WORM_PHORPIEX.B

 Analysis by: Nikko Tamana

 ALIASES:

Worm:Win32/Phorpiex.B (Microsoft)

 PLATFORM:

Windows 2000, Windows Server 2003, Windows XP (32-bit, 64-bit), Windows Vista (32-bit, 64-bit), Windows 7 (32-bit, 64-bit)

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:

  • Threat Type: Worm

  • Destructiveness: No

  • Encrypted: Yes

  • In the wild: Yes

  OVERVIEW

Infection Channel:

Propagates via removable drives


This worm arrives via removable drives. It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

It connects to Internet Relay Chat (IRC) servers. It joins an Internet Relay Chat (IRC) channel.

  TECHNICAL DETAILS

File Size:

122,880 bytes

File Type:

EXE

Memory Resident:

Yes

Initial Samples Received Date:

18 Mar 2013

Payload:

Compromises system security

Arrival Details

This worm arrives via removable drives.

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This worm adds the following folders:

  • %User Profile%\M-1-25-8784-4125-7572
  • {Removable Drive}:\94728631

(Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.)

It drops the following copies of itself into the affected system and executes them:

  • %User Profile%\M-1-25-8784-4125-7572\winsvc.exe

(Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

  • D9T3U5H1K7N

Autostart Technique

This worm adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Microsoft® Windows Update = "%User Profile%\M-1-25-8784-4125-7572\winsvc.exe"

Other System Modifications

This worm creates the following registry entry(ies) to bypass Windows Firewall:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\AuthorizedApplications\
List
%User Profile%\M-1-25-8784-4125-7572\winsvc.exe = "%User Profile%\M-1-25-8784-4125-7572\winsvc.exe:*:Enabled:Microsoft® Windows Update"

Propagation

This worm drops the following copy(ies) of itself in all removable drives:

  • {Removable Drive}:\windrvs32.exe
  • {Removable Drive}:\94728631\{Folder Names}.exe

It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

The said .INF file contains the following strings:

[autorun]
icon=%SystemRoot%\system32\SHELL32.dll,4
action=Open folder to view files
shellexecute=windrvs32.exe
UseAutoPlay=1

Backdoor Routine

This worm connects to any of the following Internet Relay Chat (IRC) servers:

  • {BLOCKED}07.net

It joins any of the following Internet Relay Chat (IRC) channels:

  • #32770

It accesses a remote Internet Relay Chat (IRC) server where it receives the following commands from a remote malicious user:

  • Propagate via Google Talk and/or ICQ
  • Download and execute arbitrary files
  • Perform Denial of Service attack (SYN flood)
  • Join other IRC channel
  • Uninstall itself

Download Routine

This worm saves the files it downloads using the following names:

  • %Application Data%\msnsvconfig.txt

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.)

NOTES:
This worm creates .LNK (shortcut) files pointing to the copy of WORM_PHORPIEX.B named {Removable Drive}:\94728631\{Folder Names}.EXE. {Folder Names} are the folder names found at the root of the Removable Drive, if there are any.

It then sets the attribute of the said Folders to Hidden.

If the Backdoor Command Propagate via Google Talk and/or ICQ is executed, this worm checks if Google Talk and/or ICQ is installed on the affected machine. If found, it sends a message to all of the affected user's contacts with a message and a link to a copy of itself.

The message can be of different language depending on the locale and system language of the affected machine. The message can be one of the following:

