WORM_VERCUSE.CV
Worm:Win32/Vercuser.A (Microsoft), Win32/Vercuser.A worm (ESET)
Windows 2000, Windows Server 2003, Windows XP (32-bit, 64-bit), Windows Vista (32-bit, 64-bit), Windows 7 (32-bit, 64-bit)
![](/vinfo/imgFiles/legend.jpg)
Threat Type: Worm
Destructiveness: No
Encrypted:
In the wild: Yes
OVERVIEW
This worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.
TECHNICAL DETAILS
Arrival Details
This worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
Installation
This worm drops the following files:
- %User Temp%\~temp~{random}iN.dat
- %User Temp%\~temp~{random}iN.dat
- %User Temp%\~temp~{random}~.tmp
- %Program Files%\Internet Explorer\ieinstal.dll
- %User Temp%\~DF{random}KB.tmp.exe
- User Temp%\~security~update~{random}.log
(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.. %Program Files% is the default Program Files folder, usually C:\Program Files in Windows 2000, Server 2003, and XP (32-bit), Vista (32-bit), and 7 (32-bit), or C:\Program Files (x86) in Windows XP (64-bit), Vista (64-bit), and 7 (64-bit).)
It drops the following copies of itself into the affected system:
- %Application Data%\Microsoft\Windows\~temp~{random}iN.exe
- %User Temp%\hsperfdata_temp\~temp~clear~{random}.exe
- %User Temp%\~temp~{random}iN.exe
- %User Temp%\hsperfdata_temp\~temp~clear~{random}.exe
- %Program Files%\Windows Defender\MSASCui.exe
- %Application Data%\Program Files\Windows Defender\MSASCui.exe
- %Program Files%\Internet Explorer\iexplore.exe
- %Application Data%\Program Files\Internet Explorer\iexplore.exe
(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.. %Program Files% is the default Program Files folder, usually C:\Program Files in Windows 2000, Server 2003, and XP (32-bit), Vista (32-bit), and 7 (32-bit), or C:\Program Files (x86) in Windows XP (64-bit), Vista (64-bit), and 7 (64-bit).)
Autostart Technique
This worm adds the following registry entries to enable its automatic execution at every system startup:
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\RunOnce
ClearTemp = "%User Temp%\hsperfdata_temp\~temp~clear~{random}.exe"
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\RunOnce
ClearTemp = "%User Temp%\hsperfdata_temp\~temp~clear~{random}.exe"
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\RunOnce
Windows Defender = "%Program Files%\Windows Defender\MSASCui.exe"
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Windows Defender = %Program Files%\Windows Defender\MSASCui.exe
It drops the following shortcut pointing to its copy in the User Startup folder to enable its automatic execution at every system startup:
- Windows Defender.lnk
- Internet Security.lnk
It drops the following file(s) in the Windows Common Startup folder to enable its automatic execution at every system startup:
- Windows Defender.lnk
- Internet Security.lnk
Other System Modifications
This worm adds the following registry entries:
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings
GlobalUserOffline = "0"
HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer
WaitDir = "{pre-defined directory}"
HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer
Lastupdate = "{malware-defined value}"
HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer
DownDir = "{pre-defined directory}"
HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer
SecurityKey = "{malware-defined value}"
HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer
iSecurityCheck = "{random value}"
HKEY_LOCAL_MACHINE\Software\Microsoft\
Internet Explorer
SecurityKey = "{malware-defined value}"
HKEY_LOCAL_MACHINE\Software\Microsoft\
Internet Explorer
iSecurityCheck = "{random value}"
It modifies the following registry entries:
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
Hidden = "2"
(Note: The default value data of the said registry entry is 1.)
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
HideFileExt = "1"
(Note: The default value data of the said registry entry is 0.)
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
ShowSuperHidden = "0"
(Note: The default value data of the said registry entry is 1.)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced\Folder\Hidden\
NOHIDDEN
DefaultValue = "2"
(Note: The default value data of the said registry entry is {User's default value}.)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced\Folder\Hidden\
NOHIDDEN
CheckedValue = "2"
(Note: The default value data of the said registry entry is {User's default value}.)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced\Folder\Hidden\
SHOWALL
CheckedValue = "1"
(Note: The default value data of the said registry entry is {User's default value}.)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced\Folder\Hidden\
SHOWALL
DefaultValue = "2"
(Note: The default value data of the said registry entry is {User's default value}.)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced\Folder\SuperHidden
CheckedValue = "0"
(Note: The default value data of the said registry entry is {User's default value}.)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced\Folder\SuperHidden
DefaultValue = "0"
(Note: The default value data of the said registry entry is {User's default value}.)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced\Folder\SuperHidden
UncheckedValue = "0"
(Note: The default value data of the said registry entry is 1.)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced\Folder\HideFileExt
DefaultValue = "1"
(Note: The default value data of the said registry entry is {User's default value}.)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced\Folder\HideFileExt
CheckedValue = "1"
(Note: The default value data of the said registry entry is {User's default value}.)
HKEY_CURRENT_USER\Software\Microsoft\
Internet Connection Wizard
Completed = "01000000"
(Note: The default value data of the said registry entry is {System's defined value}.)
HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Main
Check_Associations = "no"
(Note: The default value data of the said registry entry is {User's default value}.)
Propagation
This worm creates the following folders in all removable drives:
- {drive letter}:\USB
- {drive letter}:\USB\Data
It drops the following copy(ies) of itself in all removable drives:
- {drive letter}:\NewFolder.exe
- {drive letter}:\USB\Data\SecureDrive.exe
It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.
Dropping Routine
This worm drops the following files:
- {removable drive}:\USB\Desktop.ini