All right guys, this is the San Windows worm.
Written in Visual Basic script, it arrives on your system not as an attachment,
but as an embedded signature in Outlook Express emails.
And it actually spreads using the same vulnerability as the KAK worm
where it adds this signature and when you either preview or open the email it automatically infects your system.
So it's pretty neat.
So we're gonna go ahead and run it
We'll see if it actually runs... Okay.
Yeah we'll void the script.
And here we go, here's the uh, here's what you would see.
It's a fake MS-DOS window.
And it's not doing anything other than infecting your system right now.
Go ahead and run it again.
Get the same deal.
If we go ahead and check Outlook Express, in the options, we'll go to signatures
and you'll see we have a new signature called Firma 1.
And as you can see, the file is index.html.
If we open that file, we actually won't see anything.
Doesn't show up, but we can open it.
It's not the default signature or anything, this is added by the worm.
Is it System, all files...
Index, here you are. Open it.
And we can't see anything.
If we navigate to the file...
I'm not sure how big it is, but I'm assuming it's not zero bytes,
considering it needs to spread.
Or maybe the worm has stopped, and didn't actually write anything to that file.
We'll see.
Oops... Where are we...
Index, here you are.
Properties...Oh, it is a zero byte file.
Okay. So the worm is supposed to write its, uh, spreading routine here so that it can embed it in all outgoing emails from Outlook Express.
However, it appears to have failed to do that. It just created an empty file that doesn't do anything.
But just pretend like this worm is going to infect your machine. It's gonna be really bad.
Now let's get to the fun part, the payload.
Activates on the 8th, 14th, 23rd or 29th of every month when it deletes every single file on your computer.
Let's go ahead and do the 8th.
We'll go and open My Computer real quick, because it has another component of the payload.
As you can see, all of our folders are properly named, we've got My Documents, Program Files, Windows,
all the Windows folders are properly named.
But this virus--or worm, rather--won't have any of that.
So we'll go ahead and run it again.
We can't see the disk activity LED on the virtual machine, but it is going full-time now
as it's deleting all your files.
And you can see, we get this same kind of grey desktop and "desktop is not accessible"
as we did with the Arctic Bomb trojan.
Go ahead and close out of this. And now we can see it's renamed
or added new folders for us. My Documents has been renamed to
My Documents happy san valentine happy san valentine happy san valentine happy san valentine.
And they all have varying amounts of "happy san valentine" added on to the end here.
And same with the Windows folder,
see, all these folders have been--most of the folders have been renamed, I'm assuming the ones that aren't in use.
Got Cookies and we've got Cookies happy san valentine.
We see most of our files are still here, can we run them?
Yeah, apparently we can.
Uh, not sure if it failed to delete--well, that's not working.
Defrag? That works.
DOS prompt? Yeah...
How about...
Oh, what are we doing? What are we installing?
Stop--no--Office, get outta here. No...
Office, what are you doing? Get outta here. Okay.
See what else we got. Hardware info? Doesn't do anything.
Eh? Ah. Get outta here. What are we doing?
What are we doin'?
Notepad? Okay.
Seems to work. Paintbrush?
No Paintbrush. All right.
So let's do the fun part. Let's restart, now that our machine has been crippled. And see what happens.
Takes a little longer to restart than normal.
All right, and can't find a device driver--mainly for the virtual machine editions.
Can't find another one. Another one. Another one, and--oh, cannot initialize Windows.
We are out of memory.
Which we shouldn't be, 'cause we didn't change anything.
So that's a bad sign. If we hit enter, it'll just shut down your machine, and just kill the virtual machine.
If we try booting again, I'm sure it'll do the same thing.
Oh, oh, let's try Safe Mode.
Oh, no, no, it's not liking it...
Yeah, okay, we still can't boot into Windows.
Let's try booting into the DOS prompt, see what happens.
Command Prompt.
So, SYSINI.exe is missing, so our virtual machine editions at least have been deleted.
So what do we got?
We got all our regular files here...
"type autoexecute.bat"
And there's just our virtual editions line,
there's nothing else added that would be taking up memory and preventing Windows from starting.
So I'm gonna go ahead and say this machine is pretty much done for.
Look over here...See if we can actually run Paintbrush.
Well, it still knows that it can't be run in DOS mode, but...
If we try to boot Windows... No, it's not happening.
As you can see, you're pretty much just gonna have to reinstall Windows at this point.
Unless you can figure out some way to undo this damage.
Which I really can't think of.
So... That's about it at this point. Installing Windows once again.
And that is about it for the San Windows worm.