Home / malware

PDF

Worm:Win32/Autorun.MBS

First posted on 24 August 2019.
Source: Microsoft

Aliases :

Worm:Win32/Autorun.MBS is also known as WORM_YAHLOVER.AZ, Trojan.Win32.Agent.dfas, W32/AutoRun-ABD, W32.Imaut.

Explanation :

Worm:Win32/Autorun.MBS is a worm - a self-propagating program that can spread itself from one computer to another. Worms may spread themselves via a variety of different channels in order to compromise new machines. Commonly, worms may spread directly by copying themselves to removable or network drives, or by attempting to exploit particular vulnerabilities on targeted machines. Worms also often attempt to spread via platforms that require user interaction in order to run. They may send themselves as an attachment to an email or an instant message, or send a link to a copy of themselves in the body of a message. In these cases the message needs to be convincing enough to encourage the victim to click on the link or attachment and run or download a copy of the worm. Installation When executed, Worm:Win32/Autorun.MBS copies itself to the following locations:
%windir%iexplorei.exe
iexplorei.exe
word.exe
Note - refers to a variable location that is determined by the malware by querying the Operating System. The default installation location for the System folder for Windows 2000 and NT is C:WinntSystem32; and for XP and Vista is C:WindowsSystem32.
The malware modifies the following registry entry/ies to ensure that its copy executes at each Windows start: Adds value: "Yahoo Messengger"
With data: "c:windowssystem32iexplorei.exe"
To subkey: HKCUSOFTWAREMicrosoftwindowscurrentversion
un
Adds value: "Shell"
With data: "explorer.exe iexplorei.exe"
To subkey: HKLMSOFTWAREMicrosoftWindows NTCurrentVersionWinlogon
The malware drops the following file(s) to an affected machine: autorun.ini - detected as Worm:Win32/Autorun!inf setting.ini
The malware attempts to create a scheduled Windows task that runs the worm at 9:00 am every day of the week, by running the following Windows shell command instruction:
cmd.exe /C AT /delete /yes
cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su WORD.exe Spreads Via… Removable drives Worm:Win32/Autorun.MBS copies itself to the following location/s on removable drives:
:i mat.exe
:iexplorei.exe
:subst.exe.

It also places an autorun.inf file in the root directory of the targeted drive. Such autorun.inf files contain execution instructions for the operating system, so that when the removable is accessed from another machine supporting the Autorun feature, the malware is launched automatically. Note: this worm was observed to write an executable and create an autorun.inf file on a targeted drive in our automated testing environment. This is particularly common malware behaviour, generally utilized in order to spread malware from machine to machine. It should also be noted that autorun.inf files on their own are not necessarily a sign of infection, as they are used by legitimate programs and installation CDs. Payload Terminates processes Worm:Win32/Autorun.MBS terminates the following processes should they be running on an affected machine: cmd.exe

Modifies system settings The malware modifies the affected computer system's settings by making the following changes to the registry: Sets value: "DisableTaskMgr"
With data: "1"
To subkey: HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
This modification disables the system utility Task Manager.
Contacts remote hosts The malware may contact the following remote hosts using port 80: setting10.t35.com
setting11.t35.com
setting3.t35.com

Commonly, malware may contact a remote host for the following purposes: To confirm Internet connectivity To report a new infection to its author To receive configuration or other data To download and execute arbitrary files (including updates or additional malware) To receive instruction from a remote attacker To upload data taken from the affected computer This malware description was produced and published using our automated analysis system's examination of file SHA1 50673ed4b22f90a24217efc419d934a4f950b949. If you would like to comment on this analysis, please send your feedback to mmpc-amd@microsoft.com.

Last update 24 August 2019

 

TOP