Trojan.Win32.PHORPIEX.R06CC0DJU23

Infection Channel: Downloaded from the Internet, Dropped by other malware

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It connects to a website to send and receive information.

File Size: 81,920 bytes

File Type: EXE

Memory Resident: Yes

Initial Samples Received Date: 26 Jan 2024

Payload: Connects to URLs/IPs

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following files:

%User Profile%\tbnds.dat
F:\{disk name} ({disk free space}GB).lnk → detected as Trojan.LNK.RUNNER.B
%User Profile%\win{7 random alphabet characters} → copy of %User Temp%\{10 random numbers}.exe
%Windows%\win{7 random alphabet characters} → copy of %User Temp%\{10 random numbers}.exe

It drops and executes the following files:

%User Temp%\{10 random numbers}.exe

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It drops the following copies of itself into the affected system:

%Windows%\sysplorsv.exe
F:\.\VolDriver.exe

(Note: %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.)

It adds the following processes:

%Windows%\sysplorsv.exe
%User Temp%\{10 random numbers}.exe

(Note: %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It creates the following folders:

F:\. → hidden

It adds the following mutexes to ensure that only one of its copies runs at any one time:

3444rrre
333x3333x3

Autostart Technique

This Trojan adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Windows Settings = %Windows%\sysplorsv.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Windows Settings = %Windows%\win{7 random alphabet characters}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Windows Settings = %User Profile%\win{7 random alphabet characters}

Other System Modifications

This Trojan deletes the following files:

Files found in the removable and/or network drive with the following extension:
- .lnk
- .vbs
- .js
- .scr
- .com
- .jse
- .cmd
- .pif
- .jar
- .dll
- .vbe
- .bat
- .inf

It modifies the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
FirewallOverride = 1