Analysis by: Jennifer Gumban
ALIASES:

Worm:Win32/VB.WJ (Microsoft), W32/Autorun.worm.c (McAfee)

 PLATFORM:

Windows 2000, Windows Server 2003, Windows XP (32-bit, 64-bit), Windows Vista (32-bit, 64-bit), Windows 7 (32-bit, 64-bit)

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:
 INFORMATION EXPOSURE:

  • Threat Type: Worm

  • Destructiveness: No

  • Encrypted:

  • In the wild: Yes

  OVERVIEW

This worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It modifies certain registry entries to hide file extensions.

It drops copies of itself into all the physical drives of an affected system. It drops copies of itself in removable drives. These dropped copies use the names of the folders located on the said drives for their file names.

It modifies the Internet Explorer Zone Settings.

  TECHNICAL DETAILS

File Size: 540,672 bytes
File Type: EXE
Initial Samples Received Date: 13 Aug 2013

Arrival Details

This worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Autostart Technique

This worm adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
"(Default Value)" = "%SystemRoot%\{Random Numbers}-.exe"

Other System Modifications

This worm adds the following registry keys:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes
exefile =

It adds the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\ShellNoRoam\MUICache\
C:\WINDOWS
{Random Name}.exe = "{Random Name}"

It modifies the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
Hidden = "0"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
ShowSuperHidden = "0"

(Note: The default value data of the said registry entry is "1".)

It modifies the following registry entries to hide file extensions:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
HideFileExt = "1"

(Note: The default value data of the said registry entry is "0".)

Propagation

This worm drops copies of itself into all the physical drives of an affected system.

It drops copies of itself in removable drives. These dropped copies use the names of the folders located on the said drives for their file names.

Web Browser Home Page and Search Page Modification

This worm modifies the Internet Explorer Zone Settings.

NOTES:

It drops copies of itself into all the physical drives as {Random Value}.exe.