➔
search
✕

WORM_TUPYM.A

April 09, 2013
 Analysis by: Rika Joi Gregorio
 ALIASES:

Worm:Win32/Tupym.A(Microsoft), Worm.Win32.Tupym.A (v)(Sunbelt), Worm.Win32.Nuqel(Ikarus), Win32/Autoit.EB worm(Eset)

 PLATFORM:

Windows 2000, Windows Server 2003, Windows XP (32-bit, 64-bit), Windows Vista (32-bit, 64-bit), Windows 7 (32-bit, 64-bit)

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:

  • Threat Type: Worm

  • Destructiveness: No

  • Encrypted: Yes

  • In the wild: Yes

  OVERVIEW

Infection Channel:

Propagates via flashdrives, Propagates via instant messaging applications

This worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It uses Windows Task Scheduler to create a scheduled task that executes the dropped copy.

It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

  TECHNICAL DETAILS

File Size:

631,163 bytes

File Type:

EXE

Memory Resident:

Yes

Initial Samples Received Date:

05 Apr 2013

Payload:

Terminates processes, Drops files

Arrival Details

This worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This worm drops the following files:

  • %System%\autorun.ini - copy of {Drive Letter}:\autorun.inf
  • %Desktop%\autorun.ini (for Windows 7 and Vista) -copy of {Drive Letter}:\autorun.inf

(Note: %System% is the Windows system folder, which is usually C:\Windows\System32.. %Desktop% is the current user's desktop, which is usually C:\Documents and Settings\{User Name}\Desktop on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\Desktop on Windows Vista and 7.)

It drops the following copies of itself into the affected system:

  • %Windows%\system3_.exe
  • %System%\system3_.exe
  • %Desktop%\system3_.exe (for Windows 7 and Vista)

(Note: %Windows% is the Windows folder, which is usually C:\Windows.. %System% is the Windows system folder, which is usually C:\Windows\System32.. %Desktop% is the current user's desktop, which is usually C:\Documents and Settings\{User Name}\Desktop on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\Desktop on Windows Vista and 7.)

It uses Windows Task Scheduler to create a scheduled task that executes the dropped copy.

Autostart Technique

This worm adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Yahoo Messengger = "%System%\system3_.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Yahoo Messengger = "%Desktop%\system3_.exe" (for Windows 7 and Vista)

It modifies the following registry entries to ensure it automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Winlogon
Shell = "Explorer.exe system3_.exe"

(Note: The default value data of the said registry entry is Explorer.exe.)

The scheduled task executes the malware at the following period:

  • Weekly 9:00 AM

Other System Modifications

This worm adds the following registry keys:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
System

HKEY_CURRENT_USER\Software\Policies\
Microsoft\Internet Explorer

HKEY_CURRENT_USER\Software\Policies\
Microsoft\Internet Explorer\Control Panel

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Internet Explorer

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Internet Explorer\Control Panel

It adds the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
WorkgroupCrawler\Shares
shared = "\New Folder.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings
GlobalUserOffline = "0"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
System
DisableTaskMgr = "1"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
System
DisableRegistryTools = "1"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
System
NofolderOptions = "1"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\Schedule
AtTaskMaxHours = "0"

It modifies the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Main
Start Page = "http://www.mydreamworld.50webs.com"

(Note: The default value data of the said registry entry is {default page}.)

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Main
Start Page = "http://www.advgoogle.blogspot.com"

(Note: The default value data of the said registry entry is {default page} (for Windows 7 and Vista).)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\Schedule
NextAtJobId = "2"

(Note: The default value data of the said registry entry is 1.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Internet Explorer\Main
Default_Page_URL = "http://www.mydreamworld.50webs.com"

(Note: The default value data of the said registry entry is {default page}.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Internet Explorer\Main
Default_Search_URL = "http://www.mydreamworld.50webs.com"

(Note: The default value data of the said registry entry is {default page}.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Internet Explorer\Main
Search Page = "http://www.mydreamworld.50webs.com"

(Note: The default value data of the said registry entry is {default page}.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Internet Explorer\Main
Start Page = "http://www.mydreamworld.50webs.com"

(Note: The default value data of the said registry entry is {default page}.)

Propagation

This worm searches for folders in all physical and removable drives then drops copies of itself inside the folder as {folder name}.EXE.

