VBS/Jenxcus

Installation

VBS/Jenxcus installs itself in any of the following folders:

• %APPDATA%
• %ProgramData%
• <startup folder>
• %TEMP%
• %USERPROFILE%
• %windir%

This threat can be installed with any of these file names:

• crypted.vbs
• do.vbs
• file.vbs
• Kj-w0rm.vbs
• nj-worm.vbs
• servieca.vbs
• smss-DoOoMs.vbe
• smss-DoOoMs.vbs
• system32.vbs
• Taakj2005.vbs
• temp.vbs
• w0rm.vbs

It changes the following registry entry so that it runs each time you start your PC:

In subkey: HKLM\Software\Microsoft\Windows\CurrentVersion\Run or HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Sets value: "<malware file name>"
With data: "<malware folder and file name>"

For example:
In subkey: HKLM\Software\Microsoft\Windows\CurrentVersion\Run or HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Sets value: "Serviecs.vbs"
With data: "%TEMP%\Serviecs.vbs"

In subkey: HKCU\Software\Microsoft\Windows\CurrentVersion\Run or  HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Sets value: "<malware file name>"
With data: "wscript.exe //B <malware file name>"

In subkey: HKCU\Software\Microsoft\Windows\CurrentVersion\Run or  HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Sets value: "<legitimate process name>"
With data: ""<legitimate process>" /minimized /regrun, wscript.exe //B "<malware folder and file name.lnk>""

For example:
In subkey: HKCU\Software\Microsoft\Windows\CurrentVersion\Run or  HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Sets value: "Skype"
With data: ""%ProgramFiles%\Skype\Phone\Skype.exe" /minimized /regrun, wscript.exe //B "%temp%\\Media Player\smss-DoOoMp.lnk""

In subkey: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
Sets value: "<malware folder and file name>"
With data: "explorer.exe, wscript.exe //B "<malware folder and file name>"

In subkey: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
Sets value: "<malware folder and file name>"
With data: "<system folder>\userinit.exe,wscript.exe //B "<malware folder and file name>"

Spreads through...

If this worm detects a removable drive connected to your PC, it copies itself into every folder in that drive. It also creates a shortcut link pointing to its copy in the removable drive.

Typically, this threat gets onto your PC from a drive-by download attack. It might also have installed itself onto your PC if you visit a compromised webpage or if you use an infected removable drive.

The threat drops the malicious file in the infected removable drive with any of these names:

• help.vbs
• njq8.vbs
• Servieca.vbs
• Serviecs.vbs

Payload

Gives a malicious hacker access and control of your PC

VBS/Jenxcus can give a malicious hacker access and control of your PC to:

• Close the malware
• Display message boxes
• Do a DoS or DDoS attack
• Download and execute other malware (like Bitcoin Miner)
• Open webpages
• Restart the malware
• Run files
• Run remote shell
• Shutdown, logoff, and restart your system
• Start Live Quran site
• Steal your online user names and passwords and the URL you entered them on
• Terminate antivirus related processes for example, SpyTheSpy.exe, TiGeR-Firewall.exe, and bavtray.exe
• Uninstall the malware
• Update files

Some variants of this malware have anti-VM checking capabilities and can terminate and uninstall itself when found to be running in a VM environment.

It also sends information about your PC to a malicious hacker, such as the following:

• Active windows
• Antivirus product installed
• CPU information
• Firewall information
• GPU information
• Hardware identification
• Installed .NET and its version
• IP address visited
• Malware installed date
• Operating system
• Passwords
• Processor information
• Product name, productI D, and product key
• Size of RAM
• USB drives
• User names

It also steals the following information:

• No-IP/DUC passwords
• Chrome-stored passwords
• FileZilla passwords

This worm can connect to the following domains using a random port:

Additional Information

See the Win32/Jenxcus family description for more information.

Analysis by Donna Sibangan