Worm:Win32/Qwizz.A

Worm:Win32/Qwizz.A is a dropper that executes a dropped Batch script worm, identified as Worm:Win32/Qwizz.A!bat. The worm may copy itself to networked shares, and download and execute other malware.

When Worm:Win32/Qwizz.A is run, it drops a Batch script worm into the %TEMP% folder and executes it within a shell command, as in the following:

 

cmd.exe /c %TEMP%\<random>.bat %windir%\<random>.bat

 

The Batch script worm is randomly named, such as 'bt7061.bat'. After being written to the Windows folder, it is then executed. It first verifies it is being run from the Windows folder, and if not then copies itself there. Next it attempts to schedule a task in order to run the Batch script automatically.

Networked Shares

This worm scans for connected computers across a network and attempts to write a copy itself to open shares.

Stops Services

This worm may attempt to stop the following services:

Security Centre

Internet Connection Sharing (ICS)

 

Downloads Malware

This worm may attempt to download and execute other programs from a remote FTP server named 'ftp.es.geocities.com' using TCP port 21. Files downloaded are saved into the Windows system folder as 'wzrd.exe' and 'system.exe'. Next, the Batch script attempts to schedule the downloaded malware to execute.

 

Analysis by Andrei Florin Saygo