Worm.Win32.CONUSTR.AMZ

This Worm arrives via removable drives. It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This Worm arrives via removable drives.

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Worm drops the following copies of itself into the affected system and executes them:

• %User Temp%\conhost.exe

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It drops and executes the following files:

• %User Temp%\ppxxxx – contains registry data to be added to the machine
• %User Temp%\must.bat – contains commands used to gather information

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It adds the following processes:

• %User Temp%\conhost.exe
• regini.exe %User Temp%\ppxxxx
• cmd /c %User Temp%\must.bat
• net  user
• net  localgroup administrators
• net  start
• netstat  -ano
• tasklist  
• ipconfig  /all
• arp  -a
• systeminfo  
• net  use
• net  view
• net  view /domain
• net  user /domain
• %System%\xcopy.exe /d /c /i /h /r /y %User Temp%\WPDNSE\*.NLS {Removable Drive Letter}\RECYCLER\
• %System%\xcopy.exe /d /c /i /h /r /y %User Temp%\Media\*.ldf {Removable Drive Letter}\RECYCLER\
• %System%\xcopy.exe /d /c /i /h /r /y {Removable Drive Letter}\RECYCLER\*.NLS %User Temp%\WPDNSE\
• %Program Files%\winrar\rar.exe u -apC    -ed -tk -dh -hpThisTw0Piece -ta{Current Date} %User Temp%\WPDNSE\{Random}.NLS "%User Temp%\winword4.doc"
• %Program Files%\winrar\rar.exe u -apF -r -ed -tk -dh -sl5000000 -hpThisTw0Piece -ta{Current Date} %User Temp%\WPDNSE\{Random}.NLS {Available Fixed/Removable Drive Letter}\*.doc {Available Fixed/Removable Drive}\*.docx {Available Fixed/Removable Drive Letter}\*.pdf {Available Fixed/Removable Drive Letter}\*.mvd {Available Fixed/Removable Drive Letter}\*.tif {Available Fixed/Removable Drive}\*.xls {Available Fixed/Removable Drive Letter}\*.xlsx

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.. %Program Files% is the default Program Files folder, usually C:\Program Files in Windows 2000(32-bit), Server 2003(32-bit), XP, Vista(64-bit), 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit) , or C:\Program Files (x86) in Windows XP(64-bit), Vista(64-bit), 7(64-bit), 8(64-bit), 8.1(64-bit), 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It creates the following folders:

• {Removable Drive Letter}:\RECYCLER
• %User Temp%\WPDNSE

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

Other System Modifications

This Worm adds the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
exefile
NeverShowExt = ""

It modifies the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Windows NT\CurrentVersion\Windows
Load = "%User Temp%\conhost.exe"

(Note: The default value data of the said registry entry is "".)

Propagation

This Worm drops the following copies of itself in all physical and removable drives:

• {Removable Drive Letter}\{Existing Foldername}.exe
• {Removable Drive Letter}\RECYCLER\Dcfly.exe

Dropping Routine

This Worm drops the following files:

• %User Temp%\WPDNSE\{random filename}.NLS - password protected archive file containing gathered information
• {Removable Drive Letter}\RECYCLER\{random filename}.NLS

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

Information Theft

This Worm gathers the following data:

• System Date
• OS information
• List of user accounts
• List of administrator users
• Running Services
• Active TCP connections
• Running applications and services
• Full network configuration for all adapters
• Contents of the ARP cache
• System Information
• List of network connections
• List of computers in the current domain
• List all domains in the network
• List of all users of each domain
• List of files and directories of drives C:\, D:\, E:\, F:\, G:\, H:\, I:\
• SQL log files (.ldf) from %User Temp%\Media\
• Files in active root drives with the following extensions: .docx, .pdf, .mvd, .tif, .xls, .xlsx

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

Stolen Information

This Worm saves the stolen information in the following file:

• %User Temp%\winword4.doc

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

NOTES:
-This malware uses a folder icon to disguise itself. -It drops copies of itself using the original folder names in the removable drive. Then it hides the original folders to trick the users into clicking its dropped copy. -It uses the password "ThisTw0Piece" for the archive file it creates.