Analysis by: Karl Dominguez
 PLATFORM:

Windows 2000, XP, Server 2003

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:

  • Threat Type: Trojan

  • Destructiveness: No

  • Encrypted: No

  • In the wild: Yes

  OVERVIEW

This Trojan may be dropped by other malware.

  TECHNICAL DETAILS

File Size: 8,174 bytes
File Type: VBS
Memory Resident: No
Initial Samples Received Date: 21 Jun 2011

Arrival Details

This Trojan may be dropped by the following malware:

  • TROJ_DROPPR.ECZ

NOTES:
Upon execution, VBS_WMIGHOST.ECZ writes malicious Windows Management Instrumentation (WMI) JScript that connects to a remote site to possibly download other malicious file(s) and execute arbitrary commands. Creating a WMI script effectively hides the malicious script from the user. VBS_WMIGHOST.ECZ then deletes itself and its dropper once its execution is completed.

It saves the malicious __EventConsumer as the following:

  • Microsoft WMI Comsumer Security Event_consumer

It creates the following __EventFilter, which is necessary for the created __EventConsumer to be registered as a permament event consumer. It also acts as an autostart mechanism for the malicious script:

  • Microsoft WMI Comsumer Security Event_filter

A __IntervalTimerInstruction with the following name is also created to run the event every 30 seconds:

  • Microsoft WMI Comsumer Security Event_WMITimer

A __FiltertoConsumerBinding class is then executed to relate the above-mentioned __EventConsumer to the __EventFilter.

The malicious script connects to the following URL to notify a remote user of an infection, download other files, and receive arbitrary commands.

  • http://{BLOCKED}itty.shop.co/count/{computer name}{MAC Address}_{malware-specified parameter}

However, as of this writing, the said site is inacessible.

For information regarding WMI, please refer to Microsoft MSDN page.

  SOLUTION

Minimum Scan Engine: 8.900

Step 1

For Windows XP and Windows Server 2003 users, before doing any scans, please make sure you disable System Restore to allow full scanning of your computer.

Step 2

Remove malware files dropped/downloaded by VBS_WMIGHOST.ECZ

    TROJ_DROPPR.ECZ

Step 3

Scan your computer with your Trend Micro product to delete files detected as VBS_WMIGHOST.ECZ. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.

NOTES:
Deleting Malicious Script

To delete the malicious script created by this malware using WMI Command-line Tool:

  1. Open a WMI command-line. To do this, click Start>Run, type WMIC in the text box provided, then press Enter.

  2. Type the following on the command-line tool and delete the malicious event consumer:
    /namespace:\\root\subscription PATH __EventConsumer delete

    Press Y and Enter when prompted to delete the following, press N and enter if other values are seen:
    \\{computer name}\\ROOT\subscription:ActiveScriptEventConsumer.Name="Microsoft WMI Comsumer Security Event_consumer"

  3. Type the following on the command-line tool and delete the event filter:
    /namespace:\\root\subscription PATH __EventFilter delete

    Press Y and Enter when prompted to delete the following, press N and enter if other values are seen: \\{computer name}\\ROOT\subscription:__EventFilter.Name="Microsoft WMI Comsumer Security Event_filter"

  4. Type the following on the command-line tool and delete the event timer instruction:
    /namespace:\\root\subscription PATH __TimerInstruction delete

    Press Y and Enter when prompted to delete the following, press N and enter if other values are seen: \\{computer name}\\ROOT\subscription:__TimerInstruction.TimerId="Microsoft WMI Comsumer Security Event_WMITimer"

  5. Type the following on the command-line tool and delete the FiltertoConsumerBinding:
    /namespace:\\root\subscription PATH __FilterToConsumerBinding delete

    Press Y and Enter when prompted to delete the following, press N and enter if other values are seen:
    \\{computer name}\\ROOT\subscription:__FilterToConsumerBinding.Consumer="\\\\.\\root\\subscription:ActiveScriptEventConsumer.Name="Microsoft WMI Comsumer Security Event_consumer\"",Filter="\\\\.\\root\\subscription:__EventFilter.Name="Microsoft WMI Comsumer Security Event_filter\""

  6. Type quit or exit to close the command-line tool.


Did this description help? Tell us how we did.

Related Malware