Note that this malware does NOT exploit ‘Vulnerability in Windows Shell Could Allow Remote Code Execution’ 2286198. It simply uses the autorun.inf to launch the executable, or waits for the user to double click the .LNK file. I wrote up this diary before fellow handler Bojan pointed that out to me.
Aaron wrote in the following:

We had a user get infected … The symptoms we saw were as follows:

The virus hides all folders on the root of any drive it has write access to.
It then drops an LNK file named the same as all of the folders. So you have a series of LNK files where your folders used to be. This appears to only happen at the root of the drive(s) the user has write access to.
Then the virus drops an autorun.inf, EXE, and SRC file at the root of the infected drives.

One of the things we did to scan our server shares was to run robocopy in list-only mode. We used a command similar to this:

robocopy servershare c: *.lnk /MAXAGE:2 /L /S /R:3 /W:3 /NDL

It scans for any LNK files created in the past 2 days. The reasoning is that LNK files should not be created very often on shares, so a large number of them would be suspicious.

He also sent us a copy of the files found on the affected system. The virustotal results virustotal.com results yesterday were 11/36 (30.56%).
This is what the .LNK file looks like:
xxd Backup Drive.lnk

0000000: 4c00 0000 0114 0200 0000 0000 c000 0000 L……………

0000010: 0000 0046 cb00 0000 0700 0000 0000 0000 …F…………

0000020: 0000 0000 0000 0000 0000 0000 007b b54b ………….{.K

0000030: 7627 cb01 00c2 0100 0300 0000 0100 0000 v’…………..

0000040: 0000 0000 0000 0000 0000 0000 7500 1400 …………u…

0000050: 1f50 e04f d020 ea3a 6910 a2d8 0800 2b30 .P.O. .:i…..+0

0000060: 309d 1900 2f43 3a5c 0000 0000 0000 0000 0…/C:……..

0000070: 0000 0000 0000 0000 0000 0046 0032 0000 ………..F.2..

0000080: c201 00f3 3c87 9907 0066 6f65 7576 652e ……..foeuve.

0000090: 7363 7200 002c 0003 0004 00ef be00 0000 scr..,……….

00000a0: 0000 0000 0014 0000 0066 006f 0065 0075 ………f.o.e.u

00000b0: 0076 0065 002e 0073 0063 0072 0000 001a .v.e…s.c.r….

00000c0: 0000 004a 0000 001c 0000 0002 0000 0000 …J…………

00000d0: 0000 0000 0000 001c 0000 003f 0000 0023 ………..?…#

00000e0: 0000 0003 0000 0014 0000 0020 0000 0000 ……….. ….

00000f0: 00fe 7f5c 5c43 6c69 656e 745c 4324 0043 …ClientC$.C

0000100: 3a00 666f 6575 7665 2e73 6372 000c 002e :.foeuve.scr….

0000110: 005c 0066 006f 0065 0075 0076 0065 002e ..f.o.e.u.v.e..

0000120: 0073 0063 0072 0021 0025 0073 0079 0073 .s.c.r.!.%.s.y.s

0000130: 0074 0065 006d 0072 006f 006f 0074 0025 .t.e.m.r.o.o.t.%

0000140: 005c 0073 0079 0073 0074 0065 006d 0033 ..s.y.s.t.e.m.3

0000150: 0032 005c 0073 0068 0065 006c 006c 0033 .2..s.h.e.l.l.3

0000160: 0032 002e 0064 006c 006c 0000 0000 00 .2…d.l.l…..
Here are md5sums of the files captured:
4514e6b0ebf1859bc06464cc86e6b0aa 994e7f70c6c8cfdc0d10.lnk

