presskey.cmd → executes %System Root%\MyMusic\presskey.jse
• %System Root%\MyMusic\presskey.jse → Detected as Worm.JS.JASCREX.B

(Note: %System Root% is the Windows root folder, where it usually is C:\ on all Windows operating system versions.)

It adds the following processes:

• cmd/T: /U /Q /C cd /D {Drive Letter}: && dir /b/s/x *.mpp *.vsdx *.odt *.ods *.odp *.odm *.odc *.odb *.wps *.xlk *.ppt *.pst *.dwg *.dxf *.dxg *.wpd *.doc *.xls *.pdf *.rtf *.txt *.pub >>%APPDATA%\flip.txt
• cmd/T: /U /Q /C copy /Y "{Malware File Directory}\{Malware File Name}" "{Name of the file it will replace}.jse" && del /Q/F "{Name of the file it will replace}"
• wscript /B /E:JScript "%Application Data%\{Random Numbers}.fop"
• cscript /B /E:JScript "%Application Data%\{Random Numbers}.fop"
• rundll32 "{Random Numbers}.com" Initialize

It displays the following fake error messages:

Download Routine

This Trojan connects to the following website(s) to download and execute a malicious file:

• https://{BLOCKED}.{BLOCKED}.152.55/2/1.php

It saves the files it downloads using the following names:

• %Application Data%\{Random Numbers}.fop
• %Application Data%\{Random Numbers}.edp
• %Application Data%\{Random Numbers}.com

Information Theft

This Trojan gathers the following data:

• Computer Name
• User Name
• User Domain

Other Details

This Trojan does the following:

• The document contains the following message details luring users to enable macro content:
  
• If the dropped script fails to download a file from its C&C Server, it locates for files with the following extensions in shared and removable drives, deletes the file and replaces the deleted file with a copy of itself:
  
  • .mpp
  • .vsdx
  • .odt
  • .ods
  • .odp
  • .odm
  • .odc
  • .odb
  • .wps
  • .xlk
  • .ppt
  • .pst
  • .dwg
  • .dxf
  • .dxg
  • .wpd
  • .doc
  • .xls
  • .pdf
  • .rtf
  • .txt
  • .pub

However, as of this writing, the said sites are inaccessible.