Malware

Happy99

Happy99, also known as Ska and I-Worm, is a Microsoft Windows email and Usenet worm first seen in mid-January 1999 and described in the provided content as an early modern Internet worm. It spreads as an email attachment named HAPPY99.EXE, a 10,000-byte Win32 PE file. When executed, it displays a fireworks animation and a "Happy New Year" message as a decoy while installing itself into the Windows system directory as SKA.EXE and dropping SKA.DLL. It copies WSOCK32.DLL to WSOCK32.SKA and patches WSOCK32.DLL so it can intercept outbound network activity. The worm monitors SMTP port 25 and NNTP port 119 traffic and, when triggered, uses exported routines in SKA.DLL to append a UUencoded HAPPY99.EXE dropper to outgoing email and newsgroup messages. Infected messages may include the header "X-Spanska: Yes," and recipient addresses are logged in LISTE.SKA in the Windows system directory. The content states it infects Windows 95 and Windows 98 successfully; one source notes Windows NT targeting, while another states propagation fails on Windows NT because of bugs. Persistence can be achieved via a RunOnce registry entry at HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce if WSOCK32.DLL is locked. The malware is described as causing little or no damage beyond self-propagation, but it was widely reported globally in 1999 and associated in the content with the virus writer "Spanska." Noted artifacts and cleanup-related indicators include HAPPY99.EXE, SKA.EXE, SKA.DLL, LISTE.SKA, WSOCK32.SKA, and a patched WSOCK32.DLL.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

9 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1566.001Spearphishing AttachmentEvidence1

The worm arrives as an attachment in an e-mail as a HAPPY99.EXE file.

Execution

2 techniques

T1204.002Malicious FileEvidence1

When an infected attachment is executed and gains control, the worm displays a funny firework in the program's window to hide its malicious nature.

T1574Hijack Execution FlowEvidence1

it creates the SKA.EXE and SKA.DLL files in there, copies the WSOCK32.DLL to the newly created WSOCK32.SKA and patches the original WSOCK32.DLL file to hook e-mail sending calls.

Persistence

2 techniques

T1112Modify RegistryEvidence1

If the WSOCK32.DLL is in use and cannot be opened for writing, the worm creates a new key in the system registry to run its dropper during the next rebooting: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce=SKA.EXE

T1547.001Registry Run Keys / Startup FolderEvidence1

the worm creates a new key in the system registry to run its dropper during the next rebooting: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce=SKA.EXE

Privilege Escalation

1 technique

T1547.001Registry Run Keys / Startup FolderEvidence1

the worm creates a new key in the system registry to run its dropper during the next rebooting: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce=SKA.EXE

Stealth

2 techniques

T1036MasqueradingEvidence1

When an infected attachment is executed and gains control, the worm displays a funny firework in the program's window to hide its malicious nature.

T1574Hijack Execution FlowEvidence1

it creates the SKA.EXE and SKA.DLL files in there, copies the WSOCK32.DLL to the newly created WSOCK32.SKA and patches the original WSOCK32.DLL file to hook e-mail sending calls.

Defense Impairment

1 technique

T1112Modify RegistryEvidence1

Discovery

1 technique

T1083File and Directory DiscoveryEvidence1

While sending infected attachments, the worm stores the recipients' addresses to the LISTE.SKA file in the Windows system directory.

Command and Control

2 techniques

T1105Ingress Tool TransferEvidence1

Depending on the port number, the worm calls one of these routines, but both of them create a new message, insert UUencoded worm HAPPY99.EXE dropper into it, and send it to an Internet address.

T1572Protocol TunnelingEvidence1

A second kind of covert channel, aimed at subverting firewall–based filtering, uses standard ports for passing non-standard traffic.

INDICATORS OF COMPROMISE

IOCs tracked for this family

2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

2 tracked

IPs, domains, and DNS infrastructure linked to this family.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app—

ip.v4●●●●●●●●●●●●View more in app—

ACTIVITY FEED

Recent activity

24 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

24 SOURCESView more in app

wikipedia cyber incidentsNews

Jul 4, 2016

Jean-Bernard Condat - Wikipedia

The content includes a 'Malware' list under 'Hacking in the 1990s' that names: 'CIH, Happy99, Hare, KAK, Melissa, Michelangelo, Staog'.

wikipedia cyber incidentsNews

Dec 10, 2015

Elias Ladopoulos - Wikipedia

Timeline ... Malware ... CIH ... Happy99 ... Hare ... KAK ... Melissa ... Michelangelo ... Staog

wikipedia cyber incidentsNews

Apr 26, 2013

Operation Cybersnare - Wikipedia

The content includes a 1990s timeline section listing malware, including: "Malware CIH Happy99 Hare KAK Melissa Michelangelo Staog".

wikipedia enNews

Mar 13, 2010

Justin Tanner Petersen - Wikipedia

Malware ... Happy99

+20 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching2

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping9

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Happy99