TROJ_PHINDOLP.A

This Trojan may be dropped by other malware.

It modifies the Internet Explorer Zone Settings.

Arrival Details

This Trojan may be dropped by the following malware:

• TROJ_DROPHIN.A

Autostart Technique

This Trojan adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
arun = "%User Temp%\explorer.exe"

Other System Modifications

This Trojan adds the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\PhishingFilter
Enabled = "1"

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\PhishingFilter
ShownVerifyBalloon = "3"

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Recovery
AutoRecover = "2"

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Main
Check_Associations = "no"

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Main
DisableFirstRunCustomize = "2"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings
IEHardenIENoWarn = "0"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings
WarnonZoneCrossing = "0"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings
WarnOnPostRedirect = "0"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings\
ZoneMap
IEharden = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Internet Explorer\Main
DEPOff = "1"

Web Browser Home Page and Search Page Modification

This Trojan modifies the Internet Explorer Zone Settings.

NOTES:

This Trojan checks if it is running under a virtual environment by querying the following registry key:

HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Disk\Enum

It checks for the presence of the following strings on the aforementioned registry:

• VBOX
• Virtual
• VMware

It terminates the following processes to make sure that only Firefox, Chrome, Opera, or Internet Explorer is the browser used by the affected user:

• maxthon.exe
• 360se.exe

It may then send the following parameter to its C&C server to report the running browser on the affected system:

• ReuseFF
• IEalone
• ReuseOP

It retrieves the host name and domain of the affected machine by querying the following values on the following registry key:

• Registry key

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters

• Registry values

・HostName
・Domain

It retrieves the IP address, default gateway, and DHCP IP address by querying the following values on the following registry key:

• Registry key

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces

• Registry values

・IPAddress
・DefaultGateway
・DHCPIPAddress

It checks for installed email clients by querying the following registry key:

HKEY_LOCAL_MACHINE\software\clients\mail

It checks for installed web browsers by querying the following registry key:

HKEY_LOCAL_MACHINE\Software\Classes\http\shell

It searches for the following strings on the aforementioned registry key:

• FIREFOX.EXE
• Chrome
• Maxthon3
• Opera
• 360

It queries the following registry key to check the default browser in the system:

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet

It obtains the Proxy Server, AutoConfigURL, and checks if Proxy is enabled on the affected machine by querying the following values in the following registry key:

• Registry key

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings

• Registry values

・ProxyEnable
・ProxyServer
・AutoConfigURL

It checks the version of Internet Explorer by querying the following registry key:

HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Version Vector

It then encrypts and sends all the gathered information above to the C&C server http://sky{BLOCKED}1.name/{.aspx directory}?r={encrypted information}&a= via HTTP POST.

Note that {.aspx directory} may be any of the following:

• shfam9y/Default.aspx
• shfam9y/Direct9.aspx
• shfam9y/login0.aspx
• shfam9y/www2.aspx

The server may then reply with a binary download which the malware then executes. As of this writing, the C&C does not have a response.

It copies %System%\cmd.exe as %User Temp%\~vmdmc.exe, which it uses to silently execute downloaded binaries.

It also queries the following registry entry to check if command prompt is enabled:

HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System
DisableCMD

If disabled, it modifies the registry Value accordingly to make sure its download and execute routine will be successful.

It is capable of modifying browser preferences to adjust proxy configurations of the affected machines.