WORM_BRONTOK.JM
Virus:Win32/Gael.A (Microsoft), W32.Rontokbro@mm (Symantec), W32/Rontokbro.gen@MM (McAfee), Email-Worm.Win32.Brontok.jj (Kaspersky)
Windows 2000, Windows XP, Windows Server 2003
Threat Type: Worm
Destructiveness: No
Encrypted:
In the wild: Yes
OVERVIEW
This worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
It uses Windows Task Scheduler to create a scheduled task that executes the dropped copy.
It modifies files, disabling programs and applications from properly running.
TECHNICAL DETAILS
Arrival Details
This worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
Installation
This worm drops the following copies of itself into the affected system:
- %Application Data%\smss.exe
- %Application Data%\services.exe
- %Application Data%\lsass.exe
- %Application Data%\inetinfo.exe
- %Application Data%\csrss.exe
- %Application Data%\winlogon.exe
- %System%\TEST'S SETTING.SCR
- %System%\drivers\etc\HOSTS-DENIED BY-TEST.COM
- %User Profile%\TEMPLATES\BARARONTOK.COM
- %Windows%\SHELLNEW\ElnorB.exe
(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Windows\Profiles\{user name}\Application Data on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Application Data on Windows NT, and C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, XP, and Server 2003.. %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.. %User Profile% is the current user's profile folder, which is usually C:\Windows\Profiles\{user name} on Windows 98 and ME, C:\WINNT\Profiles\{user name} on Windows NT, and C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003.. %Windows% is the Windows folder, which is usually C:\Windows or C:\WINNT.)
It drops the following files:
- %Application Data%\LISTHOST4.TXT
- %Application Data%\UPDATE.4.BRON.TOK.BIN
(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Windows\Profiles\{user name}\Application Data on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Application Data on Windows NT, and C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, XP, and Server 2003.)
It uses Windows Task Scheduler to create a scheduled task that executes the dropped copy.
It creates the following folders:
- %Application Data%\Bron.tok-4-19
(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Windows\Profiles\{user name}\Application Data on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Application Data on Windows NT, and C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, XP, and Server 2003.)
Autostart Technique
This worm adds the following registry entries to enable its automatic execution at every system startup:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Bron-Spizaetus = ""%Windows%\ShellNew\ElnorB.exe""
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Tok-Cirrhatus = ""%Application Data%\smss.exe""
It drops the following file(s) in the Windows User Startup folder to enable its automatic execution at every system startup:
- %User Startup%\Empty.pif
(Note: %User Startup% is the current user's Startup folder, which is usually C:\Windows\Profiles\{user name}\Start Menu\Programs\Startup on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Start Menu\Programs\Startup on Windows NT, and C:\Documents and Settings\{User name}\Start Menu\Programs\Startup.)
Other System Modifications
This worm modifies the following files:
- %System Root%\AUTOEXEC.BAT
(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.)
It adds the following registry entries:
HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Toolbar\ShellBrowser
{01E04581-4EEE-11D0-BFE9-00AA005B4383} = "{random values}"
HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Toolbar\Explorer
ITBarLayout = "{random values}"
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
System
DisableRegistryTools = "1"
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
System
DisableCMD = "0"
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
Explorer
NoFolderOptions = "1"
HKEY_CURRENT_USER\Software\Microsoft\
Windows\ShellNoRoam\Bags\
61\Shell
FolderType = "MyDocuments"
It modifies the following registry entries:
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
System
DisableRegistryTools = "1"
(Note: The default value data of the said registry entry is "0".)
It modifies the following registry entries to hide files with Hidden attributes:
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
Hidden = "0"
(Note: The default value data of the said registry entry is "1".)
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
HideFileExt = "1"
(Note: The default value data of the said registry entry is "0".)
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
ShowSuperHidden = "0"
(Note: The default value data of the said registry entry is "1".)
Other Details
This worm connects to the following possibly malicious URL:
- http://www.{BLOCKED}ies.com/sdotlobxp/BrontokInf4.txt
- http://www.{BLOCKED}ies.com/sdotlobxp/Host4.txt