VBS_JENXCUS.YWL

This worm arrives via removable drives. It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This worm arrives via removable drives.

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This worm drops the following copies of itself into the affected system:

• %User Temp%\{malware filename}.vbs

(Note: %User Temp% is the user's temporary folder, where it usually is C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local\Temp on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

Autostart Technique

This worm adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
{malware filename} = "wscript.exe //B "%User Temp%\{malware filename}.vbs""

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
{malware filename} = "wscript.exe //B "%User Temp%\{malware filename}.vbs""

Other System Modifications

This worm adds the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\{malware filename}
(Default) = "{true or false} - {Date of execution}"

Propagation

This worm drops the following copy(ies) of itself in all removable drives:

• {drive letter}:\{malware filename}.vbs

Other Details

This worm connects to the following possibly malicious URL:

• medoutil.{BLOCKED}e.com

NOTES:

This malware creates .LNK (shortcut) files using folder names and file names found in removable drives. It then hides the original folders and files tricking users to click .LNK files. This .LNK files point out to a dropped copy of itself in the removable drive.