Worm.Win32.HERMWIZ.YECCA

它以其他恶意软件释放的文件或用户访问恶意网站时不知不觉下载的文件的形式到达系统。

新病毒详细信息

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

安装

它植入下列文件：

• Once it establishes a connection to an IP within its network:
  • {Malware File Path}\{Random 2}.ocx - module used for SMB propagation and execution to the remote machine
  • {Malware File Path}\{Random 3}.ocx - module used for WMI propagation and execution to the remote machine
• {Malware File Path}\{c{12 Random Characters}}.dll - copy of itself

它植入和执行下列文件：

• {Malware File Path}\{Random 1}.ocx - Disk Wiper

它添加下列进程：

• Once a connection to an IP address is established:
  • %System%\regsvr32.exe {Malware File Path}\{Random 2}.ocx #1 -s {Malware File Path}\{c{12 Random Characters}}.dll -i {Target IP Address}
  • %System%\regsvr32.exe {Malware File Path}\{Random 3}.ocx #1 -s {Malware File Path}\{c{12 Random Characters}}.dll -i {Target IP Address}

(注意: %System% 是 Windows 的 system 文件夹，通常位于 C:\Windows\System (Windows 98 和 ME)、C:\WINNT\System32 (Windows NT 和 2000) 和 C:\WINDOWS\system32 (Windows 2000(32-bit)、XP、Server 2003(32-bit)、Vista、7、8、8.1、2008(64-bit),2012(64bit) 和 10(64-bit))。)

其他详细信息

该程序执行以下操作：

• It obtains IP addresses within the local network via:
  • Obtaining the physical address mapping table
  • Enumerating servers in the domain
  • Obtaining the TCP Table
  • Adapters addresses
• It tries to establish a connection on the IP addresses obtained and copy itself remotely.