Worm.Win32.DOWNAD.PICX

March 03, 2021

Analysis by: Thea Patrice Tajonera

ALIASES:

Worm:W32/Downadup.gen!A (FSECURE); W32.Downadup.B (NORTON)

PLATFORM:

Windows

OVERALL RISK RATING:

DAMAGE POTENTIAL:

DISTRIBUTION POTENTIAL:

REPORTED INFECTION:

INFORMATION EXPOSURE:

Threat Type: Worm
Destructiveness: No
Encrypted:
In the wild: Yes

OVERVIEW

This Worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

TECHNICAL DETAILS

File Size: 164,160 bytes

File Type: DLL

Memory Resident: No

Initial Samples Received Date: 03 Mar 2021

Arrival Details

This Worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Worm adds the following processes:

explorer %System Root%

(Note: %System Root% is the Windows root folder, where it usually is C:\ on all Windows operating system versions.)

Other System Modifications

This Worm modifies the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer
ShellState = "{Hex Values}"

(Note: The default value data of the said registry entry is {Default Value}.)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
Hidden = 2

(Note: The default value data of the said registry entry is 1.)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
ShowCompColor = 1

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
HideFileExt = 0

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
DontPrettyPath = 0

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
ShowInfoTip = 1

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
HideIcons = 0

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
MapNetDrvBtn = 0

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
WebView = 1

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
Filter = 0

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
SuperHidden = 0

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
SeparateProcess = 0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced\Folder\Hidden\
SHOWALL
CheckedValue = 0

(Note: The default value data of the said registry entry is 1.)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
AutoCheckSelect = 0

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
IconsOnly = 0

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
ShowTypeOverlay = 1

SOLUTION

Minimum Scan Engine: 9.850

FIRST VSAPI PATTERN FILE: 16.572.05

FIRST VSAPI PATTERN DATE: 03 Mar 2021

VSAPI OPR PATTERN File: 16.573.00

VSAPI OPR PATTERN Date: 04 Mar 2021

Step 1

Before doing any scans, Windows 7, Windows 8, Windows 8.1, and Windows 10 users must disable System Restore to allow full scanning of their computers.

Step 2

Note that not all files, folders, and registry keys and entries are installed on your computer during this malware's/spyware's/grayware's execution. This may be due to incomplete installation or other operating system conditions. If you do not find the same files/folders/registry information, please proceed to the next step.

Step 3

Restore these modified registry values

[ Learn More ]

Important:Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this only if you know how to or you can seek your system administrator's help. You may also check out this Microsoft article first before modifying your computer's registry.

In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer
- From: ShellState = {Hex Values}
  To: ShellState = {Default Value}

In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
- From: Hidden = 2
  To: Hidden = 1

In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
- From: ShowCompColor = 1
  To: ShowCompColor = 1

In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
- From: HideFileExt = 0
  To: HideFileExt = 0

In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
- From:DontPrettyPath = 0
  To:DontPrettyPath = 0

In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
- From: ShowInfoTip = 1
  To: ShowInfoTip = 1

In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
- From: HideIcons = 0
  To: HideIcons = 0

In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
- From: MapNetDrvBtn = 0
  To: MapNetDrvBtn= 0

In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
- From: WebView = 1
  To: WebView = 1

In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
- From: Filter = 0
  To: Filter = 0

In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
- From: SuperHidden = 0
  To: SuperHidden = 0

In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
- From: SeparateProcess = 0
  To: SeparateProcess = 0

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL
- From: CheckedValue = 0
  To: CheckedValue = 1

In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
- From: AutoCheckSelect = 0
  To: AutoCheckSelect = 0

In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
- From: IconsOnly = 0
  To: IconsOnly = 0

In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
- From: ShowTypeOverlay = 1
  To: ShowTypeOverlay = 1

To restore registry values this malware/grayware modified:

Open Registry Editor. To do this:
- On Windows 7 and Server 2008 (R2):
  Click the Start button, type REGEDIT in the Search input field then press Enter.
- On Windows 8, 8.1, 10, and Server 2012 (R2):
  Right-click on the lower left corner of the screen and click Run, type REGEDIT in the Run input field, and then press Enter.
In the left panel, double-click the following:
HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer
In the right panel, locate the registry value:
ShellState = {Hex Values}
Right-click on the value name and choose Modify. Change the value data of this entry to:
ShellState = {Default Value}
In the left panel, double-click the following:
HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>Advanced
In the right panel, locate the registry value:
Hidden = 2
Right-click on the value name and choose Modify. Change the value data of this entry to:
Hidden = 1
Again In the right panel, locate the registry value:
ShowCompColor = 1
Right-click on the value name and choose Modify. Change the value data of this entry to:
ShowCompColor = 1
Again In the right panel, locate the registry value:
HideFileExt = 0
Right-click on the value name and choose Modify. Change the value data of this entry to:
HideFileExt = 0
Again In the right panel, locate the registry value:
DontPrettyPath = 0
Again In the right panel, locate the registry value:
ShowInfoTip = 1
Right-click on the value name and choose Modify. Change the value data of this entry to:
ShowInfoTip = 1
Again In the right panel, locate the registry value:
HideIcons = 0
Again In the right panel, locate the registry value:
MapNetDrvBtn = 0
Again In the right panel, locate the registry value:
WebView = 1
Right-click on the value name and choose Modify. Change the value data of this entry to:
WebView = 1
Again In the right panel, locate the registry value:
Filter = 0
Again In the right panel, locate the registry value:
SuperHidden = 0
Again In the right panel, locate the registry value:
SeparateProcess = 0
Again In the right panel, locate the registry value:
AutoCheckSelect = 0
Right-click on the value name and choose Modify. Change the value data of this entry to:
AutoCheckSelect = 0
Again In the right panel, locate the registry value:
IconsOnly = 0
Right-click on the value name and choose Modify. Change the value data of this entry to:
IconsOnly = 0
Again In the right panel, locate the registry value:
ShowTypeOverlay = 0
Right-click on the value name and choose Modify. Change the value data of this entry to:
ShowTypeOverlay = 1
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>Software>Microsoft>Windows>CurrentVersion>Explorer>Advanced>Folder>Hidden>SHOWALL
In the right panel, locate the registry value:
CheckedValue = 0
Right-click on the value name and choose Modify. Change the value data of this entry to:
CheckedValue = 1
Close Registry Editor.

Step 4

Scan your computer with your Trend Micro product to delete files detected as Worm.Win32.DOWNAD.PICX. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check the following Trend Micro Support pages for more information:

Did this description help? Tell us how we did.

Worm.Win32.DOWNAD.PICX

OVERVIEW

TECHNICAL DETAILS

SOLUTION

Trend Vision One™ - Proactive Security Starts Here.

Resources

Support

About Trend

Country Headquarters