WORM_DROM.AI

This worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This worm drops the following copies of itself into the affected system:

• %Program Files%\Internet Explorer\msvcrt.bak

(Note: %Program Files% is the default Program Files folder, usually C:\Program Files in Windows 2000, Server 2003, and XP (32-bit), Vista (32-bit), and 7 (32-bit), or C:\Program Files (x86) in Windows XP (64-bit), Vista (64-bit), and 7 (64-bit).)

It creates the following folders:

• Notfound\ws2_32.dll\!O!0..
• Notfound\ws2_32.dll
• Notfound\AntiVirus\ws2_32.dll
• Notfound\AntiVirus\ws2_32.dll\!O!0..

Autostart Technique

This worm registers itself as a BHO to ensure its automatic execution every time Internet Explorer is used by adding the following registry keys:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
Browser Helper Objects\{D3626E66-B13B-C628-ACDF-BDABCFA265E1}

Other System Modifications

This worm deletes the following files:

• E F C?D F E A 6 ñ_CHAR(0x1B)_ì
• %Program Files%\Internet Explorer\msvcrt.bak
• ?Úok
• %System%\drivers\etc\hosts

(Note: %Program Files% is the default Program Files folder, usually C:\Program Files in Windows 2000, Server 2003, and XP (32-bit), Vista (32-bit), and 7 (32-bit), or C:\Program Files (x86) in Windows XP (64-bit), Vista (64-bit), and 7 (64-bit).. %System% is the Windows system folder, which is usually C:\Windows\System32.)

It deletes the following folders:

• %Program Files%\Internet Explorer\msvcrt.dll
• %Program Files%\Internet Explorer\msvcrt.bak
• %Program Files%\Internet Explorer\msvcrt.ebk
• %User Temp%\smss.exe
• %User Temp%\csrss.exe
• %User Temp%\svchost32.exe
• %User Temp%\svchost.exe
• %User Temp%\conime.exe
• %User Temp%\ctfmon.exe
• %User Temp%\mmc.exe
• %User Temp%\services.exe
• %User Temp%\IEXPLORE.EXE
• %User Temp%\stpgldk.exe
• %User Temp%\srogm.exe
• %User Temp%\spglsdr.exe
• %User Temp%\copypfh.exe
• %User Temp%\okfile.exe
• %User Temp%\fyso.exe
• %User Temp%\jtso.exe
• %User Temp%\mhso.exe
• %User Temp%\c~c(iulw
• %User Temp%\wdso.exe
• %User Temp%\wgso.exe
• %User Temp%\wlso.exe
• %User Temp%\wmso.exe
• %User Temp%\woso.exe
• %User Temp%\ztso.exe
• %User Temp%\daso.exe
• %User Temp%\tlso.exe
• %User Temp%\rxso.exe
• %User Temp%\fyso0.dll
• %User Temp%\jtso0.dll
• %User Temp%\mhso0.dll
• %User Temp%\qjso0.dll
• %User Temp%\wdso0.dll
• %User Temp%\wgso0.dll
• %User Temp%\wlso0.dll
• %User Temp%\wmso0.dll
• %User Temp%\woso0.dll
• %User Temp%\ztso0.dll
• %User Temp%\tlso0.dll
• %User Temp%\daso0.dll
• %User Temp%\rxso0.dll

(Note: %Program Files% is the default Program Files folder, usually C:\Program Files in Windows 2000, Server 2003, and XP (32-bit), Vista (32-bit), and 7 (32-bit), or C:\Program Files (x86) in Windows XP (64-bit), Vista (64-bit), and 7 (64-bit).. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.)

It adds the following registry keys:

HKEY_CLASSES_ROOT\CLSID\{0FAD2E16-C8EF-5AC1-1E6A-AE3FD8EF56B3}

HKEY_CLASSES_ROOT\CLSID\{0FAD2E16-C8EF-5AC1-1E6A-AE3FD8EF56B3}\
InProcServer32

HKEY_CLASSES_ROOT\CLSID\{D3626E66-B13B-C628-ACDF-BDABCFA265E1}

HKEY_CLASSES_ROOT\CLSID\{D3626E66-B13B-C628-ACDF-BDABCFA265E1}\
InProcServer32

It adds the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{0FAD2E16-C8EF-5AC1-1E6A-AE3FD8EF56B3}\InProcServer32
ThreadingModel = "Apartment"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{D3626E66-B13B-C628-ACDF-BDABCFA265E1}\InProcServer32
ThreadingModel = "Apartment"

Dropping Routine

This worm drops the following files:

• %Program Files%\Internet Explorer\msvcrt.dll
• %Program Files%\Common Files\Relive.dll

(Note: %Program Files% is the default Program Files folder, usually C:\Program Files in Windows 2000, Server 2003, and XP (32-bit), Vista (32-bit), and 7 (32-bit), or C:\Program Files (x86) in Windows XP (64-bit), Vista (64-bit), and 7 (64-bit).)

This report is generated via an automated analysis system.