Worm.VBS.DUNIHI.AAYSYU

This Worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes commands from a remote malicious user, effectively compromising the affected system.

It gathers certain information on the affected computer.

Arrival Details

This Worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Worm adds the following folders:

• {Infected Removable Drive Letter}:\KaeQrnvNzZ

It drops the following files:

• %User Temp%\eco\{Malware File Name}.vbs
• %User Temp%\eco\svchost.exe
• %User Startup%\{Malware File Name}.vbs
• {Infected Removable Drive Letter}:\KaeQrnvNzZ\{Malware Name}.vbs → attributes set to System & Hidden

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %User Startup% is the current user's Startup folder, which is usually C:\Windows\Profiles\{user name}\Start Menu\Programs\Startup on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Start Menu\Programs\Startup on Windows NT, C:\Documents and Settings\{User name}\Start Menu\Programs\Startup on Windows 2003(32-bit), XP and 2000(32-bit), or C:\Users\{user name}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit), 10(64-bit).)

It adds the following processes:

• "%User Temp%\eco\svchost.exe" //B "%User Temp%\eco\{Malware File Name}.vbs"

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

Autostart Technique

This Worm adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
{Malware File Name} = %User Temp%\eco\svchost.exe //B "%User Temp%\eco\{Malware File Name}.vbs"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
{Malware File Name} = %User Temp%\eco\svchost.exe //B "%User Temp%\eco\{Malware File Name}.vbs"

Other System Modifications

This Worm adds the following registry entries:

HKLM\SOFTWARE\{Malware File Name}
(Default) = false - {Malware Execution Date}

Backdoor Routine

This Worm executes the following commands from a remote malicious user:

• "execute" - Executes arbitrary command from the C&C server
• "update" - Updates malware code and restart the malware
• "uninstall" - Uninstalls the malware
• "send" - Downloads a file from the C&C server, saves it in a specified directory and run it
• "site-send" - Downloads a file from the C&C server and run it
• "recv" - Sends a file from a specified URL to the C&C server
• "enum-driver " - Retrieves list of drives
• "enum-faf" - Retrieves information about files and folders in a specified directory
• "enum-process" - Retrieves information about running processes
• "cmd-shell" - Executes a command using Command Prompt and retrieves its output
• "delete" - Deletes a file or folder
• "exit-process" - Forcefully terminates a process and all its children
• "sleep" - Running script sleeps for a specified amount of time

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• http://{BLOCKED}n.twilightparadox.com:1186/is-ready

Information Theft

This Worm gathers the following information on the affected computer:

• Computer Name
• Username
• OS Information
• Volume Serial Number
• Every Antivirus Installed in System
• USB spreading report

Other Details

This Worm adds the following registry keys:

HKLM\SOFTWARE\{Malware File Name}

It does the following:

• It sets the attributes of non-LNK files and folders in the infected drive to System & Hidden