WORM_OTORUN

 Analysis by: Dianne Lagrimas

 PLATFORM:

Windows 2000, Windows XP, Windows Server 2003

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:

  • Threat Type: Worm

  • Destructiveness: No

  • Encrypted:

  • In the wild: Yes

  OVERVIEW

Infection Channel:

Propagates via removable drives, Propagates via network shares, Propagates via software vulnerabilities


This description is based on the compiled analysis of several variants of WORM_OTORUN. Note that specific data such as file names and registry values may vary for each variant.

This worm arrives by connecting affected removable drives to a system. It arrives via removable drives. It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

  TECHNICAL DETAILS

File Size:

Varies

File Type:

PE

Memory Resident:

Yes

Payload:

Downloads files, Compromises system security

Arrival Details

This worm arrives by connecting affected removable drives to a system.

It arrives via removable drives.

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This worm drops the following files:

  • %User Temp%\E_N4\eAPI.fne
  • %User Temp%\E_N4\eImgConverter.fne
  • %User Temp%\E_N4\krnln.fnr
  • %User Temp%\E_N4\PBShell.fne
  • %User Temp%\E_N4\shell.fne
  • %System Root%\OGa\RD\DesKTop.ini
  • %User Temp%\srv{random}.ini
  • %User Temp%\rstimgr.inf

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.. %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.)

It drops the following copies of itself into the affected system:

  • %System%\smsc.exe
  • %System%\svchoct.exe
  • %User Temp%\srv{3 random hexadecimal digits}.tmp
  • %System Root%\OGa\RD\GOx.exe
  • %Windows%\dllmgr.exe
  • %Application Data%\Microsoft\IME\V2005\PHIME2002A.exe
  • %User Temp%\srv{random}.tmp
  • {Shared Folder}\setup50045.fon

(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.. %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.. %Windows% is the Windows folder, which is usually C:\Windows or C:\WINNT.. %Application Data% is the current user's Application Data folder, which is usually C:\Windows\Profiles\{user name}\Application Data on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Application Data on Windows NT, and C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, XP, and Server 2003.)

It creates the following folders:

  • %User Temp%\E_N4
  • %System Root%\OGa
  • %System Root%\OGa\RD
  • %System Root%\RECYCLER\{SID}

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.. %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.)

It injects itself into the following processes as part of its memory residency routine:

  • spoolsv.exe
  • explorer.exe

Autostart Technique

This worm registers itself as a system service to ensure its automatic execution at every system startup by adding the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\PrtSmanm
ImagePath = "{malware path and file name}"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\srv{random hexadecimal number}
ImagePath = "{malware path and file name}"

It adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
{malware-defined name} = "{malware-defined entry name}

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\srv{random}\parameters
{malware-defined name} = "{malware path and file name}"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
{malware-defined name} = "{malware path and file name}"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
{malware-defined name} = {malware path and file name}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Active Setup\Installed Components\{random CLSID}
StubPath = "{malware path and file name}"

It adds the following keys to allow itself to run on safe mode:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Minimal\
srv{random hexadecimal number}

Other System Modifications

This worm adds the following registry entries as part of its installation routine:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Shell Extensions
{malware-defined name} = "{malware-defined entry name}"

It modifies the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile
EnableFirewall = "0"

(Note: The default value data of the said registry entry is 1.)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\wscsvc
Start = "4"

(Note: The default value data of the said registry entry is 2.)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\wuauserv
Start = "4"

(Note: The default value data of the said registry entry is 2.)

It creates the following registry entry(ies) to bypass Windows Firewall:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\GloballyOpenPorts\
List
{malware-defined name} = "{malware-defined entry name}"

Propagation

This worm creates the following folders in all removable drives:

  • RECYCLER\S-1-5-21-2214276341-3544434524-6043330-4321
  • OGa
  • {Removable drive} letter:\{random characters}

It drops the following copy(ies) of itself in all removable drives:

  • {drive}:\RECYCLER\S-1-5-21-2214276341-3544434524-6043330-4321\update.exe
  • {space}.exe
  • setup1911.fon
  • {Removable drive letter}:\{random characters}\{random characters}.exe

It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

Other Details

This worm connects to the following possibly malicious URL:

  • http://{BLOCKED}.{BLOCKED}.89.121/X
  • http://{BLOCKED}.{BLOCKED}.89.121/exe
  • http://{BLOCKED}.{BLOCKED}.48.173
  • http://{BLOCKED}.{BLOCKED}.193.21
  • http://{BLOCKED}.{BLOCKED}.88.10
  • http://{base url}/bin/read_a.php?a1={some encrypted data}

NOTES:

Some variants of WORM_OTORUN have backdoor routines. These variants connect to certain Internet Relay Chat (IRC) servers to communicate and receive commands from a remote user.

Other variants may use network drives or software vulnerabilities to further propagate across a network.

This description is based on the compiled analysis of several variants of WORM_OTORUN. Note that specific data such as file names and registry values may vary for each variant.

  SOLUTION

Minimum Scan Engine:

9.200

FIRST VSAPI PATTERN FILE:

5.554.01

FIRST VSAPI PATTERN DATE:

20 Sep 2008

VSAPI OPR PATTERN File:

5.555.00

VSAPI OPR PATTERN Date:

20 Sep 2008

Trend customers:

    Keep your pattern and scan engine files updated. Trend Micro antivirus software can clean or remove most types of computer threats. Malware, though, such as Trojans, scripts, overwriting viruses and joke programs which are identified as uncleanable, should simply be deleted.

All Internet users:

    1. Use HouseCall - the Trend Micro online threat scanner to check for malware that may already be on your PC.
    2. Catch malware/grayware before they affect your PC or network. Secure your Web world with Trend Micro products that offer the best anti-threat and content security solutions for home users, corporate users, and ISPs. Go here for more information on Trend Micro products that fit your needs.


Did this description help? Tell us how we did.