arrow_back
search
close

WORM_DOWNAD

March 20, 2014
 ALIASES:

Conficker, Kido, Downadup, Downad

 PLATFORM:

Windows 2000, Widnows XP, Windows Server 2003

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:
 INFORMATION EXPOSURE:

  • Threat Type: Worm

  • Destructiveness: No

  • Encrypted:

  • In the wild: Yes

  OVERVIEW

Infection Channel:

Propagates via network shares, Propagates via software vulnerabilities, Propagates via removable drives

The first variant of the CONFICKER malware family was seen propagating via the MS08-067 Server service vulnerability back in 2008. Other variants after the first CONFICKER worm spread to other machines by dropping copies of itself in removable drives and network shares.

What makes CONFICKER notable is the fact that most of these worms are capable of generating hundreds of URLs that it connects to. It attempts to connect to a randomly-generated URL, which it created using its own domain-generation algorithm, to download additional files to infected systems.

Part of the difficulty of removing a CONFICKER infection is its capability to block access to security and antivirus-related websites. Also, the AUTORUN feature on Windows systems, which is enabled by default, allowed easy propagation and execution when a CONFICKER-infected USB is plugged in to a clean machine. To add to this, there was a significant number of machines that were not patched because of various reasons - some were revealed to be because of piracy, others were legacy systems running old programs that were only supported by older Windows operating systems.

The CONFICKER infection brought to light many security issues that were later actively addressed by updates in newer Windows operating systems. It also highlighted the need to patch and the need for better management of legacy systems, especially those systems that are hooked up to a company's network.

  TECHNICAL DETAILS

Memory Resident:

Yes

Payload:

Downloads files

Installation

This worm drops the following files:

  • {drive letter}:\autorun.inf

It drops the following copies of itself into the affected system:

  • %Application Data%\{random file name}.dll
  • %System%\{random file name}.dll
  • %System%\{random number}.tmp
  • %Program Files%\Internet Explorer\{random file name}.dll
  • %Program Files%\Movie Maker\{random file name}.dll
  • %User Temp%\{random file name}.dll
  • {drive letter}:\Recycler\{SID}\{random characters}.{random}

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.. %System% is the Windows system folder, which is usually C:\Windows\System32.. %Program Files% is the default Program Files folder, usually C:\Program Files in Windows 2000, Server 2003, and XP (32-bit), Vista (32-bit), and 7 (32-bit), or C:\Program Files (x86) in Windows XP (64-bit), Vista (64-bit), and 7 (64-bit).. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.)

It creates the following folders:

  • {drive letter}:\Recycler\{SID}

Autostart Technique

This worm registers itself as a system service to ensure its automatic execution at every system startup by adding the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\SvcHost\
{random characters}

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{random characters}
ImagePath = "%System Root%\system32\svchost.exe -k"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{random characters}\Parameters
ServiceDll = "%System%\{malware file name}"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{random service name}
Type = "1"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{random service name}
Start = "3"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{random service name}
ErrorControl = "0"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{random service name}
ImagePath = "%System%\{random number}.tmp"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{random service name}
DisplayName = "{random service name}"

It adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
{random characters} = "rundll32.exe {malware path and file name}, Parameter"

Other System Modifications

This worm adds the following registry entries as part of its installation routine:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Applets
dl = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Applets
ds = "0"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Applets
dl = "0"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Applets
ds = "0"

It modifies the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\Tcpip\Parameters
TcpNumConnections = "00FFFFFE"

(Note: The default value data of the said registry entry is user-defined.)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\BITS
Start = "4"

(Note: The default value data of the said registry entry is 2.)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\wuauserv
Start = "4"

(Note: The default value data of the said registry entry is 2.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced\Folder\Hidden\
SHOWALL
CheckedValue = "0"

(Note: The default value data of the said registry entry is 1.)

