WORM_DOWNAD.BP

This worm arrives via removable drives. It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

It does not have any backdoor routine.

Arrival Details

This worm arrives via removable drives.

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This worm drops the following component file(s):

• %System%\{random number}.tmp - detected as TROJ_DOWNAD.E

(Note: %System% is the Windows system folder, which is usually C:\Windows\System32.)

It drops the following copies of itself into the affected system:

• %System%\{random file name}.dll

(Note: %System% is the Windows system folder, which is usually C:\Windows\System32.)

Autostart Technique

This worm registers itself as a system service to ensure its automatic execution at every system startup by adding the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{random characters 1}
DisplayName = "{random}"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{random characters 1}
Type = "32"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{random characters 1}
Start = "2"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{random characters 1}
ErrorControl = "0"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{random characters 1}
ObjectName = "LocalSystem"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{random characters 1}
Description = "{long sentences}"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{random characters 1}
ImagePath = "%System Root%\system32\svchost.exe -k netsvcs"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{random characters 1}\Parameters
ServiceDll = %System%\{random file name}.dll

It registers its dropped component as a system service to ensure its automatic execution at every system startup. It does this by creating the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{random characters 2}
DisplayName = "{random}"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{random characters 2}
Type = "1"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{random characters 2}
Start = "3"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{random characters 2}
ErrorControl = "0"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{random characters 2}
ImagePath = "%System%\{random number}.tmp"

Other System Modifications

This worm adds the following registry keys:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{random characters 1}

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{random characters 2}

It modifies the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
Hidden = "2"

(Note: The default value data of the said registry entry is "1".)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
SuperHidden = "0"

(Note: The default value data of the said registry entry is "1".)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced\Folder\Hidden\
SHOWALL
CheckedValue = "0"

(Note: The default value data of the said registry entry is "1".)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\BITS
Start = "4"

(Note: The default value data of the said registry entry is "2".)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\wuauserv
Start = "4"

(Note: The default value data of the said registry entry is "2".)

It creates the following registry entry(ies) to bypass Windows Firewall:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\GloballyOpenPorts\
List
{random port number}:TCP = "{random port number}:TCP:*:Enabled:{random value}"

Propagation

This worm creates the following folders in all removable drives:

• {removable drive letter}:\RECYCLER
• {removable drive letter}:\RECYCLER\{SID}

It drops the following copy(ies) of itself in all removable drives:

• {removable drive letter}:\RECYCLER\{SID}\jwgkvsq.vmx

It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

The said .INF file contains the following strings:

;{garbage characters}
[AUTorUN
;{garbage characters}
AcTION=Open folder to view files
;{garbage characters}
icon=%syStEmrOot%\sySTEM32\sHELL32.Dll ,4
;{garbage characters}
shelLExECUte=RuNdLl32.EXE .\RECYCLER\{SID}\jwgkvsq.vmx,ahaezedrn
;{garbage characters}

Backdoor Routine

This worm does not have any backdoor routine.

Other Details

This worm connects to the following time servers to determine the current date:

• http://www.w3.org

NOTES:

This worm uses the following lists of user names and passwords to access password-protected shared files:

• 99999999
• 9999999
• 999999
• 99999
• 88888888
• 8888888
• 888888
• 88888
• 77777777
• 7777777
• 777777
• 77777
• 66666666
• 6666666
• 666666
• 66666
• 55555555
• 5555555
• 555555
• 55555
• 44444444
• 4444444
• 444444
• 44444
• 33333333
• 3333333
• 333333
• 33333
• 22222222
• 2222222
• 222222
• 22222
• 11111111
• 1111111
• 111111
• 11111
• 00000000
• 0000000
• 00000
• 0987654321
• 987654321
• 87654321
• 7654321
• 654321
• 54321
• zzzzz
• xxxxx
• qqqqq
• aaaaa
• intranet
• controller
• killer
• games
• private
• market
• coffee
• cookie
• forever
• freedom
• student
• account
• academia
• files
• windows
• monitor
• unknown
• anything
• letitbe
• letmein
• domain
• access
• money
• campus
• explorer
• exchange
• customer
• cluster
• nobody
• codeword
• codename
• changeme
• desktop
• security
• secure
• public
• system
• shadow
• office
• supervisor
• superuser
• share
• super
• secret
• server
• computer
• owner
• backup
• database
• lotus
• oracle
• business
• manager
• temporary
• ihavenopass
• nothing
• nopassword
• nopass
• Internet
• internet
• example
• sample
• love123
• boss123
• work123
• home123
• mypc123
• temp123
• test123
• qwe123
• abc123
• pw123
• root123
• pass123
• pass12
• pass1
• admin123
• admin12
• admin1
• password123
• password12
• password1
• default
• foobar
• foofoo
• temptemp
• testtest
• rootroot
• adminadmin
• mypassword
• mypass
• Login
• login
• Password
• password
• passwd
• zxcvbn
• zxcvb
• zxccxz
• zxcxz
• qazwsxedc
• qazwsx
• q1w2e3
• qweasdzxc
• asdfgh
• asdzxc
• asddsa
• asdsa
• qweasd
• qwerty
• qweewq
• qwewq
• nimda
• administrator
• Admin
• admin
• a1b2c3
• 1q2w3e
• 1234qwer
• 1234abcd
• 123asd
• 123qwe
• 123abc
• 123321
• 12321
• 123123
• 1234567890
• 123456789
• 12345678
• 1234567
• 123456
• 12345

