Analysis by: Karl Dominguez
 PLATFORM:

Windows 2000, Windows XP, Windows Server 2003

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:

  • Threat Type: Trojan

  • Destructiveness: No

  • Encrypted: No

  • In the wild: Yes

  OVERVIEW

This Trojan writes a malicious Windows Management Instrumentation (WMI) JScript that connects to a remote site to possibly download other malicious file(s) and execute arbitrary commands upon execution. Creating a WMI script effectively hides the malicious script from the user. It then deletes itself and its dropper once its execution is completed.

This Trojan may be dropped by other malware.

  TECHNICAL DETAILS

File Size: 7,848 bytes
Memory Resident: No
Initial Samples Received Date: 29 Dec 2011

Arrival Details

This Trojan may be dropped by the following malware:

  • TROJ_WIMMIE.BYE

NOTES:

Upon execution, VBS_WIMMIE.BYE writes a malicious Windows Management Instrumentation (WMI) JScript that connects to a remote site to possibly download other malicious file(s) and execute arbitrary commands. Creating a WMI script effectively hides the malicious script from the user. VBS_WIMMIE.BYE then deletes itself and its dropper once its execution is completed.

It saves the malicious __EventConsumer as the following:

  • Microsoft WMI Comsumer Security Event_consumer

It creates the following __EventFilter, which is necessary for the created __EventConsumer to be registered as a permament event consumer. It also acts as an autostart mechanism for the malicious script:

  • Microsoft WMI Comsumer Security Event_filter

An __IntervalTimerInstruction with the following name is also created to run the event every 30 seconds:

  • Microsoft WMI Comsumer Security Event_WMITimer

A __FiltertoConsumerBinding class is then executed to relate the abovementioned __EventConsumer to the __EventFilter.

The malicious script connects to the following URL to notify a remote user of an infection, download other files, and receive arbitrary commands.

  • http://{BLOCKED}ms.0fees.net/count/{computer name}{MAC Address}_{malware-specified parameter}

However, as of this writing, the said site is inacessible.

For information regarding WMI, please refer to Microsoft MSDN page.

  SOLUTION

Minimum Scan Engine: 9.200

Step 1

For Windows XP and Windows Server 2003 users, before doing any scans, please make sure you disable System Restore to allow full scanning of your computer.

Step 2

Remove malware files dropped/downloaded by VBS_WIMMIE.BYE

    TROJ_WIMMIE.BYE

Step 3

Scan your computer with your Trend Micro product to delete files detected as VBS_WIMMIE.BYE. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.

NOTES:

Deleting Malicious Script

To delete the malicious script created by this malware using WMI Command-line Tool:

  1. Open a WMI command-line. To do this, click Start>Run, type WMIC in the text box provided, then press Enter.
      Type the following on the command-line tool and delete the malicious event consumer:
    • /namespace:\\root\subscription PATH __EventConsumer delete
  2. Press Y and Enter when prompted to delete the following, press N and enter if other values are seen: \\{computer name}\\ROOT\subscription:ActiveScriptEventConsumer.Name="Microsoft WMI Comsumer Security Event_consumer"
      Type the following on the command-line tool and delete the event filter:
    • /namespace:\\root\subscription PATH __EventFilter delete
  3. Press Y and Enter when prompted to delete the following, press N and enter if other values are seen: \\{computer name}\\ROOT\subscription:__EventFilter.Name="Microsoft WMI Comsumer Security Event_filter"
      Type the following on the command-line tool and delete the event timer instruction:
      /namespace:\\root\subscription PATH __TimerInstruction delete
  4. Press Y and Enter when prompted to delete the following, press N and enter if other values are seen: \\{computer name}\\ROOT\subscription:__TimerInstruction.TimerId="Microsoft WMI Comsumer Security Event_WMITimer"
      Type the following on the command-line tool and delete the FiltertoConsumerBinding:
    • /namespace:\\root\subscription PATH __FilterToConsumerBinding delete
  5. Press Y and Enter when prompted to delete the following, press N and enter if other values are seen: \\{computer name}\\ROOT\subscription:__FilterToConsumerBinding.Consumer="\\\\.\\root\\subscription:ActiveScriptEventConsumer.Name="Microsoft WMI Comsumer Security Event_consumer\"",Filter="\\\\.\\root\\subscription:__EventFilter.Name="Microsoft WMI Comsumer Security Event_filter\""
    • Type quit or exit to close the command-line tool.


Did this description help? Tell us how we did.

Related Malware