Hello everyone, today we're taking a look at the Tractor Word trojan.
This is a trojan written in Microsoft Word's Visual Basic macro language,
and activates right as soon as you pretty much open up
the document. So, I'm gonna set up a reason as to
why an unsuspecting user would be opening this random
document from me.
Let's pretend that I own a recipe website.
And now, after a few years of running that website,
I am just tired of making new recipes.
There's so many competing sites, I just really don't
wanna do it anymore.
So I make you a deal on all my recipe pages.
Instead of reading 16 pages of horrendously boring
backstory about my life growing up on a farm in
southwest Minnesota,
you can simply download the document which has the recipe
in it right there. Sounds pretty good, right?
[note: did not actually live in Minnesota. or on a farm. Never happened. Don't ask me how to grow things.]
Let's give it a shot.
Alright, heeeere's Tractor!
[Clippy, and myself, are unimpressed]
Where's the recipe?! There's nothing here!
Oh but rest assured, there is something there.
If we take a look at the code in our macro...
...we can see that the very first thing it does
is create a new file in the Windows directory called
Tractor.VBS.
Is it there?
[suspense building]
Oh hey look! There it is, Tractor.VBS.
If we edit it we can see that we're creating some...
interesting named uh....registry keys.
And looks like we're counting til 4, that's not very high.
But we're gonna go ahead and restart so we can get that
VBS script to launch on startup.
We're also using Windows Me cuz, why not?
[the horror]
It's been a long time.
[Bubbles, the best wallpaper, makes an appearance. Please pay your respects to Bubbles.
For whatever reason, I set Bubbles as the background
first, and then that flower one,
and it always seems to wanna show Bubbles
before this one loads.
Maybe cuz it's an Active Desktop or whatever?
I dunno. If you know, you can let me know.
[I'm counting on you, this is important, this means something]
So we now have that Tractor.VBS script running,
but nothing appears to be happening.
We're gonna take a look at Regedit real quick.
[Model M clack clack clack type type type]
[enter click]
HKEY/Current User where we now have Tractor,
with our, uh, interestingly named key.
And then we have a count
which is now set to zero,
and we know we're counting until it's four.
But we're gonna time travel so I don't have to
reset four times to get there.
Every time you reset, this increments by one.
[very ominous, what could it be doing??]
So you get four resets before
Tractor does what it's going to do.
So there we go, we are now primed and ready
to see what Tractor does. We have all these lovely
files....don't get used to 'em.
They're not gonna be there for very long.
Let's reset once more.
[CD drive whirs, Windows Me boots boringly]
Okay here we go, there's Bubbles!
[yay!]
And here comes Windows Me.
[boo!]
Ah there's our flower.
Great, nothing seems to have gone wr- what.
What did that say?
[I have a bad feeling about this]
[reading] "Furious Tractor Driver has just destroyed your DATA."
"HA, ha, "
"Ha...haha."
That doesn't sound good.
Hmm, we seem okay for now.
All of our stuff is still here, which is good.
I think we are good to just clear out of this box.
Okay [click]
[rip furious tractor driver]
...Did something disappear?
Uh oh.
Are things...disappearing?
I can hear my hard drive running.
I'm just gonna let it sit right - oop - - oh no.
This cannot be good.
[it's fine, those were filler Windows files, you didn't need them. 99% of stuff in the Windows directory is just fluff added to get you to buy a bigger hard drive, WAKE UP PEOPLE]
Hmm...I have a bad feeling about that Furious Tractor Driver.
[reading] "The toolbar is no longer available. This folder"
er, "THE folder this toolbar was created from has been deleted."
Hmm...our Office toolbar is dead.
[rip 2 - rip harder]
Well...
Hey look, our files came back!
Clearly that's all that's supposed to be here, right?
Things are looking up!
Let's play some solitaire!
[futile keyboard clack clack clack]
NOOOooooo it's GONE
[his smile and optimism, gone]
So if you noticed in the code,
when that counter reaches 4, and the computer reboots,
Tractor takes control to do a deltree command,
Which is why we're using Windows Me.
It only works on flavors of Windows 9x, so 95, 98, and Me.
And it iterates through your hard drive and deletes everything it can
:(
The files you see left are the ones it was not able to delete.
So, since our system is now thoroughly hosed,
let's reboot!
All from one Word document.
Hey, Bubbles is still there!
Bubbles made it, I'm so proud.
Gonna miss you, Bubbles.
[F in the chat for Bubbles]
"Invalid system disk. Replace the disk, and then press any key."
Which means your operating system is toast.
And I do apologize that there was no boot up sequence
with a nice seek test or anything like that in this video.
This computer does not do a very loud one.
First of all, it's set to quick boot, but if you'd like a nice piece of
Dan trivia, this is actually the Pentium 4 Gateway PC I used
allll the way back in my very first videos.
It's falling to pieces but it's still alive and kickin'.
[same tbh]
And that is about it for the Tractor MS Word trojan.
Thank you very much for watching,
take care. :)