This worm connects to the following URL to get the affected system's IP address and to check for an internet connection:

• http://www.{BLOCKED}p.org
• http://www.whatsmyipaddress.com
• http://www.whatismyip.org
• http://checkip.dyndns.org

Upon execution, it opens a window which displays the files under the malware path's root drive to hide its malicious routines from the user.

It modifies its file attributes to Read-only, Hidden and System after execution.

It generates strings and appends the following extensions to create URLs based on the current date:

• .biz
• .info
• .org
• .net
• .com
• .ws
• .cn
• .cc

It checks if any of the generated URLs is active and creates a thread to download and execute files. This routine also converts the host name to an IP address to complete the following URL:

• http://{IP address}/search?q=11

It prevents users from visiting antivirus-related websites that contain the following strings:

• ahnlab
• arcabit
• avast
• avg
• avira
• avp
• bit9.
• castlecops
• centralcommand
• clamav
• comodo
• computerassociates
• cpsecure
• defender
• drweb
• emsisoft
• esafe
• eset
• etrust
• ewido
• f-prot
• f-secure
• fortinet
• gdata
• grisoft
• hacksoft
• hauri
• ikarus
• jotti
• k7computing
• kaspersky
• malware
• mcafee
• microsoft
• networkassociates
• nod32
• norman
• norton
• panda
• pctools
• prevx
• quickheal
• rising
• rootkit
• sans.
• securecomputing
• sophos
• spamhaus
• spyware
• sunbelt
• symantec
• threatexpert
• trendmicro
• virus
• wilderssecurity
• windowsupdate

It exploits the following software vulnerabilities to propagate to other computers across a network:

• Vulnerability in Microsoft's Server service

Patches TCPIP.SYS in memory in order to modify the limit of maximum TCP half-connection attempts in systems running Windows XP Service Pack 2. It does this by loading TCPIP.SYS in a certain memory location. It then drops %System%\0{random number}.tmp, which is responsible for creating a device object named TcpIp_Perf and linking it to the loaded TCPIP.SYS in memory. It then sends the control code (patch code) to the linked device object.

Exports functions used by other malware. It sets the creation time of the file similar to that of the creation time indicated in the legitimate Windows file KERNEL32.DLL, which is also located in the Windows system folder. It does this to prevent early detection as a newly added file on the affected system.

Executes the following commands to disable auto-tuning if the system is running under Windows Vista:

• netsh interface tcp set global autotuning=disabled

Propagates by taking advantage of a vulnerability discovered in certain Microsoft operating systems that could allow remote code execution if an affected system received a specially crafted RPC request, which also contains a shellcode. More information on the said vulnerability can be found in this Microsoft Web page:

• Microsoft Security Bulletin MS08-067

Once this specially crafted RPC request reaches its target vulnerable system, the shellcode is decrypted, and then retrieves certain APIs capable of downloading a copy of the worm from the affected system, which is already converted into an HTTP server. The affected system then opens a random TCP port, allowing the vulnerable machine to connect to itself using the following URL:

• http://{IP address of the affected machine}:{random port generated by this worm}/{malware file name composed of random characters}

Propagating over the Internet by attempting to send the exploit code to random Internet addresses. It first broadcasts the opened random port that serves as an HTTP server so that it is accessible over the Internet. Then, it gets the external IP address of the system to check if it has a direct connection to the Internet. Once a direct connection is made, it launches the exploit code over the Internet by checking the external IP address and the configured IP address in the ethernet or modem driver.

Drops a copy of itself in the Admin$\System32 folder using a randomly named file using the credentials of the compromised user once it gains access. Upon successful network propagation, a scheduled task is created in the %Windows%\Tasks folder using the NetScheduleJobAdd API to be able to execute its dropped copy. The scheduled time of execution on the created job file is retrieved from GetLocalTime API.

Generates a set of URLs containing 250 random sites per day based on the UTC time standard.

Checks if any of the generated URLs is active and creates a thread to download and execute files. This routine also converts the host name to an IP address to complete the following URL:

• http://{IP address}/search?q=0

Hooks the following APIs to filter a list of antivirus-related sites when being accessed on the Internet:

• DnsQuery_A
• DnsQuery_UTF8
• Query_Main