WORM_DOWNAD.PICH

This worm arrives via removable drives. It may be dropped by other malware.

It modifies registry entries to disable various system services. This action prevents most of the system functions to be used.

It drops copies of itself into all the removable drives connected to an affected system. It drops copies of itself into network drives. It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

It modifies certain registry entries to hide Hidden files.

Arrival Details

This worm arrives via removable drives.

It may arrive via network shares.

It may be dropped by other malware.

Installation

This worm drops the following copies of itself into the affected system:

• %Application Data%\{random file name}.dll
• %System%\{random file name}.dll
• %System%\{random number}.tmp
• %Program Files%\Internet Explorer\{random file name}.dll
• %Program Files%\Movie Maker\{random file name}.dll
• %User Temp%\{random file name}.dll

(Note: %Application Data% is the Application Data folder, where it usually is C:\Documents and Settings\{user name}\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.. %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.. %Program Files% is the Program Files folder, where it usually is C:\Program Files on all Windows operating system versions; C:\Program Files (x86) for 32-bit applications running on Windows 64-bit operating systems.. %User Temp% is the user's temporary folder, where it usually is C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local\Temp on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

Autostart Technique

This worm registers itself as a system service to ensure its automatic execution at every system startup by adding the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{random characters}
ImagePath = "%System Root%\system32\svchost.exe -k"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{random characters}\Parameters
ServiceDll = "%System%\{malware file name}"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\SvcHost\
{random characters}

It adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
{random characters} = "rundll32.exe {malware path and file name}, Parameter"

Other System Modifications

This worm adds the following registry entries as part of its installation routine:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Applets
dl = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Applets
ds = "0"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Applets
dl = "0"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Applets
ds = "0"

It modifies the following registry key(s)/entry(ies) as part of its installation routine:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\Tcpip\Parameters
TcpNumConnections = "00FFFFFE"

(Note: The default value data of the said registry entry is user-defined.)

It modifies registry entries to disable the following system services:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\BITS
Start = "4"

(Note: The default value data of the said registry entry is 2.)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\wuauserv
Start = "4"

(Note: The default value data of the said registry entry is 2.)

Propagation

This worm creates the following folders in all removable drives:

• {drive letter}:\Recycler\{SID}

It drops copies of itself into all the removable drives connected to an affected system.

It drops the following copy(ies) of itself in all removable drives:

• {drive letter}:\Recycler\{SID}\{random characters}

It drops copies of itself into network drives.

It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

Other Details

This worm connects to the following URL(s) to get the affected system's IP address:

• http://www.getmyip.org
• http://www.whatsmyipaddress.com
• http://www.whatismyip.org
• http://checkip.dyndns.org

It connects to the following possibly malicious URL:

• {pseudorandom-generated domain}.biz
• {pseudorandom-generated domain}.info
• {pseudorandom-generated domain}.org
• {pseudorandom-generated domain}.net
• {pseudorandom-generated domain}.com
• {pseudorandom-generated domain}.ws
• {pseudorandom-generated domain}.cn
• {pseudorandom-generated domain}.cc
• http://{ip address converted from confirmed pseudorandom-generated domain}/search?q={number}

It connects to the following time servers to determine the current date:

• myspace.com
• msn.com
• ebay.com
• cnn.com
• aol.com
• w3.org
• ask.com
• yahoo.com
• google.com
• baidu.com

It modifies the following registry entries to hide Hidden files:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced\Folder\Hidden\
SHOWALL
CheckedValue = "0"

(Note: The default value data of the said registry entry is 1.)