WORM_EMAIL.AT

June 18, 2013

ALIASES:

Backdoor:Win32/Rbot (Microsoft); W32/Ridnu.e (McAfee); W32.Miprinc@mm (Symantec); Email-Worm.Win32.Ridnu.e (Kaspersky); Trojan.Win32.Generic.pak!cobra (Sunbelt); Trojan horse Generic_r.PW (AVG)

PLATFORM:

Windows 2000, Windows XP, Windows Server 2003

OVERALL RISK RATING:

DAMAGE POTENTIAL:

DISTRIBUTION POTENTIAL:

REPORTED INFECTION:

Threat Type: Worm
Destructiveness: No
Encrypted:
In the wild: Yes

OVERVIEW

This worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It disables Task Manager, Registry Editor, and Folder Options.

TECHNICAL DETAILS

File Size: 752,596 bytes

File Type: EXE

Memory Resident: Yes

Initial Samples Received Date: 18 Jun 2013

Arrival Details

This worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This worm drops the following copies of itself into the affected system:

%System%\3IPA2.SMANSA.PKP.exe
%Windows%\services.exe
%Desktop%\Message For My Princess.txt
%Desktop%\Message For My Princess.scr
%Program Files%\Irma Triana.scr
%Program Files%\I_Miss_U_MyPrincess.scr
%Program Files%\Your_Prince_Will_Be_Waiting_For_You.scr
%Program Files%\May be Smansa was wonderful place to us.scr
%Program Files%\Common Files\Emira.Emma
%Program Files%\Common Files\Aliciana.Alisa
%System Root%\Penylethylamine.scr
%System Root%\Xenova.scr
e:\Penylethylamine.scr
e:\Xenova.scr
f:\Penylethylamine.scr
f:\Xenova.scr
g:\Penylethylamine.scr
g:\Xenova.scr
h:\Penylethylamine.scr
h:\Xenova.scr
i:\Penylethylamine.scr
i:\Xenova.scr
j:\Penylethylamine.scr
j:\Xenova.scr
k:\Penylethylamine.scr
k:\Xenova.scr
l:\Penylethylamine.scr
l:\Xenova.scr
m:\Penylethylamine.scr
m:\Xenova.scr
n:\Penylethylamine.scr
n:\Xenova.scr
o:\Penylethylamine.scr
o:\Xenova.scr
p:\Penylethylamine.scr
p:\Xenova.scr
q:\Penylethylamine.scr
q:\Xenova.scr
r:\Penylethylamine.scr
r:\Xenova.scr
s:\Penylethylamine.scr
s:\Xenova.scr
t:\Penylethylamine.scr
t:\Xenova.scr
u:\Penylethylamine.scr
u:\Xenova.scr
v:\Penylethylamine.scr
v:\Xenova.scr
w:\Penylethylamine.scr
w:\Xenova.scr
x:\Penylethylamine.scr
x:\Xenova.scr
y:\Penylethylamine.scr
y:\Xenova.scr
z:\Penylethylamine.scr
z:\Xenova.scr
%User Profile%\Local Settings\AKGNAB_UALUP.exe
%System%\xyjxpxs.exe
%Windows%//Negeri Serumpun Sebalai .pif .bat .com .scr .exe
%User Profile%\Local Settings\AKGNAB_UALUP.exe.FrontMission3
%System%\msvbvm60.dll
%User Profile%\Local Settings\Mr_CF_Mutation.SaveTheQueen
%User Profile%\Local Settings\puim.exe

It creates the following folders:

%User Profile%\Application Data\Mr_CF

(Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.)

Autostart Technique

This worm adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Alumni_Smoensa_Pangkalpinang = "Mr_CoolFace"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
My_Old_Class = "3IPA2.SMANSA.PKP.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
WindowsSecurityService = "%Windows%\services.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
pykmgri = "xyjxpxs.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Penylethylamine = "%Application Data%\Emma.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Paradiso_Perduto = "SMUNSA_PANGKALPINANG_BANGKA"

It modifies the following registry entries to ensure it automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Winlogon
Userinit = "%System%\userinit.exe, %System Root%\explorer.exe"

(Note: The default value data of the said registry entry is %Windows%\system32\userinit.exe,.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Winlogon
Shell = "explorer.exe %System Root%\explorer.exe"

(Note: The default value data of the said registry entry is Explorer.exe.)

Other System Modifications

This worm adds the following registry keys:

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Policies\
Explorer

HKEY_LOCAL_MACHINE\Software\Policies\
Microsoft\Windows NT\SystemRestore

It adds the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
CabinetState
FullPathAddress = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\policies\
Explorer
NoFind = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows NT\SystemRestore
DisableConfig = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows NT\SystemRestore
DisableSR = "1"

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Toolbar
BackBitmapShell = "%Windows%\Web\Wallpaper\Bliss.bmp"

It modifies the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced\Folder\Hidden\
NOHIDDEN
CheckedValue = "2"

(Note: The default value data of the said registry entry is 2.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced\Folder\Hidden\
NOHIDDEN
DefaultValue = "2"

(Note: The default value data of the said registry entry is 2.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced\Folder\Hidden\
SHOWALL
CheckedValue = "1"