WORM_VERCUSE.CV

January 23, 2014

Analysis by: Anthony Joe Melgarejo

ALIASES:

Worm:Win32/Vercuser.A (Microsoft), Win32/Vercuser.A worm (ESET)

PLATFORM:

Windows 2000, Windows Server 2003, Windows XP (32-bit, 64-bit), Windows Vista (32-bit, 64-bit), Windows 7 (32-bit, 64-bit)

OVERALL RISK RATING:

DAMAGE POTENTIAL:

DISTRIBUTION POTENTIAL:

REPORTED INFECTION:

INFORMATION EXPOSURE:

Threat Type: Worm
Destructiveness: No
Encrypted:
In the wild: Yes

OVERVIEW

This worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

TECHNICAL DETAILS

File Size:

499,069 bytes

File Type:

EXE

Initial Samples Received Date:

07 May 2013

Arrival Details

This worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This worm drops the following files:

%User Temp%\~temp~{random}iN.dat
%User Temp%\~temp~{random}iN.dat
%User Temp%\~temp~{random}~.tmp
%Program Files%\Internet Explorer\ieinstal.dll
%User Temp%\~DF{random}KB.tmp.exe
User Temp%\~security~update~{random}.log

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.. %Program Files% is the default Program Files folder, usually C:\Program Files in Windows 2000, Server 2003, and XP (32-bit), Vista (32-bit), and 7 (32-bit), or C:\Program Files (x86) in Windows XP (64-bit), Vista (64-bit), and 7 (64-bit).)

It drops the following copies of itself into the affected system:

%Application Data%\Microsoft\Windows\~temp~{random}iN.exe
%User Temp%\hsperfdata_temp\~temp~clear~{random}.exe
%User Temp%\~temp~{random}iN.exe
%User Temp%\hsperfdata_temp\~temp~clear~{random}.exe
%Program Files%\Windows Defender\MSASCui.exe
%Application Data%\Program Files\Windows Defender\MSASCui.exe
%Program Files%\Internet Explorer\iexplore.exe
%Application Data%\Program Files\Internet Explorer\iexplore.exe

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.. %Program Files% is the default Program Files folder, usually C:\Program Files in Windows 2000, Server 2003, and XP (32-bit), Vista (32-bit), and 7 (32-bit), or C:\Program Files (x86) in Windows XP (64-bit), Vista (64-bit), and 7 (64-bit).)

Autostart Technique

This worm adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\RunOnce
ClearTemp = "%User Temp%\hsperfdata_temp\~temp~clear~{random}.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\RunOnce
ClearTemp = "%User Temp%\hsperfdata_temp\~temp~clear~{random}.exe"

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\RunOnce
Windows Defender = "%Program Files%\Windows Defender\MSASCui.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Windows Defender = %Program Files%\Windows Defender\MSASCui.exe

It drops the following shortcut pointing to its copy in the User Startup folder to enable its automatic execution at every system startup:

Windows Defender.lnk
Internet Security.lnk

It drops the following file(s) in the Windows Common Startup folder to enable its automatic execution at every system startup:

Windows Defender.lnk
Internet Security.lnk

Other System Modifications

This worm adds the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings
GlobalUserOffline = "0"

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer
WaitDir = "{pre-defined directory}"

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer
Lastupdate = "{malware-defined value}"

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer
DownDir = "{pre-defined directory}"

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer
SecurityKey = "{malware-defined value}"

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer
iSecurityCheck = "{random value}"

HKEY_LOCAL_MACHINE\Software\Microsoft\
Internet Explorer
SecurityKey = "{malware-defined value}"

HKEY_LOCAL_MACHINE\Software\Microsoft\
Internet Explorer
iSecurityCheck = "{random value}"

It modifies the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
Hidden = "2"

(Note: The default value data of the said registry entry is 1.)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
HideFileExt = "1"

(Note: The default value data of the said registry entry is 0.)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
ShowSuperHidden = "0"

(Note: The default value data of the said registry entry is 1.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced\Folder\Hidden\
NOHIDDEN
DefaultValue = "2"