TROJ_WHAIM.A

This threat is a Master Boot Record (MBR) wiper that infected systems of a major Korean electric utility.

To get a one-glance comprehensive view of the behavior of this Trojan, refer to the Threat Diagram shown below.

This Trojan may be dropped by other malware.

Arrival Details

This Trojan may be dropped by the following malware:

• TROJ_MDROP.WQA

Installation

This Trojan drops the following copies of itself into the affected system:

• %System%\{random file name}.dll

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

Autostart Technique

This Trojan adds the following entries to allow itself to run on safe mode:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Minimal\
{random data}
(Default) = "Service"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Network\
{random data}
(Default) = "Service"

It adds the following keys to allow itself to run on safe mode:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Minimal\
{random data}

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\SafeBoot\Network\
{random data}

It registers its dropped component as a system service to ensure its automatic execution at every system startup. It does this by creating the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{random data}\Parameters
ServiceDll = "%System%\{random file name}.dll"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{random data}\Parameters
ServiceMain = "ServiceMain"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{random data}
ImagePath = "%SystemRoot%\System32\svchost.exe -k {random value}"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{random data}
DisplayName = "{random value}"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{random data}
Description = "{random description}"

It registers its dropped component as a system service to ensure its automatic execution at every system startup. It does this by creating the following registry keys:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{random data}\Parameters

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{random data}

Other System Modifications

This Trojan adds the following registry keys:

HKEY_LOCAL_MACHINE\SOFTWARE\PcaSvcc

It adds the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\PcaSvcc
number = "{random value in hex}"

HKEY_LOCAL_MACHINE\SOFTWARE\PcaSvcc
year = "{current year in hex}"

HKEY_LOCAL_MACHINE\SOFTWARE\PcaSvcc
month = "{current month in hex}"

HKEY_LOCAL_MACHINE\SOFTWARE\PcaSvcc
day = "{current day in hex}"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\SvcHost
{random value} = "{random data}"

HKEY_LOCAL_MACHINE\SOFTWARE\PcaSvcc
finish = "1"

NOTES:

If the Operating System (OS) is Vista or higher and is 64-bit, it drops and executes the following malware:

• TROJ64_WHAIM.A

This Trojan overwrites the Master Boot record (MBR) of the affected system with the strings, Who Am I?.

After infection, it restarts the system and it displays the following:

Where {random file name} can be any of the following:

• bddsvc.dll
• iconsvc.dll
• ehressvc.dll
• netstsvc.dll
• pnas.dll
• pnrpmchname.dll
• pwpsvc.dll
• pcssvc.dll
• rregconf.dll
• scardmngsvc.dll
• tcpmsvc.dll
• tschmng.dll
• mmthread.dll
• wcmngsvc.dll
• coladj.dll
• wndmodmng.dll
• timesyncsvc.dll
• wiredconfsvc.dll
• wlanconf.dll
• wstmng.dll
• Where {random value} can be any of the following:
• blockcom
• iconcom
• mcsvccom
• nssvccom
• pnacom
• pnrpcom
• ppolcom
• pcompcom
• rregcom
• scardcom
• tpcmcom
• tschcom
• mmthcom
• wcmngcom
• wndcolcom
• wndmodcom
• wndtimecom
• wconfcom
• wlanconfcom
• wstcom

Where {random data} can be any of the following:

• BitLocker Drive Decryption Service
• Internet Connection Service
• Media Center Service
• Network Storage Service
• Peer Networking Address
• PNRP Machine Name
• Power Policy
• Program Compatibility Service
• Remote Registry Configuration
• Smart Card Management Service
• Tablet PC Management Service
• Task Schedule Manager
• Thread Ordering Service
• WebClient Manage Service
• Windows Color Adjustment
• Windows Modules Management
• Windows Time Synchronization
• Wired Config Service
• WLAN Config Service
• Workstation management

• BDESVC hosts the BitLocker Drive Decryption service.
• Provides network address translation, addressing, name resolution and/or intrusion prevention services for a home or small office network.
• Allows Media Center to locate and connect to the computer.
• This service delivers network notifications (e.
• Enables multi-party communication using Peer-to-Peer Connecting.
• This service publishes a machine name using the Peer Name Resolution Protocol.
• Manages power policy and power policy notification delivery.
• This service provides support for the Program Compatibility Assistant (PCA).
• Enables remote users to modify registry configurations on this computer.
• Manages access to smart cards read by this computer.
• Enables Tablet PC pen and ink functionality
• Enables a user to configure and schedule automated tasks on this computer.
• Provides ordered execution for a group of threads within a specific period of time.
• Enables Windows-based programs to create, access, and modify Internet-based files.
• The WcasPlugInService service hosts third-party Windows Color System color device model and gamut map model plug-in modules.
• Enables installation, modification, and removal of Windows updates and optional components.
• Maintains date and time synchronization on all clients and servers in the network.
• The Wired AutoConfig (DOT3SVC) service is responsible for performing IEEE 802.1X

TROJ_WHAIM.A checks if the current date and time is Dec 10, 2014 11:00 AM or later. If it meets this condition, it sets the registry, HKEY_LOCAL_MACHINE\SOFTWARE\PcaSvcc\finish to 1, thus triggering the MBR infection. Otherwise, it sleeps for a minute and checks the system time again.