VirusW32/Brontok.BZ@mm
Analysis
- Creates the folder Bron.tok-[Number]-[Number] under the undefinedUser Profileundefined\Local Settings\Application Data folder.
- Creates the following copies of itself:
- undefinedUser Profileundefined\Local Settings\Application Data\csrss.exe
- undefinedUser Profileundefined\Local Settings\Application Data\inetinfo.e
- undefinedUser Profileundefined\Local Settings\Application Data\lsass.exe
- undefinedUser Profileundefined\Local Settings\Application Data\services.e
- undefinedUser Profileundefined\Local Settings\Application Data\smss.exe
- undefinedUser Profileundefined\Local Settings\Application Data\winlogon.exe
- undefinedUser Profileundefined\Local Settings\Start Menu\Programs\Startup\Empty.pif
- undefinedWindowsundefined\eksplorasi.exe
- undefinedSystemundefined\{User}'s Setting.scr
- undefinedUser Profileundefined\Templates\WowTumpeh.com
- undefinedWindowsundefined\ShellNew\bronstab.exe
The last two files are hidden.
- Creates the file At1.job in the undefinedWindowsundefined\Tasks folder. This enables the Windows Scheduler to run the file WowTumpeh.com every day at 9:00 am.
- Uses its own SMTP engine to send itself to email addresses that it finds.
Registry Modification
- Creates the following registry entries to automatically execute itself during startup:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Tok-Cirrhatus = "undefinedUser Profileundefined\Local Settings\Application Data\smss.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Bron-Spizaetus = "undefinedWindowsundefined\ShellNew\bronstab.exe" - Modifies the following registry entry to automatically execute itself during startup:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Shell = "Explorer.exe "undefinedWindowsundefined\eksplorasi.exe"" (The default is "Explorer.exe") - Disables registry editing tools by adding the following registry entry:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System
DisableRegistryTools = dword:00000001 - Adds the following registry entry:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System
This has no effect on the system.
DisableCMD = dword:00000000
- Removes the Folder Options item from all Windows Explorer menus by adding the following registry entry:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System
NoFolderOptions = dword:00000001 - Hides files that have the Hidden attribute by modifying the following registry entry:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
Hidden = dword:00000000 - Hides file extensions by modifying the following registry entry:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
HideFileExt = dword:00000001 - Hides files that have the System attribute by modifying the following registry entry:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
ShowSuperHidden = dword:00000001
Recommended Action
- FortiGate Systems
- Check the main screen using the web interface for your FortiGate unit to ensure that the latest AV/NIDS database has been downloaded and installed on your system - if required, enable the 'Allow Push Update' option.
FortiClient Systems
- Quarantine/delete files that are detected and replace infected files with clean backup copies.
Telemetry
Detection Availability
| FortiClient | |
|---|---|
| Extreme | |
| FortiMail | |
| Extreme | |
| FortiSandbox | |
| Extreme | |
| FortiWeb | |
| Extreme | |
| Web Application Firewall | |
| Extreme | |
| FortiIsolator | |
| Extreme | |
| FortiDeceptor | |
| Extreme | |
| FortiEDR |