WORM_LEGMIR.GT

This worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It employs registry shell spawning by adding certain registry entries. This allows this malware to execute even when other applications are opened.

It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

Arrival Details

This worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This worm drops the following copies of itself into the affected system:

• %Program Files%\Common Files\iexplore.pif
• %Program Files%\Internet Explorer\iexplore.com
• %System%\command.pif
• %System%\dxdiag.com
• %System%\finder.com
• %System%\MSCONFIG.COM
• %System%\regedit.com
• %System%\rundll32.com
• %Windows%\1.com
• %Windows%\Debug\DebugProgram.exe
• %Windows%\ExERoute.exe
• %Windows%\explorer.com
• %Windows%\finder.com
• D:\pagefile.pif
• %Windows%\services.exe

Autostart Technique

This worm creates the following registry entries to enable automatic execution of dropped component at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Torjan Program = "%Windows%\services.exe"

It employs registry shell spawning to ensure its execution when certain file types are accessed by adding the following entries:

HKEY_CLASSES_ROOT\winfiles\Shell\
Open\Command
@ = "%Windows%\ExeRoute.exe "%1" %*"

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\
StartMenuInternet\iexplore.pif\shell
@ = "%Program Files%\Common Files\iexplore.pif"

Other System Modifications

This worm adds the following registry keys:

HKEY_CURRENT_USER\Software\VB and VBA Program Settings

HKEY_CLASSES_ROOT\winfiles

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\
StartMenuInternet\iexplore.pif\shell

It adds the following registry entries:

HKEY_CURRENT_USER\Software\Internet Explorer\
Main
Check_Associations = "No"

It modifies the following registry entries:

HKEY_CLASSES_ROOT\SOFTWARE\Classes\
Applications\iexplore.exe\shell\
open\command
@ = ""%Program Files%\Internet Explorer\iexplore.com" %1"

(Note: The default value data of the said registry entry is "%Program Files%\Internet Explorer\iexplore.exe" %1.)

HKEY_CLASSES_ROOT\SOFTWARE\Classes\
.lnk\ShellNew
Command = "%System%\rundll32.com appwiz.cpl,NewLinkHere %1"

(Note: The default value data of the said registry entry is %System%\rundll32.exe appwiz.cpl,NewLinkHere %1.)

HKEY_CLASSES_ROOT\SOFTWARE\Classes\
cplfile\shell\cplopen\
command
@ = "rundll32.com shell32.dll,Control_RunDLL "%1",%*"

(Note: The default value data of the said registry entry is rundll32.exe shell32.dll,Control_RunDLL "%1",%*.)

HKEY_CLASSES_ROOT\SOFTWARE\Classes\
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\
OpenHomePage\Command
@ = "%Program Files%\Internet Explorer\iexplore.com"

(Note: The default value data of the said registry entry is %Program Files%\Internet Explorer\iexplore.exe.)

HKEY_CLASSES_ROOT\SOFTWARE\Classes\
Drive\shell\find\
command
@ = "SystemRoot%\explorer.com"

(Note: The default value data of the said registry entry is SystemRoot%\explorer.exe.)

HKEY_CLASSES_ROOT\SOFTWARE\Classes\
dunfile\shell\open\
command
@ = "%System%\rundll32.com NETSHELL.DLL,InvokeDunFile %1"

(Note: The default value data of the said registry entry is %System%\rundll32.exe NETSHELL.DLL,InvokeDunFile %1.)

HKEY_CLASSES_ROOT\SOFTWARE\Classes\
ftp\shell\open\
command
@ = ""%Program Files%\Internet Explorer\iexplore.com" %1"

(Note: The default value data of the said registry entry is "%Program Files%\Internet Explorer\iexplore.exe" %1.)

HKEY_CLASSES_ROOT\SOFTWARE\Classes\
htmlfile\shell\open\
command
@ = ""%Program Files%\Internet Explorer\iexplore.com" -nohome"

(Note: The default value data of the said registry entry is "%Program Files%\Internet Explorer\iexplore.exe" -nohome.)

HKEY_CLASSES_ROOT\SOFTWARE\Classes\
htmlfile\shell\opennew\
command
@ = ""%Program Files%\Internet Explorer\iexplore.com" %1"

(Note: The default value data of the said registry entry is "%Program Files%\Internet Explorer\iexplore.exe" %1.)

HKEY_CLASSES_ROOT\SOFTWARE\Classes\
HTTP\shell\open\
command
@ = ""%Program Files%\Internet Explorer\iexplore.com" -nohome"

(Note: The default value data of the said registry entry is "%Program Files%\Internet Explorer\iexplore.exe" -nohome.)

HKEY_CLASSES_ROOT\SOFTWARE\Classes\
inffile\shell\Install\
command
@ = "%System%\rundll32.com setupapi,InstallHinfSection DefaultInstall 132 %1"

(Note: The default value data of the said registry entry is %System%\rundll32.exe setupapi,InstallHinfSection DefaultInstall 132 %1 .)

HKEY_CLASSES_ROOT\SOFTWARE\Classes\
InternetShortcut\shell\open\
command
@ = "finder.com shdocvw.dll,OpenURL %l"

(Note: The default value data of the said registry entry is rundll32.exe shdocvw.dll,OpenURL %l.)

HKEY_CLASSES_ROOT\SOFTWARE\Classes\
scrfile\shell\install\
command
@ = "finder.com desk.cpl,InstallScreenSaver %l"

(Note: The default value data of the said registry entry is rundll32.exe desk.cpl,InstallScreenSaver %l.)

HKEY_CLASSES_ROOT\SOFTWARE\Classes\
scriptletfile\Shell\Generate Typelib\
command
@ = ""%System%\finder.com" %System%\scrobj.dll,GenerateTypeLib "%1""

(Note: The default value data of the said registry entry is "%System%\rundl32.dll" %System%\scrobj.dll,GenerateTypeLib "%1".)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
telnet\shell\open\
command
@ = "finder.com url.dll,TelnetProtocolHandler %l"

(Note: The default value data of the said registry entry is rundll32.exe url.dll,TelnetProtocolHandler %l.)

HKEY_CLASSES_ROOT\SOFTWARE\Classes\
.exe
@ = "winfiles"

(Note: The default value data of the said registry entry is exefile.)

HKEY_CLASSES_ROOT\SOFTWARE\Classes\
.bfc\ShellNew
Command = "%System%\rundll32.com %System%\syncui.dll,Briefcase_Create %2!d! %1"

(Note: The default value data of the said registry entry is %System%\rundll32.exe %System%\syncui.dll,Briefcase_Create %2!d! %1.)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Unknown\shell\openas\
command
@ = "%System%\finder.com %System%\shell32.dll,OpenAs_RunDLL %1"

(Note: The default value data of the said registry entry is %System%\rundll32.exe %System%\shell32.dll,OpenAs_RunDLL %1 .)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Winlogon
Shell = "Explorer.exe 1"

(Note: The default value data of the said registry entry is Explorer.exe.)

Propagation

This worm drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

The said .INF file contains the following strings:

[autorun]
OPEN=D:\pagefile.pif

Other Details

This worm connects to the following possibly malicious URL:

• http://account.{BLOCKED}t.com.cn/UPD/Information.asp?UID={value}&UID88={value}