eb72f852dc417e5c1c500d777b763ff5 autorun.inf

4514e6b0ebf1859bc06464cc86e6b0aa Backup Drive.lnk

4514e6b0ebf1859bc06464cc86e6b0aa dellinks.lnk

4514e6b0ebf1859bc06464cc86e6b0aa DELL.lnk

4514e6b0ebf1859bc06464cc86e6b0aa Documents and Settings.lnk

7a86fc2e33f1853e56e87968554a4f23 Documents.lnk

4514e6b0ebf1859bc06464cc86e6b0aa DOS.lnk

6c312fa82a83602bf4bac49c569dddba foeuve.exe

6c312fa82a83602bf4bac49c569dddba foeuve.scr

8dd2dbd509c9e30c9a481fb790521a2a Music.lnk

4514e6b0ebf1859bc06464cc86e6b0aa New Folder.lnk

62ed86349f7d418d67c0e4dbbf2b0b57 Pictures.lnk

4514e6b0ebf1859bc06464cc86e6b0aa Program Files.lnk

4514e6b0ebf1859bc06464cc86e6b0aa QUARANTINE.lnk

4514e6b0ebf1859bc06464cc86e6b0aa RECYCLER.lnk

4514e6b0ebf1859bc06464cc86e6b0aa Root_C.lnk

4514e6b0ebf1859bc06464cc86e6b0aa System Volume Information.lnk

4514e6b0ebf1859bc06464cc86e6b0aa temp.lnk

94ea35e7315ede1f3226b42e8a1197e9 Video.lnk

4514e6b0ebf1859bc06464cc86e6b0aa Vision5.lnk

4514e6b0ebf1859bc06464cc86e6b0aa VNCTEMP.lnk

4514e6b0ebf1859bc06464cc86e6b0aa WINDOWS.lnk
The .LNK files affected all have the same hash value, the two dropped files as well (foeuve.*) share md5sums. Here is the contents of autorun.inf:
cat autorun.inf

[AUtoRUn]

aCTION=Open folder to view files

SHeLLEXECuTe=FOeUVE.EXE

IcoN=%syStEMRoOt%sySTEm32Shell32.dll,4
Today the virustotal.com results for foeuvre.scr are similar, 23/41 (56.1%).
Thanks Aaron!
So, in a nutshell, not the exploit or malware we were looking for, but interesting nonetheless.
Cheers,

Adrien de Beaupr

EWA-Canada.com

(c) SANS Internet Storm Center. http://isc.sans.org Creative Commons Attribution-Noncommercial 3.0 United States License.

View full post on SANS Internet Storm Center, InfoCON: green

• Vulnerability in Internet Explorer Could Allow Remote Code Execution (CVE-2010-3962), (Wed, Nov 3rd)
  Microsoft has announced a vulnerability in all currently-supported versions of Internet Explorer (6 through 8) that could all the execution of arbitrary code (advisory 2458511.) This would likely be ...
• Vulnerabilities in SMB Could Allow Remote Code Execution
  Published: September 08, 2009 Microsoft is investigating new public reports of a possible vulnerability in Microsoft Server Message Block (SMB) implementation. We are not aware of attacks that try to...
• Remote Code Execution Vulnerability in Internet Explorer (CVE-2010-3962)
  A new vulnerability has been discovered in Internet Explorer that is currently being used in limited attacks. Websense Security Labs is monitoring the situation and will update this blog post as ...
• Oracle Java SE and Java for Business ‘MixerSequencer’ Remote Code Execution Vulnerability, (Sun, May 23rd)
  SecurityFocus has published Bugtraq ID39077 vulnerability for Java SE and Java for Business , which allows attackers to remote execute code context of the user running the affected application. Read t...
• Microsoft Windows SMB “mrxsmb.sys” Remote Heap Overflow Vulnerability
  Technical Description A vulnerability has been identified in Microsoft Windows, which could be exploited by remote attackers or malicious users to cause a denial of service or take complete control o...
• Exploit Leads to Remote Code Execution
  Malware authors use existing software vulnerabilities in order to place their piece of malicious code into the victim’s system - WebMaster (news@malwarecity.com) on MalwareCity Blog...
• Remote DLL Vulnerability Used to Attack Windows Apps
  The remote DLL loading vulnerability that has the security community all atwitter has begun to produce specific exploits in Windows applications. View full post on PCMag.com Security Covera...
• Protection for New Malware Families Using .LNK Vulnerability
  We’ve added detection for two new malware families using the vulnerability described in SA2286198. The first, Win32/Vobfus, is actually a family of obfuscated worms that has been around since 20...
• Exploit Code For Windows .LNK Flaw Public
  Proof of concept exploit code for the recently-revealed zero-day vulnerability in all versions of Windows has been made public on exploit-db.com. This means that, while attacks using it so fa...
• Zero-Day Vulnerability in Windows Shell
  Microsoft has released Security Advisory 2286198, which provides details on the LNK shortcut (Windows Shell) vulnerability that's currently being exploited by the Stuxnet rootkit.The news is n...