Viral Rewind: Email-Worm.VBS.NumGame (GuessGame)
Visit my Linktree to access my socials and other channels: https://linktr.ee/mausolfb
-----------------------------------------------------------
. NumGame (aka GuessGame) is a visual basic script derived e-mail worm on Windows. It first arrives on a system attached to an e-mail it sends from an infected machine as an HTML file. When this HTML file is opened it presents a dialog box to the user with instructions asking them to ensure it is being run from a proper location and to acknowledge any ActiveX control warning that is given for it. If the user allows the ActiveX control to run, NumGame manifests itself on the system and begins its payloads.
The payloads:
First NumGame makes a copy of itself as GuessGame.vbe in the Windows system directory.
Next it writes another file called GuessGame.vbs in the same directory containing code it calls "security" that monitors the Microsoft Outlook process to see if it is active or not and perform certain actions depending on conditions.
Then it performs its mailing routine where it finds ten contacts addressing them by their usernames as their "valentine" in the subject and body of the e-mail message. It then attaches itself and sends the e-mails.
Next it changes the system date to April 8th, 1981 (04-08-1981) and then attempts to write another file called GuessGame.bat with commands "DATE %1" and "CLS" and then possibly run it. However this section of the worm's code appears to not function correctly as it hangs here during the process and doesn't advance unless "winoldap" is forcefully closed (Winoldap corresponds to the Winoa.386 file used for older Win16/MS-DOS operations).
Afterwards NumGame runs its destructive code routine where it essentially searches out all possible files and folders on local and network drives to delete. As a bit of redundancy, NumGame also writes autoexec.bat batch files containing DEL and DELTREE commands across the local and network drives so that if files on those drives weren't deleted that execution of the batch file on startup would.
Lastly NumGame runs the game code which the worm is named after. Here it asks the user to guess a number ranging from 1 to 100 and that they have ten tries. These values can be modified within the worm's code. If the user guess the number correctly within the number of tries it proclaims them the winner; If not it proclaims them a loser. It monitors whether the number is too large/small or if the input is invalid (like a letter). After the ten tries or guessing the number correctly NumGame will ask if the user wants to play again. If they say "yes" NumGame will rerun it's code from the beginning (where it makes a local copy). If the user says "no" the script ends there and does not repeat.
At this point the system will have to be recovered as most files/directories will be gone and the system will not boot if restarted.
---------------------------------------------
Like the Facebook page: / brian.mausolf
Follow me on Twitter: / mausolfb