Worm.VBS.AUTORUN.C

This Worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It drops copies of itself into all the removable drives connected to an affected system. It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

Arrival Details

This Worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Worm drops a copy of itself in the following folders using different file names:

• %User Profile%\Documents\database.mdb
• %User Temp%\rad{5 Random Characters}.tmp
• {Traversed Folders}\Thumb.db

(Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name} on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It drops the following files:

• %User Temp%\Yuyun.Q
• %User Temp%\rad{5 Random Characters}.tmp
• %User Temp%\auto.exe
• %System Root%\Documents and Settings.lnk
• %System Root%\Boot.lnk
• %System Root%\MSOCache.lnk
• %System Root%\PerfLogs.lnk
• {Traversed Folders}\Microsoft.lnk
• {Traversed Folders}\New Folder.lnk
• {Parent Folder Name}.lnk
• {Parent Folder Name}\{Child Folder Name}.lnk
• %User Temp%\v.doc
• {Traverse Folders or Drives}\autorun.inf

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %System Root% is the Windows root folder, where it usually is C:\ on all Windows operating system versions.)

It adds the following processes:

• "%System%\wscript.exe" //e:VBScript %User Temp%\rad{5 random characters}.tmp "{Malware File Directory}\{Malware Filename}.vbs"

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

Autostart Technique

This Worm adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Explorer = Wscript.exe //e:VBScript "%User Profile%\Documents\database.mdb"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
WinUpdate = Wscript.exe //e:VBScript "%Windows%\:Microsoft Office Update for Windows XP.sys"

Other System Modifications

This Worm adds the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
System
DisableRegistryTools = 1

It deletes the following registry keys:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
lnkfile
IsShortcut = (null)

(Note: The default value data of the said registry entry is (null).)

Propagation

This Worm drops copies of itself into all the removable drives connected to an affected system.

It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

It creates shortcut files (.LNK) disguised as folders or files located on the affected drives pointing to the malware copy.