Worm.Win32.HERMWIZ.YECCA

This Worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This Worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Worm drops the following files:

• Once it establishes a connection to an IP within its network:
  • {Malware File Path}\{Random 2}.ocx - module used for SMB propagation and execution to the remote machine
  • {Malware File Path}\{Random 3}.ocx - module used for WMI propagation and execution to the remote machine
• {Malware File Path}\{c{12 Random Characters}}.dll - copy of itself

It drops and executes the following files:

• {Malware File Path}\{Random 1}.ocx - Disk Wiper

It adds the following processes:

• Once a connection to an IP address is established:
  • %System%\regsvr32.exe {Malware File Path}\{Random 2}.ocx #1 -s {Malware File Path}\{c{12 Random Characters}}.dll -i {Target IP Address}
  • %System%\regsvr32.exe {Malware File Path}\{Random 3}.ocx #1 -s {Malware File Path}\{c{12 Random Characters}}.dll -i {Target IP Address}

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

Propagation

This Worm drops the following file(s) in remote admin shares:

• \{IP Address}\ADMIN$\{Malware File Path}\{c{12 Random Characters}}.dll

Other Details

This Worm does the following:

• It obtains IP addresses within the local network via:
  • Obtaining the physical address mapping table
  • Enumerating servers in the domain
  • Obtaining the TCP Table
  • Adapters addresses
• It tries to establish a connection on the IP addresses obtained and copy itself remotely.

It accepts the following parameters:

• -s --> allows full scanning of IP addresses found using the following ports:
  • 20
  • 21
  • 22
  • 80
  • 135
  • 137
  • 139
  • 443
  • 445