Download Routine

This worm connects to the following website(s) to download and execute a malicious file:

  • http://{DGA IP address}/search?q=0

Other Details

This worm connects to the following URL(s) to get the affected system's IP address:

  • http://www.getmyip.org
  • http://www.whatsmyipaddress.com
  • http://www.whatismyip.org
  • http://checkip.dyndns.org

It connects to the following time servers to determine the current date:

  • myspace.com
  • msn.com
  • ebay.com
  • cnn.com
  • aol.com
  • w3.org
  • ask.com
  • yahoo.com
  • google.com
  • baidu.com

  SOLUTION

Minimum Scan Engine:

8.900

VSAPI OPR PATTERN File:

7.733.00

VSAPI OPR PATTERN Date:

28 Dec 2010

NOTES:

Trend Micro OfficeScan users are also urged to use the following features to protect from WORM_DOWNAD malware:

Enabling Device Access Control

  1. Open the OfficeScan web console.
  2. In the left panel, click Networked Computers to expand its list of contents.
  3. Click Client Management to open the user interface found in the right panel.
  4. In the right panel, click Setting and choose Device Control Settings from the dropdown list.
  5. Click Enable Device Control then Block Autorun function on USB devices after setting your desired permissions.
  6. At the bottom of the window, click Apply to All Clients.

Enabling USB Autoscan

For Trend Micro OfficeScan 10.6 SP1 and later, enable this Trend Micro OfficeScan feature, please refer to the following eSupport page:

Enabling Scan Network Drive

  1. Still in the OfficeScan web console, in the left panel, click Networked Computers to expand its list of contents.
  2. Click Client Management to open user interface on the right panel.
  3. In the right panel, click Settings and select Scan Settings>Real-time Scan Settings.
  4. In Scan Settings, check Scan network drive.
  5. At the bottom of the window, click Apply to All Clients.

Enabling Web Reputation Service

  1. Still in the OfficeScan web console, in the left panel, click Networked Computers.
  2. Click Client Management to open user interface on the right panel.
  3. In the right panel, click Settings, then choose Web Reputation Settings from the dropdown list. This opens a new window where you can configure the Web Reputation service settings.
  4. Check Enable Web reputation policy on the following operation systems.
  5. At the bottom of the window, click Apply to All.

Enabling Firewall Feature

  1. Still in the OfficeScan web console, in the left panel, click Networked Computers.
  2. Click Client Management to open user interface on the right panel.
  3. In the right panel, click Settings, then choose Additional Service Settings from the dropdown list. This opens a new window where you can enable firewall service.
  4. Check Enable service ion the following operating systems.
  5. At the bottom of the window, click Apply to All Clients.

Trend Micro OfficeScan users may also install and configure the Intrusion Defense Firewall (IDF) plugin to further prevent WORM_DOWNAD infections.

Configuring IDF to Protect from DOWNAD infections

  1. Right-click Selected Computer Group>Actions>Deploy Client Plug-in(s).
  2. Create a Security Profile. Select Security Profiles in the IDF console. Right-click Windows Workstation Profile then select Duplicate. Then you may rename the Security Profile.
    Note: Skip this step if there is an existing IDF profile.
  3. Disable the IDF firewall to preserve the Officescan Firewall. In the Security Profile Window, select Firewall and uncheck Inherit. Then select Off.
  4. Enable corresponding IDF rules by doing the following:
    • Select Deep Packet Inspection and uncheck Inherit, then Select On and Prevent.

    • Under DPI rules, select IDS/IPS. In the upper right corner, type in CVE-2008-4250 and press Enter.

    • Wait for the relevant IDF rules to be found and check all IDF rules, then click Save.
  5. Assign the security profile to the select computer group by doing the following:
    • Right-click on Computer Group>Actions>Assign Security Profile.

    • Select the newly created Security Profile, then click OK.
  6. To check if the IDF plugin was properly configured, Select a machine inside the selected Computer Group. The expected status are the following: Managed (Online), Firewall: Off, DPI: Prevent, 4 rules.


Did this description help? Tell us how we did.