Worm.Win32.HERMWIZ.YECCA

它以其他(tā)恶意软件释放的文(wén)件或用(yòng)户访问恶意网站时不知不觉下载的文(wén)件的形式到达系统。它开始执行然后再删除。

新(xīn)病毒详细信息

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

安(ān)装(zhuāng)

它植入下列文(wén)件：

• Once it establishes a connection to an IP within its network:
  • {Malware File Path}\{Random 2}.ocx - module used for SMB propagation and execution to the remote machine
  • {Malware File Path}\{Random 3}.ocx - module used for WMI propagation and execution to the remote machine
• {Malware File Path}\{c{12 Random Characters}}.dll - copy of itself

它植入和执行下列文(wén)件：

• {Malware File Path}\{Random 1}.ocx - Disk Wiper

它添加下列进程：

• Once a connection to an IP address is established:
  • %System%\regsvr32.exe {Malware File Path}\{Random 2}.ocx #1 -s {Malware File Path}\{c{12 Random Characters}}.dll -i {Target IP Address}
  • %System%\regsvr32.exe {Malware File Path}\{Random 3}.ocx #1 -s {Malware File Path}\{c{12 Random Characters}}.dll -i {Target IP Address}

(注意: %System% 是 Windows 的 system 文(wén)件夹，通常位于 C:\Windows\System (Windows 98 和 ME)、C:\WINNT\System32 (Windows NT 和 2000) 和 C:\WINDOWS\system32 (Windows 2000(32-bit)、XP、Server 2003(32-bit)、Vista、7、8、8.1、2008(64-bit),2012(64bit) 和 10(64-bit))。)

其他(tā)详细信息

该程序执行以下操作(zuò)：

• It obtains IP addresses within the local network via:
  • Obtaining the physical address mapping table
  • Enumerating servers in the domain
  • Obtaining the TCP Table
  • Adapters addresses
• It tries to establish a connection on the IP addresses obtained and copy itself remotely.