WORM_VESENLO.SMA

This worm arrives by connecting affected removable drives to a system. It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

As of this writing, the said sites are inaccessible.

It logs a user's keystrokes to steal information.

Arrival Details

This worm arrives by connecting affected removable drives to a system.

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This worm drops the following copies of itself into the affected system and executes them:

• %User Profile%\Wins7\msmm.exe

(Note: %User Profile% is a user's profile folder, where it usually is C:\Documents and Settings\{user name} on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name} on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It creates the following folders:

• %User Profile%\Wins7
• %User Profile%\Wins7\shin
• %Start Menu%\Programs\Startups
• %User Profile%\Wins7\shin0

(Note: %User Profile% is a user's profile folder, where it usually is C:\Documents and Settings\{user name} on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name} on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.. %Start Menu% is the Start Menu folder, where it usually is C:\Documents and Settings\{user name}\Start Menu on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming\Microsoft\Windows\Start Menu on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

Autostart Technique

This worm drops the following file(s) in the Windows User Startup folder to enable its automatic execution at every system startup:

• %User Startup%\Sound Player.lnk

(Note: %User Startup% is the current user's Startup folder, which is usually C:\Windows\Profiles\{user name}\Start Menu\Programs\Startup on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Start Menu\Programs\Startup on Windows NT, and C:\Documents and Settings\{User name}\Start Menu\Programs\Startup.)

Other System Modifications

This worm adds the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Windows NT\CurrentVersion\AppCompatFlags\
Layers
%System%\cmd.exe = "RUNASADMIN"

HKEY_CURRENT_USER\Software\Microsoft\
Windows NT\CurrentVersion\AppCompatFlags\
Layers
%User Profile%\Wins7\msmm,exe = "ELEVATECREATEPROCESS"

HKEY_LOCAL_MACHINE\CurrentControlSet\services\
SharedAccess\Parameters\FirewallPolicy\
FirewallRules - Windows Vista and 7 only
{Random GUID} = "v{version number}|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Private|App=%System\ftp.exe|Name=Windows%|"

HKEY_LOCAL_MACHINE\CurrentControlSet\services\
SharedAccess\Parameters\FirewallPolicy\
FirewallRules - Windows Vista and 7 only
{Random GUID 2} = "v{version number}|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Private|App=%System\ftp.exe|Name=Windows%|"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\AuthorizedApplications\
List - Windows OS other than Vista and 7
%System%\ftp.exe = "%System%\ftp.exe:*:Enabled:Windows"

Propagation

This worm drops the following copy(ies) of itself in all removable drives:

• {drive letter}:\New.exe

Dropping Routine

This worm drops the following files wherein it saves the information it gathers:

• %User Profile%\Wins7\shin\sss.col - encrypted keylogs
• %User Profile%\Wins7\shin0\sss.col - encrypted keylogs. dropped upon certain conditions

(Note: %User Profile% is a user's profile folder, where it usually is C:\Documents and Settings\{user name} on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name} on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

Download Routine

This worm connects to the following URL(s) to download its component file(s):

• {BLOCKED}p.{BLOCKED}q.com

It saves the files it downloads using the following names:

• %User Profile%\Wins7\bil.col

(Note: %User Profile% is a user's profile folder, where it usually is C:\Documents and Settings\{user name} on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name} on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

As of this writing, the said sites are inaccessible.

Information Theft

This worm logs a user's keystrokes to steal information.

Drop Points

This worm uploads files to the following File Transfer Protocol (FTP) sites:

• ftp.drivehq.com

NOTES:

It attempts to check for the following analysis tools:

• File Monitor
• Process Monitor
• Registry Monitor

It monitors the following browser and instant messaging client:

• Internet Explorer
• Yahoo Messenger

It steals from the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion
Values: ProductName
CSDVersion

HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System
Values: SystemBiosVersion

HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Value: ProcessorNameString

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography
Value: MachineGUID