Threat Database Worms W32.Winiga

W32.Winiga

By JubileeX in Worms

Threat Scorecard

Ranking: 1,669
Threat Level: 20 % (Normal)
Infected Computers: 21,792
First Seen: April 4, 2012
Last Seen: September 20, 2023
OS(es) Affected: Windows

W32.Winiga is a computer worm that uses removable drives to spread itself. W32.Winiga also aims at stealing information from the targeted computer. Once executed, W32.Winiga creates the specific files on all removable drives. W32.Winiga also drops and runs a possibly malevolent files from the web. W32.Winiga then creates the certain registry entry so that it can launch whenever you turn your computer on. W32.Winiga also creates more registry entries. W32.Winiga tries to avoid the Windows firewall by creating even more registry entries and runs the specific command '[netsh firewall add allowed program]' to change the firewall settings. W32.Winiga also collects and transmits the particular information by email to remote attackers including IP address, IP host name, Windows version and many other.

File System Details

W32.Winiga may create the following file(s):
# File Name Detections
1. %SystemDrive%\Winis7\opera.exe
2. %DriveLetter%\new.exe
3. %SystemDrive%\Winis7\Data\sss.col

Registry Details

W32.Winiga may create the following registry entry or registry entries:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\"AbGame" = "%SystemDrive%\Winis7\opera.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"AbGame" = "%SystemDrive%\Winis7\opera.exe"
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers\"%SystemDrive%\Winis7\opera.exe" = "ELEVATECREATEPROCESS"
List\"%SystemDrive%\Winis7\opera.exe"= "%SystemDrive%\Winis7\opera.exe:*:Enabled:Sudoku"
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run\"AbGame" = "%SystemDrive%\Winis7\opera.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices\"AbGame" = "%SystemDrive%\Winis7\opera.exe"
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers\"%System%\cmd.exe" = "RUNASADMIN"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\
\"%SystemDrive%\Winis7\opera.exe"= "%SystemDrive%\Winis7\opera.exe:*:Enabled:Sudoku"
HKEY_USERS\S-1-5-21-1390067357-1708537768-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Run\"AbGame" = "%SystemDrive%\Winis7\opera.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\"AbGame" = "%SystemDrive%\Winis7\opera.exe"
HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\"Sudoku" = "%SystemDrive%\Winis7\opera.exe"
HKEY_USERS\S-1-5-21-1390067357-1708537768-725345543-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache\"Sudoku" = "%SystemDrive%\Winis7\opera.exe"
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List

URLs

W32.Winiga may call the following URLs:

totaltopposts.com

Trending

Most Viewed

Loading...