WORM_SOHANAD.AIL

This worm arrives by connecting affected removable drives to a system. It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It uses Windows Task Scheduler to create a scheduled task that executes the dropped copy.

It disables Task Manager, Registry Editor, and Folder Options.

It propagates via shared networks and drops copies of itself into available networks. It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

It executes the dropped file(s). As a result, malicious routines of the dropped files are exhibited on the affected system.

Arrival Details

This worm arrives by connecting affected removable drives to a system.

It may arrive via network shares.

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This worm drops the following copies of itself into the affected system:

• %Windows%\IEXPLOREi.exe
• %System%\IEXPLOREi.exe
• %System%\WORD.exe

(Note: %Windows% is the Windows folder, which is usually C:\Windows.. %System% is the Windows system folder, which is usually C:\Windows\System32.)

It uses Windows Task Scheduler to create a scheduled task that executes the dropped copy.

Autostart Technique

This worm adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Yahoo Messengger = "%System%\IEXPLOREi.exe"

It modifies the following registry entry(ies) to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Winlogon
Shell = "Explorer.exe IEXPLOREi.exe"

(Note: The default value data of the said registry entry is "Explorer.exe".)

The scheduled task executes the malware every:

• 9:00 AM

Other System Modifications

This worm adds the following registry keys:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\Schedule
AtTaskMaxHours = "0"

It modifies the following registry keys:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\Schedule
NextAtJobId = "2"

(Note: The default value data of the said registry entry is "1".)

It creates the following registry entry(ies) to disable Task Manager, Registry Tools and Folder Options:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
System
DisableTaskMgr = "1"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
System
DisableRegistryTools = "1"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
Explorer
NofolderOptions = "1"

It deletes the following registry keys:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Minimal\
{4D36E967-E325-11CE-BFC1-08002BE10318}

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Network\
{4D36E967-E325-11CE-BFC1-08002BE10318}

Propagation

This worm propagates via shared networks and drops copies of itself into available networks.

It drops the following copy(ies) of itself in all removable drives:

• {Drive}:\IEXPLOREi.exe
• {Drive}:\Bi mat.exe

It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

The said .INF file contains the following strings:

[Autorun]
Open=IEXPLOREi.exe
Shellexe cute=IEXPLOREi.exe
Shell\Open\command=IEXPLOREi.exe
Shell=Open

Dropping Routine

This worm drops the following files:

• %System%\dnssvr.dll - detected as BKDR_SMALLDOO.FL

(Note: %System% is the Windows system folder, which is usually C:\Windows\System32.)

It executes the dropped file(s). As a result, malicious routines of the dropped files are exhibited on the affected system.

NOTES:

It searches for folder inside the removable drives and drops a copy of itself using the following name:

• {Folder Name}.exe