Worm.Win32.BRONTOK.D

January 30, 2020

Analysis by: Patrick Noel Collado

ALIASES:

Worm:Win32/Ludbaruma.A [non_writable_container](Microsoft); HEUR:Trojan.Win32.Generic (Kaspersky)

PLATFORM:

Windows

OVERALL RISK RATING:

DAMAGE POTENTIAL:

DISTRIBUTION POTENTIAL:

REPORTED INFECTION:

INFORMATION EXPOSURE:

Threat Type: Worm
Destructiveness: No
Encrypted:
In the wild: Yes

OVERVIEW

This Worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It employs registry shell spawning by adding certain registry entries. This allows this malware to execute even when other applications are opened.

It modifies certain registry entries to disable Security Center functions. Doing this allows this malware to execute its routines without being detected. It disables Task Manager, Registry Editor, and Folder Options.

TECHNICAL DETAILS

File Size:

66,809 bytes

File Type:

EXE

Initial Samples Received Date:

12 Aug 2019

Arrival Details

This Worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Worm drops and executes the following files:

%Windows%\nEwb0Rn.exe
%System32%\WishfulThinking.exe
%AppDataLocal%\WINDOWS\WINLOGON.EXE
%AppDataLocal%\WINDOWS\SERVICES.EXE

(Note: %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.. %AppDataLocal% is the Local Application Data folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It drops the following copies of itself into the affected system:

%AppDataLocal%\winlogon.exe

(Note: %AppDataLocal% is the Local Application Data folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It creates the following folders:

%AppDataLocal%\WINDOWS
%Drive Letter%\nEwb0Rn

Autostart Technique

This Worm adds the following registry entries to enable its automatic execution at every system startup:

HKCU\Software\Microsoft\
Windows\CurrentVersion\Run
nEwb0Rn = %Windows%\nEwb0Rn.exe

HKLM\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
n3wb012n{Computer Name} = %AppDataLocal%\WINDOWS\WINLOGON.EXE

HKLM\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
n210bw3n = %AppDataLocal%\WINDOWS\SERVICES.EXE

HKLM\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Winlogon
Shell = Explorer.exe "%System32%\WishfulThinking.exe"

(Note: The default value data of the said registry entry is Explorer.exe.)

HKLM\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Winlogon
Userinit = %System32%\userinit.exe,%System32%\WishfulThinking.exe

(Note: The default value data of the said registry entry is %System32%\userinit.exe.)

It employs registry shell spawning to ensure its execution when certain file types are accessed by adding the following entries:

HKLM\SOFTWARE\Classes\
exefile\shell\open\
command
(Default) = "%System32%\JawsOfLife.exe" "%1" %*