Home / malware Worm:Win32/Autorun.gen!AED
First posted on 10 February 2012.
Source: MicrosoftAliases :
Worm:Win32/Autorun.gen!AED is also known as Win32/Hipo.worm.983552 (AhnLab), W32/Zbot.I.gen!Eldorado (Command), Worm.Win32.Hipo.a (Kaspersky), Hipo.A (Norman), Worm.Hipo!1sdKR0VhQdc (VirusBuster), Win32.HLLP.Autoruner (Dr.Web), Win32/Mocalo.NAC worm (ESET), Worm.Win32.Hipo (Ikarus), W32/Autorun.worm.beg (McAfee), WORM_STRAT.GEN-3 (Trend Micro).
Explanation :
Worm:Win32/Autorun.gen!AED is the worm component of Backdoor:Win32/Poison.E. Variants of Worm:Win32/Autorun usually spread using methods that include, but may not be limited to, copying themselves to removable or network drives, and placing an autorun.inf file in the root directory of each affected drive in an attempt to ensure that the worm is run when the removable drive is attached, or the network drive is visited from a remote system supporting the Autorun feature.
In the wild, Worm:Win32/Autorun.gen!AED has been observed to be packaged with two components: a clean application (usually a program called "Resource Hacker") and Backdoor:Win32/Poison.E. The package containing all three components is usually created by a tool detected as Virtool:Win32/Obfuscator.C.
Top
Worm:Win32/Autorun.gen!AED is the worm component of Backdoor:Win32/Poison.E. Variants of Worm:Win32/Autorun usually spread using methods that include, but may not be limited to, copying themselves to removable or network drives, and placing an autorun.inf file in the root directory of each affected drive in an attempt to ensure that the worm is run when the removable drive is attached, or the network drive is visited from a remote system supporting the Autorun feature.
Installation
In the wild, Worm:Win32/Autorun.gen!AED has been observed to be packaged with two components: a clean application (usually a program called "Resource Hacker") and Backdoor:Win32/Poison.E. The package containing all three components is usually created by a tool detected as Virtool:Win32/Obfuscator.C.
When executed, Worm:Win32/Autorun.gen!AED copies the package as the following:
<system folder>\winmain.exe
Note: <system folder> refers to a variable location that is determined by the malware by querying the operating system. The default installation location for the system folder for Windows 2000 and NT is C:\Winnt\System32; and for XP, Vista, and 7 is C:\Windows\System32.
It modifies the following registry entries to ensure that the package copy executes at each Windows start:
In subkey: HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Sets value: "Framework"
With data: "<system folder>\winmain.exe 6666"
Spreads via...
Removable drives
Worm:Win32/Autorun.gen!AED drops copies of the package in removable and network drives, for example:
<drive:>\autorun.exe
It also places an "autorun.inf" file in the root folder of the targeted drive. Such files contain execution instructions for the operating system, so that when the removable drive is accessed from another computer supporting the Autorun feature, the malware is launched automatically.
Payload
Modifies system settings
Worm:Win32/Autorun.gen!AED hides files with the "hidden" attribute by modifying the following registry entry:
In subkey: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
Set value "Hidden"
With data: "0"
Analysis by Edgardo Diaz
Last update 10 February 2012
