WORM_PHORPIEX.B

This worm arrives via removable drives. It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

It connects to Internet Relay Chat (IRC) servers. It joins an Internet Relay Chat (IRC) channel.

Arrival Details

This worm arrives via removable drives.

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This worm adds the following folders:

• %User Profile%\M-1-25-8784-4125-7572
• {Removable Drive}:\94728631

(Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.)

It drops the following copies of itself into the affected system and executes them:

• %User Profile%\M-1-25-8784-4125-7572\winsvc.exe

(Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• D9T3U5H1K7N

Autostart Technique

This worm adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Microsoft® Windows Update = "%User Profile%\M-1-25-8784-4125-7572\winsvc.exe"

Other System Modifications

This worm creates the following registry entry(ies) to bypass Windows Firewall:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\AuthorizedApplications\
List
%User Profile%\M-1-25-8784-4125-7572\winsvc.exe = "%User Profile%\M-1-25-8784-4125-7572\winsvc.exe:*:Enabled:Microsoft® Windows Update"

Propagation

This worm drops the following copy(ies) of itself in all removable drives:

• {Removable Drive}:\windrvs32.exe
• {Removable Drive}:\94728631\{Folder Names}.exe

It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

The said .INF file contains the following strings:

[autorun]
icon=%SystemRoot%\system32\SHELL32.dll,4
action=Open folder to view files
shellexecute=windrvs32.exe
UseAutoPlay=1

Backdoor Routine

This worm connects to any of the following Internet Relay Chat (IRC) servers:

• {BLOCKED}07.net

It joins any of the following Internet Relay Chat (IRC) channels:

• #32770

It accesses a remote Internet Relay Chat (IRC) server where it receives the following commands from a remote malicious user:

• Propagate via Google Talk and/or ICQ
• Download and execute arbitrary files
• Perform Denial of Service attack (SYN flood)
• Join other IRC channel
• Uninstall itself

Download Routine

This worm saves the files it downloads using the following names:

• %Application Data%\msnsvconfig.txt

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.)

NOTES:
This worm creates .LNK (shortcut) files pointing to the copy of WORM_PHORPIEX.B named {Removable Drive}:\94728631\{Folder Names}.EXE. {Folder Names} are the folder names found at the root of the Removable Drive, if there are any.

It then sets the attribute of the said Folders to Hidden.

If the Backdoor Command Propagate via Google Talk and/or ICQ is executed, this worm checks if Google Talk and/or ICQ is installed on the affected machine. If found, it sends a message to all of the affected user's contacts with a message and a link to a copy of itself.

The message can be of different language depending on the locale and system language of the affected machine. The message can be one of the following:

• English:
  • tell me what you think of this picture i edited
  • this is the funniest photo ever!
  • tell me what you think of this photo
  • i don't think i will ever sleep again after seeing this photo
  • i cant believe i still have this picture
  • should i make this my default picture?
• French:
  • je ne pense pas que je vais pouvoir dormir après avoir vu ces photos.
  • je n'arrive pas a croire que j'ai encore cette photo de toi depuis l'hiver dernier.
  • devrais-je mettre cette photo de profile?
  • c'est la photo la plus marrante!
  • dis moi ce que tu pense de cette photo de moi?
  • mes parents vont me tués si ils trouvent cette photo
• Spanish:
  • creo que no voy a poder dormir más despues de ver esta foto. mirá
  • no puedo creer que todav
  • a tengo esta foto tuya del invierno pasado, te acordas?
  • quedarí a bien si pongo esta foto en mi perfil? o me veo medio mal?
  • esta foto es gracios
  • mis padres me van a matar si ven esta foto mia, que decis?
• German:
  • wie findest du das foto?
  • hab ich dir das foto schon gezeigt?
  • das foto solltest du wirklich sehen
  • schau mal das foto an
  • unglaublich welche fotos leute von sich machen schau mal
  • so will ich nicht aussehen wenn ich alt bin
  • schau mal welches foto ich gefunden hab
  • bist du das auf dem foto?
  • kennst du das foto schon?
• Dutch:
  • ken je dat foto nog?
  • kijk wat voor een foto ik heb gevonden
  • zo iets leilijk heb ik nog nooit in mijn leven gezien
  • ik hoop dat jij het net bent op dit foto
  • ben jij dat op dit foto?
  • dit foto zal je echt eens bekijken!
  • ken je dit foto al?
• Romanian:
  • nu imi mai voi face niciodat poze!! toate ies urate ca asta.
  • spune-mi ce crezi despre poza asta.
  • asta e ce-a mai funny poza! tu ce zici?
  • zimi ce crezi despre poza asta?
  • nu cred ca voi mai putea dormi dupa ce am vazut poza asta. tu ce zici?
• Italian:
  • ti piace la foto?
  • hai visto questa foto?
  • la foto e grandiosa!
  • ti ricordi la Foto?
  • dopo che hai visto la foto, tu non dormirai piu
  • conosci la persona in questa foto?
  • chi e in questa foto?

It does not have rootkit capabilities.

It does not exploit any vulnerability.