MD5: 82b072430d1842d2093bc56661d8f2d2
SHA1: 49ae0c58912671e08956422dad2f18d955f455b1
SHA256: d13cae34dea3044cb2d44eba19d0bf3228a62dcb5144dc10224a7ef77d145064
SSDeep: 12288:v1dcoCUyZtwAvAs4wTCyrPT0yq0VezaOvoJpaz/g/J/vVoS:vvfty/wAvN7lry0VeH8az/g/J/No
Size: 978432 bytes
File type: EXE
Platform: WIN32
Entropy: Not Packed
PEID: PackerUPXCompresorGratuitowwwupxsourceforgenet, UPolyXv05_v6
Company: no certificate found
Created at: 2009-07-04 18:42:17
Analyzed on: WindowsXP SP3 32-bit

Summary:

Worm. A program that is primarily replicating on networks or removable drives.

Payload

Process activity

The Worm creates the following process(es):

taskkill.exe:556
taskkill.exe:1180
taskkill.exe:1660
sc.exe:516
ipconfig.exe:576
rundll32.exe:1820
cacls.exe:864
cacls.exe:1640

The Worm injects its code into the following process(es):

%original file name%.exe:984

File activity

The process ipconfig.exe:576 makes changes in the file system.
The Worm creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\drv2 (56 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\temp_wincheck.txt (145171 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\dch3.sys (13122 bytes)

The Worm deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\drv2 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\dch3.sys (0 bytes)

The process rundll32.exe:1820 makes changes in the file system.
The Worm creates and/or writes to the following file(s):

%System%\drivers\acpiec.sys (13 bytes)

The process %original file name%.exe:984 makes changes in the file system.
The Worm creates and/or writes to the following file(s):

%Documents and Settings% (4 bytes)
%System%\wbem\Repository\FS\OBJECTS.MAP (12 bytes)
%System%\wbem\Repository\FS\INDEX.MAP (4 bytes)
C:\autorun.inf (21 bytes)
%System%\drivers\etc\hosts (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\index.dat (388 bytes)
C:\ (4 bytes)
%Documents and Settings%\Default User (540 bytes)
%Documents and Settings%\All Users (4 bytes)
%WinDir% (892 bytes)
C:\$Directory (12 bytes)
%System%\dllcache (4 bytes)
%System% (3624 bytes)
C:\PROGRAM FILES (8 bytes)
%Documents and Settings%\NetworkService (4 bytes)
%System%\drivers\pcidump.sys (5404535 bytes)
%System%\config (192 bytes)
%WinDir%\Temp\Perflib_Perfdata_7ac.dat (4 bytes)
%System%\drivers (968 bytes)
%WinDir%\phpq.dll (22141559 bytes)
%System%\func.dll (18378359 bytes)
%Documents and Settings%\%current user% (12 bytes)
C:\totalcmd (4 bytes)
%System%\wbem\Repository\FS\MAPPING1.MAP (192 bytes)
C:\1.exe (7345 bytes)
%Documents and Settings%\LocalService (4 bytes)

Registry activity

The process taskkill.exe:556 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "03 E6 55 31 EF 5C 79 77 28 70 5B F0 C7 C7 BA 99"

The process taskkill.exe:1180 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "0E DC B4 CD 22 CF E1 C4 0D 7E EB 02 14 82 E1 76"

The process taskkill.exe:1660 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F5 F8 08 53 88 DA 5B CD F6 48 87 EE 43 CE 39 EA"

The process sc.exe:516 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "88 38 DF 55 E7 56 49 2A E1 94 2A E5 6D 35 B6 FE"

The process rundll32.exe:1820 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "7D 32 41 82 D3 D2 38 B4 8D 64 DD 28 2A 57 9A 13"

The process cacls.exe:864 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "21 7D C4 B2 B1 1D 6A 94 C6 6E 7D 89 90 13 F2 50"

The process cacls.exe:1640 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BA 1F B7 30 14 C6 00 68 74 4B BF FB 6F 58 BD B7"

Dropped PE files

HOSTS file anomalies

The Worm modifies "%System%\drivers\etc\hosts" file which is used to translate DNS entries to IP addresses.
The modified file is 5743 bytes in size. The following strings are added to the hosts file listed below:

Rootkit activity

The Worm installs the following kernel-mode hooks:

ZwQuerySystemInformation

Using the driver "%System%\drivers\pcidump.sys" the Worm substitutes IRP handlers in a file system driver (NTFS) to control operations with files:

MJ_CREATE

Propagation

A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Worm's file once a user opens a drive's folder in Windows Explorer.

