WORM_UTOTI.AAE

It drops several .CAB files in the Windows folder that contains a copy of itself.

It uses file names of popular games and applications as the file names of the said .CAB files. It then searches for folders in a specific directory and drops a copy using the name of folders found. It also searches for registry entries under a certain registry hive and replaces the registry data to enable execution in every system startup.

This worm arrives as an attachment to email messages spammed by other malware/grayware or malicious users. It may be downloaded by other malware/grayware/spyware from remote sites.

It uses the Windows Task Scheduler to add a scheduled task that executes the copies it drops.

It modifies registry entries to hide files with System and Read-only attributes.

It drops copies of itself into network drives. It drops copies of itself in all removable drives.

Arrival Details

This worm arrives as an attachment to email messages spammed by other malware/grayware or malicious users.

It may be downloaded by other malware/grayware/spyware from remote sites.

Installation

This worm drops the following copies of itself into the affected system:

• %System Root%\KHATRA.exe
• %Windows%\Xplorer.exe
• %Windows%\KHATARNAKH.exe
• %System%\KHATRA.exe
• %Windows%\system\gHost.exe
• %Application Data%\Microsoft\CD Burning\KHATRA.exe
• %Application Data%\Microsoft\CD Burning\winxp.exe
• %Application Data%\Microsoft\CD Burning\New Folder(3).exe

(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.. %Windows% is the Windows folder, which is usually C:\Windows or C:\WINNT.. %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.. %Application Data% is the current user's Application Data folder, which is usually C:\Windows\Profiles\{user name}\Application Data on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Application Data on Windows NT, and C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, XP, and Server 2003.)

It drops the following non-malicious file:

• %Windows%\inf\Autoplay.inF

(Note: %Windows% is the Windows folder, which is usually C:\Windows or C:\WINNT.)

It uses the Windows Task Scheduler to add a scheduled task that executes the copies it drops.

Autostart Technique

This worm adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\policies\
Explorer\Run
G_Host = %Windows%\System\gHost.exe /Reproduce

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Xplorer = ""%Windows%\Xplorer.exe" /Windows"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Winlogon
Taskman = "%System%\KHATRA.exe"

It modifies the following registry entries to ensure it automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows NT\CurrentVersion\Windows
load = "%System%\KHATRA.exe"

(Note: The default value data of the said registry entry is "".)

Other System Modifications

This worm adds the following registry entries as part of its installation routine:

HKEY_CURRENT_USER\Software\Nico Mak Computing\
WinZip\caution
NoUnsafeTypeCautionForSCR = "1"

HKEY_CURRENT_USER\Software\Nico Mak Computing\
WinZip\caution
NoUnsafeTypeCautionForEXE = "1"

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Main
Window Title = "Internet Exploiter"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
System
DisableRegistryTools = 1

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
Explorer
NoControlPanel = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Tracing\FWCFG
EnableFileTracing = 0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Tracing\FWCFG
EnableConsoleTracing = 0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Tracing\FWCFG
FileTracingMask = dword:ffff0000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Tracing\FWCFG
ConsoleTracingMask = ffff0000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Tracing\FWCFG
MaxFileSize = 00100000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\Schedule
AtTaskMaxHours = 0

It modifies the following registry key(s)/entry(ies) as part of its installation routine:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
Explorer
NoDriveTypeAutoRun = ff

(Note: The default value data of the said registry entry is 91.)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\mnmsrvc
Start = 2

(Note: The default value data of the said registry entry is 3.)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\NtmsSvc
Start = 2

(Note: The default value data of the said registry entry is 3.)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\ProtectedStorage
Start = 4

(Note: The default value data of the said registry entry is 2.)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\RDSessMgr
Start = 2

(Note: The default value data of the said registry entry is 3.)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\TermService
Start = 2

(Note: The default value data of the said registry entry is 3.)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\TlntSvr
Start = 2

(Note: The default value data of the said registry entry is 3.)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\upnphost
Start = 2

(Note: The default value data of the said registry entry is 3.)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\wscsvc
Start = 4

(Note: The default value data of the said registry entry is 2.)

It modifies the following registry entries to hide files with System and Read-only attributes:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
Hidden = 0

(Note: The default value data of the said registry entry is 1.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced\Folder\Hidden\
SHOWALL
CheckedValue = 0

(Note: The default value data of the said registry entry is 1.)

It creates the following registry entry(ies) to bypass Windows Firewall:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\AuthorizedApplications\
List
%System%\KHATRA.exe = "%System%\KHATRA.exe:*:Enabled:System"

Propagation

This worm drops copies of itself into network drives.

It drops copies of itself in all removable drives.

Other Details

This worm does the following:

• Drops several .CAB files in the Windows folder that contains a copy of itself.
• Uses file names of popular games and applications as the file names of the said .CAB files.
• Searches for folders in the directory %User Profile%\My Documents andand drops a copy using the name of folders found.
• Searches for registry entries under the following registry hive and replaces the registry data with "%System%\KHATRA.exe" to enable execution in every system startup:
  

  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

(Note: %User Profile% is the current user's profile folder, which is usually C:\Windows\Profiles\{user name} on Windows 98 and ME, C:\WINNT\Profiles\{user name} on Windows NT, and C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003.. %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)