WORM_UPATRE.A

This Worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

Arrival Details

This Worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Worm drops the following files:

• %ProgramData%\{GUID}\driver.dat
• %ProgramData%\WindowsAppCertification\WindowHelperStorageHostSystemThread.ps1
• %ProgramData%\WindowsAppCertification\checker.vbs
• %ProgramData%\WindowsAppCertification\cert.cmd
• %ProgramData%\MicrosoftCorporation\Windows\Helpers\SecurityHeaIthService.exe
• %ProgramData%\MicrosoftCorporation\Windows\Helpers\SystemldleProcess.exe
• %ProgramData%\MicrosoftCorporation\Windows\Helpers\winIogon.exe
• {Malware Path}\CreateShortcut.vbs
• %User Startup%\Isass.lnk
• %System%\Tasks\Windows_Antimalware_Host
• %System%\Tasks\Windows_Antimalware_Host_Systm

(Note: %ProgramData% is the Program Data folder, where it usually is C:\Program Files in Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\ProgramData in Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.. %User Startup% is the current user's Startup folder, which is usually C:\Documents and Settings\{user}\Start Menu\Programs\Startup on Windows 2000 and XP, and C:\Documents and Settings\{User name}\Start Menu\Programs\Startup on Windows Vista, 7, and 8.. %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

It drops the following copies of itself into the affected system:

• %ProgramData%\MicrosoftCorporation\Windows\System32\Isass.exe

(Note: %ProgramData% is the Program Data folder, where it usually is C:\Program Files in Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\ProgramData in Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It creates the following folders:

• %ProgramData%\MicrosoftCorporation
• %ProgramData%\WindowsAppCertification

(Note: %ProgramData% is the Program Data folder, where it usually is C:\Program Files in Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\ProgramData in Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

Autostart Technique

This Worm adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Windows_Antimalware_Host_Syst = %ProgramData%\MicrosoftCorporation\Windows\System32\Isass.exe

Propagation

This Worm drops the following copy(ies) of itself in all removable drives:

• {Removable Drive}\autorun.exe

It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

Download Routine

This Worm saves the files it downloads using the following names:

• %ProgramData%\{CB28D9D3-6B5D-4AFA-BA37-B4AFAABF70B8}\xmrig32.exe

(Note: %ProgramData% is the Program Data folder, where it usually is C:\Program Files in Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\ProgramData in Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

Other Details

This Worm connects to the following possibly malicious URL:

• http://{BLOCKED}.{BLOCKED}bsdfjh.pw