VersionInfo

Company Name:
Product Name: ????
Product Version: 4, 3, 1, 1
Legal Copyright: ???? (C) 2009
Legal Trademarks:
Original Filename: notepad.EXE
Internal Name: test
File Version: 1, 0, 0, 1
File Description: Microsoft ???????
Comments:
Language: English (United States)

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

No activity has been detected.

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Web Traffic was not found.

The Worm connects to the servers at the folowing location(s):

.rsrc

z.wxE

(Exec

/1.html

\phpq.dllvi

$\ 8cmd

%}cls "%s"?pB

GetWindowsDirectoryA

WinExec

tp://localhost/1.html

\phpq.dll

rundll32.exe func.dll, droqp

\system32\func.dll

cmd /c taskkill /im ScanFrm.exe /f

cmd /c taskkill /im egui.exe /f

cmd /c taskkill /im ekrn.exe /f

cmd /c sc config ekrn start= disabled

cmd /c cacls "%s" /e /p everyone:f

cmd /c cacls %s /e /p everyone:f

\temp\explorer.exe

\drivers\gm.dls

Explorer.EXE

explorer.EXE

EXPLORER.EXE

EXPLORER.exe

Explorer.exe

explorer.exe

kjk.om\k)`s`

Ci=l_[n_Msg\ifc]Fche

,-2) ) ),

,-2) ) )-

,-2) ) ).

,-2) ) ) 

,-,),/), ,)13

,-2),),),

,-2) ),),

1,),-3),2,),,053 3 

,-,),,)4 )24

,-0)4 )33).3

- /),22)4-)13

-, )2/),/0)-.1

-, )21) ),..

-,4),-4)-.4)-- 

1,),11).-)-

-,4),0.)/ )--,

-,3)4-),31)-2

-,4),0.)/1)-2

-,4),0.)0-),-.

--,),40)/-)2,

---)2.)-,3),,0

- .),, ),13)-..53 

- .),, ),13)--,53 

.1.ss)^jh

04)./),.,)0/

-, )0,)/0)0

04)./),43)--3

04)./),43)33

04)./),43)42

1 ),4 ),,/), ,

1 ),4 )-,3)./

1 ),4,),-/)-0-

1,),/0),,2)-,-

1,),02), 4)---

20),-1).)-,1

20),-1).)-,2

20),-1).)-,3

04),-0)-.,),225,2222

20),-1).)-- 

20),-1).)--,

20),-1).)---

.text

`.rdata

@.data

r4.Tq:]du

7'7,71767<

a .Mt

B .rd

KERNEL32.DLL

MSVCRT.dll

1, 0, 0, 1

notepad.EXE

4, 3, 1, 1

%original file name%.exe_984_rwx_00401000_0001A000:

GetWindowsDirectoryA

WinExec

tp://localhost/1.html

\phpq.dll

rundll32.exe func.dll, droqp

\system32\func.dll

cmd /c taskkill /im ScanFrm.exe /f

cmd /c taskkill /im egui.exe /f

cmd /c taskkill /im ekrn.exe /f

cmd /c sc config ekrn start= disabled

cmd /c cacls "%s" /e /p everyone:f

cmd /c cacls %s /e /p everyone:f

\temp\explorer.exe

\drivers\gm.dls

Explorer.EXE

explorer.EXE

EXPLORER.EXE

EXPLORER.exe

Explorer.exe

explorer.exe

kjk.om\k)`s`

Ci=l_[n_Msg\ifc]Fche

,-2) ) ),

,-2) ) )-

,-2) ) ).

,-2) ) ) 

,-,),/), ,)13

,-2),),),

,-2) ),),

1,),-3),2,),,053 3 

,-,),,)4 )24

,-0)4 )33).3

- /),22)4-)13

-, )2/),/0)-.1

-, )21) ),..

-,4),-4)-.4)-- 

1,),11).-)-

-,4),0.)/ )--,

-,3)4-),31)-2

-,4),0.)/1)-2

-,4),0.)0-),-.

