WORM_FANNY.AA

This worm arrives via removable drives. It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It connects to certain websites to send and receive information.

Arrival Details

This worm arrives via removable drives.

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This worm drops the following component file(s):

• %System%\ECELP4.ACM (detected as TROJ_AGENT.IAAN)
• %System%\shelldoc.dll (to be detected as TROJ_FANNY.AA)
• %Windows%\msagent\AGENTCPD.DLL (to be detected as TROJ_FANNY.AB)

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.. %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.)

It drops and executes the following files:

• %User Temp%\msupdate.exe (to be detected as TROJ_FANNY.AC)

(Note: %User Temp% is the user's temporary folder, where it usually is C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local\Temp on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It adds the following processes:

• rundll32.exe

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• RPCMutex
• DirectMarketing

Other System Modifications

This worm adds the following registry keys:

HKEY_LOCAL_MACHINE\system\currentcontrolset\
control\MediaResources\acm\
ECELP4

HKEY_LOCAL_MACHINE\Software\Microsoft\
MSNetMng

It adds the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\MediaResources\acm\
ECELP4
DevNode = "0"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\MediaResources\acm\
ECELP4
Driver = "%System%\ECELP4.ACM"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\MediaResources\acm\
ECELP4
filter3 = "explorer#%System%\shelldoc.dll"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\MediaResources\acm\
ECELP4
filter2 = "winlogon#%Windows%\msagent\AGENTCPD.DLL"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
MSNetMng
Status = "{random values}"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
MSNetMng
COM = "{random values}"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
MSNetMng
Version = "{random values}"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
MSNetMng
Policy = "{random values}"

Propagation

This worm drops the following copy(ies) of itself in all removable drives:

• (drive letter):\fanny.bmp

Information Theft

This worm gathers the following data:

• OS Version
• Computer Name
• User Name
• List of Running Processes

Other Details

This worm connects to the following website to send and receive information:

• {BLOCKED}supplystore.mooo.com/ads/QueryRecord200586_f2ahx.html

NOTES:

It runs rundll32.exe to load the following DLL and the corresponding function

• %Windows%\MSAGENT\AGENTCPD.DLL _start@16 0

It searches all removable drives for the following files:

• {drive letter}:\fanny.bmp
• {drive letter}:\__d__.lnk
• {drive letter}:\__e__.lnk
• {drive letter}:\__f__.lnk
• {drive letter}:\__g__.lnk
• {drive letter}:\__h__.lnk
• {drive letter}:\__i__.lnk
• {drive letter}:\__j__.lnk

It saves the searched file(fanny.bmp) as the following filename:

• %System%\comhost.dll
• %System%\mscorwin.dll

It saves the searched LNK files into:

• %System%