Worm:Win32/Scrimge.A

Installation

• Copies itself to <System>\dllcache\jucheck.exe and sets this file's attributes to read-only, hidden and system. It also attempts to set the time stamp of this file to the same as that of explorer.exe. However, this action failed in our laboratory testing.
• Creates a mutex object called "1xcam0isluvedbyus". The worm subsequently performs checks for the presence of this mutex object. If the mutex does not exist, the worm assumes that it is no longer running and re-launches itself by executing <System>\dllcache\jucheck.exe.
• Modifies the registry to run itself at each Windows start:
  Adds value "jucheck"
  With data: "<System>\dllcache\jucheck.exe"
  To subkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
• Modifies the registry to store the filename of the original copy of the worm's executable:
  Adds value "MSNPRC"
  With data: "<original malware file name>"
  To subkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions
• Drops the file "%windir%\picts-<number>.zip", where <number> is a randomly generated 4 digit number, e.g. "picts-3293.zip". This ZIP archive contains a copy of the worm with the file name "img0794-www.photoshare.com". The worm uses this file when spreading via MSN Messenger.
• Injects code into explorer.exe that opens the file <System>\dllcache\jucheck.exe and keeps it open, thus preventing it from being modified or removed.

Spreads via…

Payload

• Update itself
• Download additional files
• Kill any process and delete the associated file from disk
• Spread via MSN Messenger

Additional Information