TROJ_AVRECON.NVP

March 18, 2016

PLATFORM:

Windows

OVERALL RISK RATING:

DAMAGE POTENTIAL:

DISTRIBUTION POTENTIAL:

REPORTED INFECTION:

INFORMATION EXPOSURE:

Threat Type: Trojan
Destructiveness: No
Encrypted: Yes
In the wild: Yes

OVERVIEW

Infection Channel: Downloaded from the Internet

Angler Exploit Kit outbreak in US

This Trojan modifies registry entries to disable the Windows Firewall settings. This action allows this malware to perform its routines without being deteted by the Windows Firewall.

It connects to certain websites to send and receive information. However, as of this writing, the said sites are inaccessible. It gathers information and reports it to its servers.

TECHNICAL DETAILS

File Size: 333,312 bytes

File Type: EXE

Memory Resident: Yes

Initial Samples Received Date: 14 Mar 2016

Payload: Connects to URLs/IPs, Terminates processes

Arrival Details

This malware arrives via the following means:

distributed by Angler Exploit Kit

Installation

This Trojan drops the following copies of itself into the affected system and executes them:

%Application Data%\Mozilla\svchoste.exe

(Note: %Application Data% is the Application Data folder, where it usually is C:\Documents and Settings\{user name}\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It injects itself into the following processes as part of its memory residency routine:

svchost.exe
explorer.exe

Autostart Technique

This Trojan adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Generic Host Process = "%Application Data%\Mozilla\svchoste.exe"

Other System Modifications

This Trojan adds the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
AntiVirusDisableNotify = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
AntiVirusOverride = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
FirewallDisableNotify = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
FirewallOverride = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
UpdatesDisableNotify = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion
wowsys64datecheck = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Microsoft Antimalware\Exclusions\Extensions
{extensions} = "0"

where {extensions} are as follows:

*.exe
*.dll
*.tmp

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows Defender\Exclusions\Extensions
{extensions} = = "0"

where {extensions} are as follows:

*.exe
*.dll
*.tmp

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows Defender\Exclusions\Processes
{processes} = "0"

where {processes} are as follows:

svchost.exe
consent.exe
rundll32.exe
explorer.exe
spoolsv.exe
rgjdu.exe
afwqs.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Microsoft Antimalware\Exclusions\Processes
{processes} = "0"

where {processes} are as follows:

svchost.exe
consent.exe
rundll32.exe
explorer.exe
spoolsv.exe
rgjdu.exe
afwqs.exe

HKEY_CURRENT_USER\SOFTWARE\Microsoft\
Windows NT\CurrentVersion
WinNtM = "1"

HKEY_CURRENT_USER\SOFTWARE\Microsoft\
Windows NT\CurrentVersion
WinNtAv = "1"

HKEY_CURRENT_USER\SOFTWARE\Microsoft\
Windows NT\CurrentVersion
WinNtAr = "1"

It modifies the following registry entries to disable the Windows Firewall settings:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile
EnableFirewall = "0"