  • English:
    • tell me what you think of this picture i edited
    • this is the funniest photo ever!
    • tell me what you think of this photo
    • i don't think i will ever sleep again after seeing this photo
    • i cant believe i still have this picture
    • should i make this my default picture?
  • French:
    • je ne pense pas que je vais pouvoir dormir après avoir vu ces photos.
    • je n'arrive pas a croire que j'ai encore cette photo de toi depuis l'hiver dernier.
    • devrais-je mettre cette photo de profile?
    • c'est la photo la plus marrante!
    • dis moi ce que tu pense de cette photo de moi?
    • mes parents vont me tués si ils trouvent cette photo
  • Spanish:
    • creo que no voy a poder dormir más despues de ver esta foto. mirá
    • no puedo creer que todav
    • a tengo esta foto tuya del invierno pasado, te acordas?
    • quedarí a bien si pongo esta foto en mi perfil? o me veo medio mal?
    • esta foto es gracios
    • mis padres me van a matar si ven esta foto mia, que decis?
  • German:
    • wie findest du das foto?
    • hab ich dir das foto schon gezeigt?
    • das foto solltest du wirklich sehen
    • schau mal das foto an
    • unglaublich welche fotos leute von sich machen schau mal
    • so will ich nicht aussehen wenn ich alt bin
    • schau mal welches foto ich gefunden hab
    • bist du das auf dem foto?
    • kennst du das foto schon?
  • Dutch:
    • ken je dat foto nog?
    • kijk wat voor een foto ik heb gevonden
    • zo iets leilijk heb ik nog nooit in mijn leven gezien
    • ik hoop dat jij het net bent op dit foto
    • ben jij dat op dit foto?
    • dit foto zal je echt eens bekijken!
    • ken je dit foto al?
  • Romanian:
    • nu imi mai voi face niciodat poze!! toate ies urate ca asta.
    • spune-mi ce crezi despre poza asta.
    • asta e ce-a mai funny poza! tu ce zici?
    • zimi ce crezi despre poza asta?
    • nu cred ca voi mai putea dormi dupa ce am vazut poza asta. tu ce zici?
  • Italian:
    • ti piace la foto?
    • hai visto questa foto?
    • la foto e grandiosa!
    • ti ricordi la Foto?
    • dopo che hai visto la foto, tu non dormirai piu
    • conosci la persona in questa foto?
    • chi e in questa foto?

It does not have rootkit capabilities.

It does not exploit any vulnerability.

  SOLUTION

Minimum Scan Engine:

9.300

FIRST VSAPI PATTERN FILE:

9.846.02

FIRST VSAPI PATTERN DATE:

18 Mar 2013

VSAPI OPR PATTERN File:

9.847.00

VSAPI OPR PATTERN Date:

19 Mar 2013

Step 1

Before doing any scans, Windows XP, Windows Vista, and Windows 7 users must disable System Restore to allow full scanning of their computers.

Step 2

Restart in Safe Mode

[ Learn More ]

Step 3

Delete this registry value

[ Learn More ]

Important: Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this step only if you know how or you can ask assistance from your system administrator. Else, check this Microsoft article first before modifying your computer's registry.

  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Microsoft® Windows Update = "%User Profile%\M-1-25-8784-4125-7572\winsvc.exe"
  • In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
    • %User Profile%\M-1-25-8784-4125-7572\winsvc.exe = "%User Profile%\M-1-25-8784-4125-7572\winsvc.exe:*:Enabled:Microsoft® Windows Update"

Step 4

Search and delete these folders

[ Learn More ]
Please make sure you check the Search Hidden Files and Folders checkbox in the More advanced options option to include all hidden folders in the search result.
  • %User Profile%\M-1-25-8784-4125-7572
  • {Removable Drive}:\94728631

Step 5

Search and delete this file

[ Learn More ]
There may be some files that are hidden. Please make sure you check the Search Hidden Files and Folders checkbox in the "More advanced options" option to include all hidden files and folders in the search result.
  • %Application Data%\msnsvconfig.txt

Step 6

Search and delete AUTORUN.INF files created by WORM_PHORPIEX.B that contain these strings

[ Learn More ]
[autorun]
icon=%SystemRoot%\system32\SHELL32.dll,4
action=Open folder to view files
shellexecute=windrvs32.exe
UseAutoPlay=1

Step 7

Restart in normal mode and scan your computer with your Trend Micro product for files detected as WORM_PHORPIEX.B. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.

NOTES:

Please perform this before step 6.
Delete all the created {Folder Names}.LNK files in the removable drives.


Did this description help? Tell us how we did.