Worm.VBS.DUNIHI.NBJ

This Worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes commands from a remote malicious user, effectively compromising the affected system. However, as of this writing, the said sites are inaccessible.

Arrival Details

This Worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Worm drops the following copies of itself into the affected system and executes them:

• %User Temp%\{Malware File Name}.vbs

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It adds the following processes:

• %System%\wscript.exe //B "%User Temp%\{Malware File Name}.vbs"

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

Autostart Technique

This Worm adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
{Malware File Name} = wscript.exe //B "%User Temp%\{Malware File Name}.vbs"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
{Malware File Name} = wscript.exe //B "%User Temp%\{Malware File Name}.vbs"

It drops the following file(s) in the Windows User Startup folder to enable its automatic execution at every system startup:

• %User Startup%\{Malware File Name}.vbs

(Note: %User Startup% is the current user's Startup folder, which is usually C:\Windows\Profiles\{user name}\Start Menu\Programs\Startup on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Start Menu\Programs\Startup on Windows NT, C:\Documents and Settings\{User name}\Start Menu\Programs\Startup on Windows 2003(32-bit), XP and 2000(32-bit), or C:\Users\{user name}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit), 10(64-bit).)

Other System Modifications

This Worm adds the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\{Malware File Name}
(Default) = {true or false} - {Date of first execution on the system}

Propagation

This Worm drops the following copy(ies) of itself in all removable drives:

• {Drive Letter}:\{Malware File Name}.vbs → attributes set to System & Hidden

It creates shortcut files (.LNK) disguised as folders or files located on the affected drives pointing to the malware copy.

Backdoor Routine

This Worm executes the following commands from a remote malicious user:

• "execute" → Executes arbitrary command from the C&C server
• "update" → Updates malware code and restart the malware
• "uninstall" → Uninstalls the malware
• "send" → Downloads a file from the C&C server, saves it in a specified directory and run it
• "site-send" → Downloads a file from the C&C server and run it
• "recv" → Sends a file from a specified URL to the C&C server
• "enum-driver " → Retrieves list of drives
• "enum-faf" → Retrieves information about files and folders in a specified directory
• "enum-process" → Retrieves information about running processes
• "cmd-shell" → Executes a command using Command Prompt and retrieves its output
• "delete" → Deletes a file or folder
• "exit-process" → Forcefully terminates a process and all its children
• "sleep" → Running script sleeps for a specified amount of time

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• http://{BLOCKED}ip.biz:82/

However, as of this writing, the said sites are inaccessible.

Rootkit Capabilities

This Worm does not have rootkit capabilities.

Information Theft

This Worm gathers the following data:

• Computer name
• Username
• OS name
• Volume serial number
• Antivirus programs installed in the system

Other Details

This Worm adds the following registry keys:

HKEY_LOCAL_MACHINE\SOFTWARE\{Malware File Name}

It does the following:

• It sets the attributes of non-LNK files and folders in the infected drive to System & Hidden

It does not exploit any vulnerability.