WORM_LIGHTMOON.F

Infection Channel: Via physical/removable drives

This worm arrives via removable drives.

It drops copies of itself in removable drives. These dropped copies use the names of the folders located on the said drives for their file names.

It connects to certain websites to send and receive information.

File Size: 1,495,552 bytes

File Type: EXE

Memory Resident: No

Initial Samples Received Date: 01 Mar 2017

Payload: Drops files, Connects to URLs/IPs, Modifies files

Arrival Details

This worm arrives via removable drives.

Installation

This worm adds the following folders:

%User Profile%\Templates\O{random numbers}Z
%Windows%\M{random numbers}
%System%\X{random numbers}go

(Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.. %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.. %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

It drops the following non-malicious files:

%Windows%\[TheMoonlight].txt

(Note: %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.)

It drops the following copies of itself into the affected system:

%Windows%\Ti{random numbers}ta.exe
%Windows%\sa-{random numbers}.exe
%System%\{random numbers}I.exe
%System%\X{random numbers}go\Z{random numbers}cie.cmd
%Windows%\M{random numbers}\EmangEloh.exe
%Windows%\M{random numbers}\Ja{random numbers}bLay.com
%Windows%\M{random numbers}\smss.exe
%User Profile%\Templates\O{random numbers}Z\TuxO{random numbers}Z.exe
%User Profile%\Templates\O{random numbers}Z\service.exe
%User Profile%\Templates\O{random numbers}Z\winlogon.exe

It drops copies of itself into folders whose names contain the following strings:

upload
download
shared

Autostart Technique

This worm adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
T{random numbers}TT4 = "%System%\{random numbers}I.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
T{random numbers} = "%Windows%\sa-{random numbers}.exe"

It enables its automatic execution at every system startup by dropping the following copies of itself into the Windows Common Startup folder:

%User Startup%\sql.cmd

(Note: %User Startup% is the current user's Startup folder, which is usually C:\Documents and Settings\{user}\Start Menu\Programs\Startup on Windows 2000 and XP, and C:\Documents and Settings\{User name}\Start Menu\Programs\Startup on Windows Vista, 7, and 8.)

Other System Modifications

This worm adds the following registry keys:

HKEY_CURRENT_USER\Software\VB and VBA Program Settings

HKEY_CURRENT_USER\Software\VB and VBA Program Settings\
noGods

HKEY_CURRENT_USER\Software\VB and VBA Program Settings\
noGods\appActive

HKEY_CURRENT_USER\Software\VB and VBA Program Settings\
untukmu

HKEY_CURRENT_USER\Software\VB and VBA Program Settings\
untukmu\version

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
TUX

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
TUX\biang

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
TUX\Path

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
System

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
msconfig.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
regedit.exe

It adds the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
TUX\biang
1 = "{random numbers}"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
TUX\biang
2 = "{random numbers}"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
TUX\biang
3 = "{random numbers}"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
TUX\biang
4 = "{random numbers}"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
TUX\biang
5 = "{random numbers}"

HKEY_CURRENT_USER\Software\VB and VBA Program Settings\
noGods\appActive
service.exe = {data}

HKEY_CURRENT_USER\Software\VB and VBA Program Settings\
noGods\appActive
winlogon.exe = {data}

HKEY_CURRENT_USER\Software\VB and VBA Program Settings\
noGods\appActive
smss.exe = {data}

HKEY_CURRENT_USER\Software\VB and VBA Program Settings\
noGods\appActive
EmangEloh.exe = {data}

HKEY_CURRENT_USER\Software\VB and VBA Program Settings\
untukmu\version
me = "4"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
System
DisableRegistryTools = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
TUX\Path
1 = "M{random numbers}"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
TUX\Path
2 = "O{random numbers}Z"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
TUX\Path
3 = "X{random numbers}go"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
msconfig.exe
debugger = "%WINDOWS%\notepad.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
regedit.exe
debugger = "%WINDOWS%\notepad.exe"

It modifies the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
Hidden = 0