Worm:Autoit/Sohanad.CL is a worm that spreads via mapped network drives. It may also spread via e-mail and Yahoo Messenger after receiving configuration data from a remote attacker. Worm:Autoit/Sohanad.CL also drops additional malware to an affected machine.
Installation
When executed, Worm:Autoit/Sohanad.CL drops the following files to an affected computer:
- %windir%\winhelp.ini - a file that contains configuration data utilized by the worm
- <system folder>\rundll.exe - detected as TrojanSpy:Win32/Vlogger.M
- <system folder>\comctl32.ocx - clean system file utilized by the worm
- <system folder>\ijl11pro.dll - clean system file utilized by the worm
- <system folder>\msinet.ocx - clean system file utilized by the worm
- <system folder>\regsvr.exe - a copy of Worm:Autoit/Sohanad.CL
- %windir%\regsvr.exe - a copy of Worm:Autoit/Sohanad.CL
- <system folder>\winhelp.exe - a copy of Worm:Autoit/Sohanad.CL
- <system folder>\setup.ini - configuration file used by the worm to automatically execute regsvr.exe
Worm:Autoit/Sohanad.CL deletes all scheduled tasks, and then creates a new scheduled task to run a copy of itself, <system folder>\winhelp.exe, every day at 9.00am.
It also modifies the following registry entries to execute both itself and TrojanSpy:Win32/Vlogger.M at each Windows start:
Adds value: "Shell"
With data: "explorer.exe rundll.exe"
To subkey: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Adds value: "Yahoo Messengger"
With data: "<system folder>\regsvr.exe"
To subkey: HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Spreads via…
Network and removable drives
Worm:Autoit/Sohanad.CL attempts to drop the following files to all accessible network or removable drives:
<target drive>\new folder.exe - a copy of Worm:Autoit/Sohanad.CL
<target drive>\regsvr.exe - a copy of Worm:Autoit/Sohanad.CL
<target drive>\subst.exe - a copy of Worm:Autoit/Sohanad.CL
Worm:Autoit/Sohanad.CL also writes an autorun configuration file named 'autorun.inf' in the same location pointing to one of the files listed above. When the removable or networked drive is accessed from another machine supporting the Autorun feature, the malware is launched automatically.
Payload
Modifies system settings
Worm:Autoit/Sohanad.CL makes a number of changes to the affected system's settings in order to facilitate the worm's actions by modifying the following registry entries:
Adds value: "NofolderOptions"
With data: "0"
To subkey: HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
Adds value: "DisableTaskMgr"
With data: "0"
To subkey: HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System
Adds value: "AtTaskMaxHours"
With data: "0"
To subkey: HKLM\SYSTEM\CurrentControlSet\Services\Schedule
Adds value: "GlobalUserOffline"
With data: "0"
To subkey: HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
Adds value: "shared"
With data: "\new folder.exe"
To subkey: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\WorkgroupCrawler\Shares
Contacts remote host/Downloads arbitrary files.
Worm:Autoit/Sohanad.CL attempts to connect to www.crackspider.net via TCP port 80 in order to download a configuration file. This information in this file may be used to determine how the worm spreads via Yahoo Messenger or e-mail.
Analysis by Jaime Wong
