Virus.Win32.BKICE.A

This Virus arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

As of this writing, the said sites are inaccessible.

It gathers certain information on the affected computer.

Arrival Details

This Virus arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Virus drops the following copies of itself into the affected system:

• %System%\blackice.exe
• %System%\kernel.dll
• {Removable drive}\blackice.exe

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

It adds the following processes:

• %System%\blackice.exe

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• blackicemutex

It is injected into the following processes running in memory:

• explorer.exe

Autostart Technique

This Virus adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows NT\CurrentVersion\Windows
run = %System%\blackice.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Winlogon
shell = Explorer.exe %System%\blackice.exe

It drops the following files:

• {Removable Drive}\AUTORUN.inf -> executes blackice.exe

Other System Modifications

This Virus deletes the following files:

• Files with .GHO extension (Norton backup)

It adds the following registry entries:

HKEY_CURRENT_MACHINE\Software\Microsoft\
Office\{Office Version}\Word\
Security
Level = 1

HKEY_CURRENT_MACHINE\Software\Microsoft\
Office\{Office Version}\Word\
Security
AccessVBOM = 1

HKEY_CURRENT_MACHINE\Software\Microsoft\
Office\{Office Version}\Excel\
Security
Level = 1

HKEY_CURRENT_MACHINE\Software\Microsoft\
Office\{Office Version}\Excel\
Security
AccessVBOM = 1

File Infection

This Virus infects the following file types:

• .XLS files
• .DOC files
• .EXE files

It avoids infecting the following files:

• "winnt" in path
• "windows" in path

Propagation

This Virus drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

Rootkit Capabilities

This Virus does not have rootkit capabilities.

Process Termination

This Virus terminates the following processes if found running in the affected system's memory:

• NAVAPW32
• NAVAPSVC
• NMAIN
• NAVW32
• KVFW
• KAVSVCUI
• KAVPFW
• KAV32
• KVXP
• KVSRVXP
• KVMONXP
• KVWSC
• KAVSVC
• KWATCHUI
• RAVMOND
• RAVMON
• RAVTIMER
• RISING
• RAV.EXE
• IPARMOR
• TROJANHUNTER
• THGUARD
• PFW
• EGHOST
• ANYVIEW
• KASPERSKY
• 360SAFE

Download Routine

This Virus connects to the following URL(s) to download its configuration file:

• http://fmtwld.{BLOCKED}j.com/blackice/url.txt
• http://fmtwld.{BLOCKED}p.net/blackice/url.txt

It saves the files it downloads using the following names:

• %System%\blackice.ini -> contains received information from C2 server (deleted later)

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

As of this writing, the said sites are inaccessible.

Information Theft

This Virus gathers the following information on the affected computer:

• Hostname
• Volume Serial Number
• MAC Address
• Microsoft Office Version

Other Details

This Virus does the following:

• Should meet the following conditions in order to proceed with infection routine:
  • dwOSVersionInfoSize should be 9c or 94
  • dwPlatformId should be 2 (Win32NT or later)
• Infects files found in the following drive types:
  • Fixed
  • Network connected via WNetEnum

NOTES:

It does not exploit any vulnerability.