It drops the following copy of itself in all physical and removable drives:

  • {Drive Letter}:\New Folder.exe
  • {Drive Letter}:\system3_.exe

It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

The said .INF file contains the following strings:

[Autorun]
Open=system3_.exe
Shellexecute=system3_.exe
Shell\Open\command=system3_.exe
Shell=Open

It sends messages that contain links to sites hosting remote copies of itself using the following instant-messaging (IM) applications:

  • Yahoo Messenger.exe
  • googletalk.exe

Process Termination

This worm terminates the following processes if found running in the affected system's memory:

  • game_y.exe
  • cmd.exe

Information Theft

This worm accesses the following site to download its configuration file:

  • www.{BLOCKED}1.{BLOCKED}y.com/sdb000{random digit}/setting.ini

NOTES:

Upon execution, the malware checks the OS version of the affected machine. If it is Windows Vista, it sets the {install directory} to C:\Desktop or %User Temp%.

If the worm is not running on Windows Vista, the {install directory} is set to %System% or %Windows%.

This worm enumerates shared drives by checking the value from following registry:

  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\WorkgroupCrawler\Shares

It then copies itself to the shared drive as New Folder.exe. It also copies its corresponding AUTORUN.INF to automatically execute the worm.

It terminates processes of applications with the following Window Names:

  • [FireLion]
  • Bkav2006
  • Registry
  • System Configuration
  • Windows Task

  SOLUTION

Minimum Scan Engine:

9.300

FIRST VSAPI PATTERN FILE:

9.842.07

FIRST VSAPI PATTERN DATE:

07 Apr 2013

VSAPI OPR PATTERN File:

9.843.00

VSAPI OPR PATTERN Date:

08 Apr 2013

Step 1

Before doing any scans, Windows XP, Windows Vista, and Windows 7 users must disable System Restore to allow full scanning of their computers.

Step 2

Restart in Safe Mode

[ Learn More ]

Step 3

Delete this registry key

[ Learn More ]

Important: Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this step only if you know how or you can ask assistance from your system administrator. Else, check this Microsoft article first before modifying your computer's registry.

 
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System
  • HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Internet Explorer

Step 4

Delete this registry value

[ Learn More ]

Important: Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this step only if you know how or you can ask assistance from your system administrator. Else, check this Microsoft article first before modifying your computer's registry.

  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Yahoo Messengger = "%System%\system3_.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Yahoo Messengger = "%Desktop%\system3_.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\WorkgroupCrawler\Shares
    • shared = "\New Folder.exe"
  • In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Schedule
    • AtTaskMaxHours = "0"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
    • GlobalUserOffline = "0"

Step 5

Restore this modified registry value

[ Learn More ]

Important: Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this step only if you know how or you can ask assistance from your system administrator. Else, check this Microsoft article first before modifying your computer's registry.

  • In HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
    • From: Start Page = "http://www.mydreamworld.50webs.com"
      To: Start Page = {default page}
  • In HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
    • From: Start Page = "http://www.advgoogle.blogspot.com"
      To: Start Page = {default page} (for Windows 7 and Vista)
  • In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Schedule
    • From: NextAtJobId = "2"
      To: NextAtJobId = 1
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main
    • From: Default_Page_URL = "http://www.mydreamworld.50webs.com"
      To: Default_Page_URL = {default page}
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main
    • From: Default_Search_URL = "http://www.mydreamworld.50webs.com"
      To: Default_Search_URL = {default page}
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main
    • From: Search Page = "http://www.mydreamworld.50webs.com"
      To: Search Page = {default page}
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main
    • From: Start Page = "http://www.mydreamworld.50webs.com"
      To: Start Page = {default page}
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
    • From: Shell = "Explorer.exe system3_.exe"
      To: Shell = Explorer.exe

Step 6

Search and delete this file

[ Learn More ]
There may be some files that are hidden. Please make sure you check the Search Hidden Files and Folders checkbox in the "More advanced options" option to include all hidden files and folders in the search result.
  • %Windows%\Tasks\At1.job
  • %System%\autorun.ini
  • %Desktop%\autorun.ini

Step 7

Search and delete AUTORUN.INF files created by WORM_TUPYM.A that contain these strings

[ Learn More ]


[Autorun]
Open=system3_.exe
Shellexecute=system3_.exe
Shell\Open\command=system3_.exe
Shell=Open

Step 8

Restart in normal mode and scan your computer with your Trend Micro product for files detected as WORM_TUPYM.A. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.


Did this description help? Tell us how we did.