WORM_SOHANAD.YTL

This worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Other System Modifications

This worm deletes the following files:

• %Temporary Internet Files%\Content.IE5\09RWHJQN\desktop.ini
• %Temporary Internet Files%\Content.IE5\BVLBNMKH\desktop.ini
• %Temporary Internet Files%\Content.IE5\desktop.ini
• %Temporary Internet Files%\Content.IE5\index.dat
• %Temporary Internet Files%\Content.IE5\ZDGZNKA5\desktop.ini
• %Temporary Internet Files%\Content.IE5\ZSGKJKO6\desktop.ini

(Note: %Temporary Internet Files% is the Temporary Internet Files folder, where it usually is C:\Documents and Settings\{user name}\Local Settings\Temporary Internet Files on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local\Microsoft\Windows\Temporary Internet Files on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), and Windows Server 2008; C:\Users\{user name}\AppData\Local\Microsoft\Windows\INetCache on Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), and Windows Server 2012.)

It deletes the following folders:

• %Temporary Internet Files%\Content.IE5\09RWHJQN
• %Temporary Internet Files%\Content.IE5\BVLBNMKH
• %Temporary Internet Files%\Content.IE5\ZDGZNKA5
• %Temporary Internet Files%\Content.IE5\ZSGKJKO6
• %Temporary Internet Files%\Content.IE5
• %User Profile%\Temporary Internet Files\Content.IE5
• %Application Data%\360Chrome\Chrome\User Data\Default\CacheIE\Content.IE5
• %Application Data%\liebao\User Data\iecache\Content.IE5

(Note: %Temporary Internet Files% is the Temporary Internet Files folder, where it usually is C:\Documents and Settings\{user name}\Local Settings\Temporary Internet Files on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local\Microsoft\Windows\Temporary Internet Files on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), and Windows Server 2008; C:\Users\{user name}\AppData\Local\Microsoft\Windows\INetCache on Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), and Windows Server 2012.. %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.. %Application Data% is the Application Data folder, where it usually is C:\Documents and Settings\{user name}\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It adds the following registry keys:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Internet Explorer\Control Panel

It adds the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Internet Explorer\Control Panel
DisableDeleteBrowsingHistory = "1"

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Main
TabProcGrowth = "0"

It deletes the following registry keys:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Internet Explorer\Extensions\{FB5F1910-F110-11d2-BB9E-00C04F795683}

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\DProEx\Security

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\DProEx\Enum

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\DProEx

Dropping Routine

This worm drops the following files:

• %Windows%\Btde.dll
• %Windows%\run.bat
• %System Root%\DProEx.sys

(Note: %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.. %System Root% is the Windows root folder, where it usually is C:\ on all Windows operating system versions.)

This report is generated via an automated analysis system.