Worm/Brontok.W.A - Worm

See also

Summary

Full description

Statistics

Virus:	Worm/Brontok.W.A
Date discovered:	21/08/2006
Type:	Worm
In the wild:	No
Reported Infections:	Low
Distribution Potential:	Medium
Damage Potential:	Low to medium
Static file:	Yes
File size:	98.304 Bytes
MD5 checksum:	892f49387317b9cf8a70dad3595db4e3
VDF version:	6.36.00.51
IVDF version:	6.36.00.62 - Tue, 26 Sep 2006 19:32 (GMT+1)

General Method of propagation:
   • Local network

Aliases:
   • Symantec: Hacktool.Spammer
   • Kaspersky: Email-Worm.Win32.Brontok.w
   • F-Secure: Email-Worm.Win32.Brontok.w
   • Sophos: W32/Brontok-BO
   • Grisoft: SpamTool.GW
   • Bitdefender: Win32.Brontok.AM@mm

It was previously detected as:
   • SPR/Spam.VB.aqn

Platforms / OS:
   • Windows 98
   • Windows 98 SE
   • Windows NT
   • Windows ME
   • Windows 2000
   • Windows XP
   • Windows 2003

Side effects:
   • Drops files
   • Lowers security settings
   • Registry modification

Files It copies itself to the following locations:
   • %WINDIR%\Kr0n1C.exe
   • C:\Kr0n1C.exe
   • %SYSDIR%\shell.exe
   • %SYSDIR%\MrHelloween.scr
   • %SYSDIR%\IExplorer.exe
   • %ALLUSERSPROFILE%\Start Menu\Programs\Startup\Empty.pif
   • %home%\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
   • %home%\Local Settings\Application Data\WINDOWS\CSRSS.EXE
   • %home%\Local Settings\Application Data\WINDOWS\SERVICES.EXE
   • %home%\Local Settings\Application Data\WINDOWS\LSASS.EXE
   • %home%\Local Settings\Application Data\WINDOWS\SMSS.EXE
   • C:\Kr0n1C\New Folder.exe
   • C:\Data %current username%.exe
   • C:\Data LocalService.exe
   • %current directory%\%current directory name%.exe

It creates the following directory:
   • C:\Kr0n1C

The following files are created:

– C:\Puisi.txt This is a non malicious text file with the following content:
   • Kr0n1C

     Tertatihku Meratap Perih
     Insan Hidup Terasa Mati
     Dan Bahagiapun Sirna Seiring Waktu
     Hanya Sepi Yang Mengisi Sendi - Sendi Kehidupanku

     Ini Semua Karena Dirimu
     Yang Selalu Mengiris Hatiku

     Hari Ini Aku Tetap Menanti
     Hadirmu Walau Hanya Mimpi

     Dan Kini Telah Kusadari
     Dirimu Hanya Ingin Menyakitiku
     Hadirmu Hanya Akan Binasakanku
     Saat Ini Dan Sampai Alam Yang Abadi


      Cyber.nu

– %WINDIR%\msvbvm60.dll
– %SYSDIR%\msvbvm60.dll
– C:\Kr0n1C\Folder.htt
– C:\desktop.ini

Registry The following registry keys are added in order to run the processes after reboot:

– [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
   • "Kr0n1C"="%WINDIR%\Kr0n1C.exe"
   • "Service%current username%"="%home%\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
   • "MSMSGS"="%home%\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"

– [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   • "Logon%current username%"="%home%\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
   • "System Monitoring"="%home%\Local Settings\Application Data\WINDOWS\LSASS.EXE"
   • "LogonLocalService"="%home%\Local Settings\Application Data\WINDOWS\CSRSS.EXE"

The following registry keys are changed:

– [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot]
   Old value:
   • "AlternateShell"="cmd.exe"
   New value:
   • "AlternateShell"="%WINDIR%\Kr0n1C.exe"

– [HKCR\comfile\shell\open\command]
   Old value:
   • @="%1" %*
   New value:
   • @="%SYSDIR%\shell.exe" "%1" %*"

– [HKCR\batfile\shell\open\command]
   Old value:
   • @="%1" %*
   New value:
   • @="%SYSDIR%\shell.exe" "%1" %*"

– [HKCR\piffile\shell\open\command]
   Old value:
   • @="%1" %*
   New value:
   • @="%SYSDIR%\shell.exe" "%1" %*"

– [HKCR\lnkfile\shell\open\command]
   Old value:
   • @="%1" %*
   New value:
   • @="%SYSDIR%\shell.exe" "%1" %*"

– [HKCR\exefile\shell\open\command]
   Old value:
   • @="%1" %*
   New value:
   • @="%SYSDIR%\shell.exe" "%1" %*"

– [HKCR\exefile]
   Old value:
   • @="Application"
   New value:
   • @="File Folder"

Various Explorer settings:
– [HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
   Old value:
   • "Hidden"=%user defined settings%
   • "HideFileExt"=%user defined settings%
   • "ShowSuperHidden"=%user defined settings%
   New value:
   • "Hidden"=dword:00000000
   • "HideFileExt"=dword:00000001
   • "ShowSuperHidden"=dword:00000000

– [HKCU\Control Panel\Desktop]
   Old value:
   • "SCRNSAVE.EXE"=%user defined settings%
   • "ScreenSaverIsSecure"=%user defined settings%
   New value:
   • "SCRNSAVE.EXE"="%SYSDIR%\MRHELL~1.SCR"
   • "ScreenSaverIsSecure"="0"

– [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
   Old value:
   • "Shell"="Explorer.exe"
   • "Userinit"="%SYSDIR%\userinit.exe"
   New value:
   • "Shell"="Explorer.exe "%SYSDIR%\IExplorer.exe""
   • "Userinit"="%SYSDIR%\userinit.exe,%SYSDIR%\IExplorer.exe"

Various Explorer settings:
– [HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
   Old value:
   • "NoFolderOptions"=%user defined settings%
   New value:
   • "NoFolderOptions"=dword:00000001

– [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug]
   Old value:
   • "Auto"="1"
   • "Debugger"="drwtsn32 -p %ld -e %ld -g"
   New value:
   • "Auto"="1"
   • "Debugger"="%SYSDIR%\Shell.exe"

Disable Regedit and Task Manager:
– [HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System]
   Old value:
   • "DisableCMD"=%user defined settings%
   • "DisableTaskMgr"=%user defined settings%
   • "DisableRegistryTools"=%user defined settings%
   New value:
   • "DisableCMD"=dword:00000001
   • "DisableTaskMgr"=dword:00000001
   • "DisableRegistryTools"=dword:00000001

– [HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore]
   Old value:
   • "DisableConfig"=%user defined settings%
   • "DisableSR"=%user defined settings%
   New value:
   • "DisableConfig"=dword:00000001
   • "DisableSR"=dword:00000001

– [HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer]
   New value:
   • "LimitSystemRestoreCheckpointing"=dword:00000001
   • "DisableMSI"=dword:00000001

– [HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\
   CabinetState]
   New value:
   • "FullPath"=dword:00000001

Process termination Processes containing one of the following window titles are terminated:
• TASK; REG; ASM; DBG; W32; PROC; WALK; REST; AVS; OPTIONS; ANTI; VIRUS;
RegEdit; Registry Editor; Folder Options; Local Settings

File details Programming language:
The malware program was written in Visual Basic.

See a brief description here.

Description inserted by Adriana Popa on Tue, 19 Sep 2006 13:53 (GMT+1)
Description updated by Adriana Popa on Fri, 22 Sep 2006 12:52 (GMT+1)

» About Malware
» About Phishing
» Viruses In the Wild

« back