Multi-Device Licenses (Volume Discounts)

Change Region

English
Threat Database Worms Worm:JS/Beutanni.A

Worm:JS/Beutanni.A

By LoneStar in Worms

Worm:JS/Beutanni.A is a worm that circulates by pretending to be Word documents, corrupting HTML documents, removable and network drives, and when a computer user burns CDs on a compromised PC. Worm:JS/Beutanni.A makes a variety of alterations to the victimized computer system, reduces security settings and disables particular system applications. When installed on the infected computer, Worm:JS/Beutanni.A makes particular system alterations. Worm:JS/Beutanni.A modifies the extensions .DOC, .DOCX, or .RTF of the Word documents to .JSE. Worm:JS/Beutanni.A does this to fool the computer user into opening copies of the worm, thinking they are actually legal Word documents. Worm:JS/Beutanni.A downloads the malevolent file 'annie.ani' in the root folder of all drives on the corrupted PC, incorporating removable drives (such as USB thumb drives), fixed drives (hard disks), and network drives. Worm:JS/Beutanni.A also downloads other malevolent files. The goal of these harmful files is to seduce the victim into opening them based on their file names. However, when opening the files, the PC user will instead run the copy of Worm:JS/Beutanni.A. Worm:JS/Beutanni.A also modifies the Windows Registry on the affected computer.

File System Details

Worm:JS/Beutanni.A may create the following file(s):
Expand All | Collapse All
# File Name Detections
1. [system folder]\drivers\annie.sys
2. %SystemDrive%\annie.ani
3. %SystemDrive%\beautiful_girl_part_3.lnk
4. %LOCALAPPDATA%\Microsoft\CD Burning\annie.ani
5. %SystemDrive%\beautiful_girl_part_2.lnk
6. %SystemDrive%\beautiful_girl_part_5.lnk
7. %LOCALAPPDATA%\Microsoft\CD Burning\autorun.inf
8. %SystemDrive%\beautiful_girl_part_1.lnk
9. %SystemDrive%\beautiful_girl_part_4.lnk

Registry Details

Worm:JS/Beutanni.A may create the following registry entry or registry entries:
HKEY..\..\..\..{RegistryKeys}
HKEY_CURRENT_USER\Software\Policies\Microsoft\MMC RestrictToPermittedSnapins = 0x00000001
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore DisableConfig = 0x00000001
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\attrib.exe Debugger = "cmd.exe /c rem"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autoruns.exe Debugger = "cmd.exe /c del /q /f"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System DisableRegistryTools = 0x00000001
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore DisableSR = 0x00000001
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden UncheckedValue = 0x00000001
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe Debugger = "cmd.exe /c del /q /f"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reg.exe Debugger = "cmd.exe /c rem"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System DisableTaskMgr = 0x00000001
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer NoFileAssociate 0x00000001
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\HideFileExt UncheckedValue = 0x00000001
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe Debugger = "cmd.exe /c rem"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RegAlyzer.exe Debugger = "cmd.exe /c del /q /f"

Trending

Most Viewed

Loading...