Threat behavior
Worm:Win32/Brontok.BU@mm is a mass-mailing e-mail worm that spreads by sending a copy of itself as an e-mail attachment to e-mail addresses that it gathers from files on the infected computer. Worm:Win32/Brontok.BU@mm can also copy itself to USB and pen drives. This worm can disable antivirus and security software, immediately terminate certain applications, and cause Windows to restart immediately when certain applications run. This worm may conduct denial of service (DoS) attacks against certain Web sites.
In most cases, Worm:Win32/Brontok use the Windows 'new folder' icon for the worm files. By default, Windows suppresses the extension on executable files. Even if this feature has been disabled, Worm:Win32/Brontok variants disable executable file extension viewing. This, in conjunction with the use of the 'new folder' icon, can cause the file to appear as if it were a new folder rather than an executable file. An unsuspecting user clicking on the "folder" to view its contents thereby inadvertently runs the worm file. To further promote the impression that the worm file is merely a folder, a new Explorer window is opened when the worm is run.
When Worm:Win32/Brontok.BU@mm is run, it performs the following actions:
-
Drops copies of itself to various folders:
%AppData%\winlogon.exe
%AppData%\services.exe
%AppData%\lsass.exe
%AppData%\inetinfo.exe
%AppData%\csrss.exe
%AppData%\smss.exe
%UserProfile%\Start Menu\Programs\Startup\Empty.pif
%UserProfile%\Templates\Brengkolang.com
%WinDir%\eksplorasi.exe
%WinDir%\ShellNew\sempalong.exe
<system folder>\%UserName%'s Setting.scr
-
Copies itself to network shares and removable drives
-
Gathers e-mail addresses from files with these file extensions:
.HTML
.HTM
.TXT
.EML
.WAB
.ASP
.PHP
.CFM
.EML
.CSV
and does not gather e-mail addresses containing any of these strings:
PLASA
TELKOM
INDO
.CO.ID
.GO.ID
.MIL.ID
.SCH.ID
.NET.ID
.OR.ID
.AC.ID
.WEB.ID
.WAR.NET.ID
ASTAGA
GAUL
BOLEH
EMAILKU
SATU
-
Constructs e-mail addresses using a table of data to form specific elements:
From: (any of the following, where # is a random number)
Berita_# @ kafegaul.com
GaulNews_# @ kafegaul.com
Movie_# @ playboy.com
HotNews_# @ playboy.com
Subject: (blank)
Attachment filename: (any of the following)
winword.exe
kangen.exe
ccapps.exe
syslove.exe
untukmu.exe
myheart.exe
my heart.exe
jangan kibuka.exe
Message body (HTML format)
BRONTOK.A[10] [ By: HVM31 -- JowoBot #VM Community ]
-- Hentikan kebobrokan di negeri ini --
1. Penjarakan Koruptor, Penyelundup, Tukang Suap, & Bandar NARKOBA
( Send to "NUSAKAMBANGAN")
2. Stop Free Sex, Aborsi, & Prostitusi
( Go To HELL )
3. Stop pencemaran lingkungan, pembakaran hutan & perburuan liar.
4. SAY NO TO DRUGS !!!
-- KIAMAT SUDAH DEKAT --
Terinspirasi oleh:
Elang Brontok (Spizaetus Cirrhatus) yang hampir punah
[ By: HVM31 ]
-- JowoBot #VM Community --
!!! Akan Kubuat Mereka (VM lokal yg cengeng & bodoh) Terkapar !!!
-
Terminates processes containing any of these file names:
mcvsescn.exe
poproxy.exe
avgemc.exe
ccapps.exe
tskmgr.exe
syslove.exe
xpshare.exe
riyani_jangkaru.exe
systray.exe
-
Checks for Internet connectivity by testing connection attempts to the Web sites Google or Yahoo
-
Downloads a replacement hosts file from remote Web sites - the replacement hosts file blocks attempts to visit numerous security Web sites
-
Replaces the contents of c:\autoexec.bat with the Batch instruction "pause" such that at boot-up, the computer will pause with the message "Press any key to continue…". The boot-up window may not be visible, or is overshadowed by the Windows boot-up bitmap image, causing the system to appear in a hung state.
-
Modifies the registry to start the worm at each Windows startup:
Adds value: Tok-Cirrhatus
With data: %AppData%\smss.exe
To subkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Adds value: Bron-Spizaetus
With data: %WinDir%\ShellNew\sempalong.exe
To subkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Modifies value: Shell
With data: Explorer %WinDir%\exsplorasi.exe
To subkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
- Adds a scheduled task to run %UserProfile%\Templates\Brengkolang.com each day at 5:08 p.m.
Worm:Win32/Brontok.BU@mm may attempt to lower security settings by making the following changes:
-
Prevents the user from accessing the Registry Editor by making the following registry edit:
Adds value: DisableRegistryTools
With data: 1
In subkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System
-
Prevents the display of files and folders with the 'hidden' attribute set:
Adds value: Hidden
With data: 0
In subkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
-
Prevents the display of Windows system files:
Adds value: ShowSuperHidden
With data: 0
In subkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
Adds value: HideFileExt
With data: 1
In subkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
-
Prevents access to the Folder Options menu:
Adds value: NoFolderOptions
With data: 1
In subkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
Worm:Win32/Brontok.BU@mm may perform these additional actions:
-
Modifies the Windows HOSTS file to prevent access to certain Internet sites, the majority of which are antivirus or security-related.
-
Attempts ping attacks against certain Web sites, presumably to launch a form of denial of service (DoS) attack.
Prevention
