TrendMicro analysePE_CHIR.B
(see also: description and solution)
Variant of: WORM_CHIR.A
In the wild: No
Payload 1: Spams email
Trigger condition 1: Upon execution
Payload 2: Overwrites .ADC, .R.DB, .DOC, or .XLS files
Trigger condition 2: Every 1st day of the month
Discovered: Jul. 29, 2002
Detection available: Jul. 30, 2002
Detected by pattern file #: 330
(still using 900-series pattern files?)
Detected by scan engine #: 5.200
Language:
English
Platform: Windows
Encrypted: No
Size of virus: 6,652 Bytes
Details:
This worm exploits a known vulnerability affecting systems running Microsoft Internet Explorer 5.01 and 5.5.
This exploit allows the automatic execution of email attachments without the user opening them. The Microsoft article, Incorrect MIME Header Can Cause IE to Execute Email Attachment, contains more information on this exploit.
Upon execution, this worm executes itself as another process. Since the creation of another process consumes additional memory resources, this behavior may cause the infected system to hang.
This worm then drops the file, RUNOUCE.EXE, in the System directory. This file has hidden, system, and read only attributes, therefore, it cannot be seen in Windows Explorer unless Windows Explorer is set to view hidden and system files.
It then creates a thread of itself, and registers it as a system process. The thread creates this registry entry to enable its automatic execution on every bootup:
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Run\
Runonce = “%System%\RUNOUCE.EXE”
It then checks whether the current drive is removable, fixed, remote, or a RAM drive. If so, it searches for files to infect.
When RUNOUCE.EXE executes, it creates a thread that restarts an instance of itself whenever the main process is terminated. This enables it to persistently stay in memory.
This worm drops several copies of the file README.EML on all directories and subdirectories. This file is actually a UUEncoded version of the worm.
(Note: UUencode is a universal protocol for sending files between different platforms. It is usually utilized for sending email attachments.)
If the infected system is connected to a network, this worm also drops copies of this UUE encoded version of the malware in shared folders with read and write access. It drops these copies to machines belonging to the same workgroup as the infected system.
Besides naming the copies as README.EML, this worm may also name them after the name of the infected sytem. For example, if the infected system's name is COMPUTER_NAME, the UUE encoded worm copies dropped can have the name COMPUTER_NAME.EML.
Some of the dropped EML files have been found to be malformed, and in this state the malware fails to work.
This worm infects files with the following extensions:
EXE
SCR
HTM
HTML
To avoid reinfecting infected files, it checks the first two Bytes of the target file’s code. If it is 0xE860, which are the first Bytes of the virus code, then it does not infect. If not, then this worm attaches its code at the end of the target file.
Its infection routine is highly similar to the infection technique of PE_NIMDA.A. It appends a script that opens the dropped file, README.EML. Trend Micro detects infected HTML files as JS_NIMDA.A.
On the 1st day of every month, this malware searches for files in all fixed drives with the following extensions and overwrites the first 4,660 bytes with random data:
ADC
R.DB
DOC
XLS
These overwritten files are thereby corrupted or damaged and can no longer be restored.
This worm sends this email to all addresses found in Windows Address Book files (.WAB) to propagate copies of itself:
From: imissyou@btmail.net.cn
Subject: is comming!
Message:
Attachment: PP.EXE
The infected email attachment is tagged as audio/x-wav content-type by this worm. Therefore, the default audio file player of the system where this email arrives attempts to open the attachment. Most Windows users have the Windows Media player as their default audio file player.
On infected systems running Windows NT 4.0, Windows 2000, and Windows XP, this malware runs the Net Send command to send the following text message to all computers belonging to the same workgroup:
My god! Some one killed ChineseHacker-2 Monitor
This malware creates a thread for every one-minute interval. Each thread runs the Net Send command and sends the text message. And since each thread consumes available memory resources, this behavior may cause the infected system to hang.
CVC电脑病毒论坛
引用回复帖子