--,),40)/-)2,

---)2.)-,3),,0

- .),, ),13)-..53 

- .),, ),13)--,53 

.1.ss)^jh

04)./),.,)0/

-, )0,)/0)0

04)./),43)--3

04)./),43)33

04)./),43)42

1 ),4 ),,/), ,

1 ),4 )-,3)./

1 ),4,),-/)-0-

1,),/0),,2)-,-

1,),02), 4)---

20),-1).)-,1

20),-1).)-,2

20),-1).)-,3

04),-0)-.,),225,2222

20),-1).)-- 

20),-1).)--,

20),-1).)---

.text

`.rdata

@.data

.rsrc

r4.Tq:]du

7'7,71767<

%original file name%.exe_984_rwx_10000000_00001000:

.data

.rsrc

@.reloc

psapi.dll

\patch.exe

\dstdisk.exe

\defence.exe

192yuioealdjfiefjsdfas.txt

%SystemRoot%\System32\DRIVERS\puid.sys

\drivers\pcidump.sys

System32\DRIVERS\pcidump.sys

%SystemRoot%\system32\drivers\puid.sys

\\.\pcidump

\drivers\gm.dls

Windows

1.exe

autorun.inf

Open=1.exe

urlmon

\setup.exe

?mac=%s&ver=%s&key=%d&os=windows

.html

.hhqg

qq.exe

360safe.exe

\explorer.exe

\temp\explorer.exe

nfect_exe

%original file name%.exe_984_rwx_10005000_00001000:

\??\c:\%original file name%.exe

\??\%WinDir%\explorer.exe

ers\gm.dls

WinExec

CreatePipe

GetWindowsDirectoryA

KERNEL32.dll

USER32.dll

ADVAPI32.dll

InternetOpenUrlA

WININET.dll

rundll32.exe_1820:

.text

`.data

.rsrc

msvcrt.dll

KERNEL32.dll

NTDLL.DLL

GDI32.dll

USER32.dll

IMAGEHLP.dll

rundll32.pdb

.....eZXnnnnnnnnnnnn3

....eDXnnnnnnnnnnnn3

...eDXnnnnnnnnnnnn,

.eDXnnnnnnnnnnnn,

%Xnnnnnnnnnnnnnnn1

O3$dS7"%U9

.manifest

5.1.2600.5512 (xpsp.080413-2105)

RUNDLL.EXE

Windows

Operating System

5.1.2600.5512

YThere is not enough memory to run the file %s.

Please close other windows and try again.

9The file %s or one of its components could not be opened.

0The file %s or one of its components cannot run.

MThe file %s or one of its components requires a different version of Windows.

UThe file %s or one of its components cannot run in standard or enhanced mode Windows.3Another instance of the file %s is already running./An exception occurred while trying to run "%s"

Error in %s

Missing entry:%s

Error loading %s

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Scan a system with an anti-rootkit tool.
   
2. Terminate malicious process(es) (How to End a Process With the Task Manager):
   

   taskkill.exe:556
   taskkill.exe:1180
   taskkill.exe:1660
   sc.exe:516
   ipconfig.exe:576
   rundll32.exe:1820
   cacls.exe:864
   cacls.exe:1640

3. Delete the original Worm file.
   
4. Delete or disinfect the following files created/modified by the Worm:
   

   %Documents and Settings%\%current user%\Local Settings\Temp\drv2 (56 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\temp_wincheck.txt (145171 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\dch3.sys (13122 bytes)
   %System%\drivers\acpiec.sys (13 bytes)
   %System%\wbem\Repository\FS\OBJECTS.MAP (12 bytes)
   %System%\wbem\Repository\FS\INDEX.MAP (4 bytes)
   C:\autorun.inf (21 bytes)
   %System%\drivers\etc\hosts (5 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\index.dat (388 bytes)
   %Documents and Settings%\Default User (540 bytes)
   %Documents and Settings%\All Users (4 bytes)
   C:\$Directory (12 bytes)
   %System%\dllcache (4 bytes)
   C:\PROGRAM FILES (8 bytes)
   %Documents and Settings%\NetworkService (4 bytes)
   %System%\drivers\pcidump.sys (5404535 bytes)
   %System%\config (192 bytes)
   %WinDir%\Temp\Perflib_Perfdata_7ac.dat (4 bytes)
   %WinDir%\phpq.dll (22141559 bytes)
   %System%\func.dll (18378359 bytes)
   C:\totalcmd (4 bytes)
   %System%\wbem\Repository\FS\MAPPING1.MAP (192 bytes)
   C:\1.exe (7345 bytes)
   %Documents and Settings%\LocalService (4 bytes)

5. Restore the original content of the HOSTS file (%System%\drivers\etc\hosts):
   127.0.0.1 localhost
   
6. Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
   
7. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.