Win32.HLLW.Phorpiex.221

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\] 'Microsoft Windows Manager' = '%WINDIR%\M-505076092760247692762946920\winmgr.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run\] 'Microsoft Windows Manager' = '%WINDIR%\M-505076092760247692762946920\winmgr.exe'

Creates the following files on removable media

<Drive name for removable media>:\deviceconfigmanager.vbs
<Drive name for removable media>:\digest.rdf
<Drive name for removable media>:\middaugh_keynote.pptx
<Drive name for removable media>:\samieee_obiee_presentation.pptx
<Drive name for removable media>:\gruenspecht_02172016.pptx
<Drive name for removable media>:\waterresourcesag.pptx
<Drive name for removable media>:\writingcompletesarnarrative_1103.ppt
<Drive name for removable media>:\metac.ppt
<Drive name for removable media>:\ppswamp.ppt
<Drive name for removable media>:\file1.ppt
<Drive name for removable media>:\background.png
<Drive name for removable media>:\breakpoint.png
<Drive name for removable media>:\dissolveanother.png
<Drive name for removable media>:\calibre.png
<Drive name for removable media>:\block.png
<Drive name for removable media>:\tunpersonalca1.pem
<Drive name for removable media>:\ck_ugo.pem
<Drive name for removable media>:\delongcacert.pem
<Drive name for removable media>:\bc01.pdf
<Drive name for removable media>:\7790_preview.pdf
<Drive name for removable media>:\dualectls.pdf
<Drive name for removable media>:\clip_480_5sec_6mbps_h264.mp4
<Drive name for removable media>:\d0068197bb5a41fea16a220c45390606.mp4
<Drive name for removable media>:\video_1.mp4
<Drive name for removable media>:\51.mp4
<Drive name for removable media>:\spanner.mov
<Drive name for removable media>:\elvisimp.rdf
<Drive name for removable media>:\schema.rdf
<Drive name for removable media>:\skos.rdf
<Drive name for removable media>:\swc_2009-03-02.rdf
<Drive name for removable media>:\fiche_inscription_2015.zip
<Drive name for removable media>:\price030215.zip
<Drive name for removable media>:\excel_example.zip
<Drive name for removable media>:\1sm_price.zip
<Drive name for removable media>:\national_autism_preparation_programs.xlsx
<Drive name for removable media>:\cee_mmsprogram_summary_public.xlsx
<Drive name for removable media>:\suspendedcompanies.xlsx
<Drive name for removable media>:\highly_cited_2001.xlsx
<Drive name for removable media>:\trtf_matrix2012_oct.xlsx
<Drive name for removable media>:\disclosuredetails.xlsx
<Drive name for removable media>:\2013_finalsummaryforweb.xlsx
<Drive name for removable media>:\contractualdeadlines.xls
<Drive name for removable media>:\removedtitles_records.xls
<Drive name for removable media>:\1sm_price.xls
<Drive name for removable media>:\excel_example.xls
<Drive name for removable media>:\babyboymaintoscenesbackground.wmv
<Drive name for removable media>:\passport_pal.wmv
<Drive name for removable media>:\babyboymaintonotesbackground_pal.wmv
<Drive name for removable media>:\flower_trans_matte.wmv
<Drive name for removable media>:\fungalnameauthors.rtf
<Drive name for removable media>:\pandp.rtf
<Drive name for removable media>:\phytoremediation.rtf
<Drive name for removable media>:\waterlandhealthkano.rtf
<Drive name for removable media>:\static_electricity_easy_and_quick_activities.rtf
<Drive name for removable media>:\taxus_baccata.rdf
<Drive name for removable media>:\sioc.rdf
<Drive name for removable media>:\removedtitles_records.zip
<Drive name for removable media>:\scan.mov
<Drive name for removable media>:\firefly1.mov
<Drive name for removable media>:\parnas_01.jpg
<Drive name for removable media>:\aoc_saq_d_v3_merchant.docx
<Drive name for removable media>:\nwfieldnotes1966.docx
<Drive name for removable media>:\adhd_and_obesity.docx
<Drive name for removable media>:\holycrosschurchinstructions.docx
<Drive name for removable media>:\508softwareandos.doc
<Drive name for removable media>:\uep_form_786_bulletin_1726i602.doc
<Drive name for removable media>:\fi51.doc
<Drive name for removable media>:\testee.cer
<Drive name for removable media>:\contosoroot.cer
<Drive name for removable media>:\sdksampleunprivdeveloper.cer
<Drive name for removable media>:\contoso.cer
<Drive name for removable media>:\testcertificate.cer
<Drive name for removable media>:\pmd.cer
<Drive name for removable media>:\contoso_1.cer
<Drive name for removable media>:\dashborder_96.bmp
<Drive name for removable media>:\tileimage.bmp
<Drive name for removable media>:\dialmap.bmp
<Drive name for removable media>:\dashborder_144.bmp
<Drive name for removable media>:\dashborder_192.bmp
<Drive name for removable media>:\archer.avi
<Drive name for removable media>:\delete.avi
<Drive name for removable media>:\join.avi
<Drive name for removable media>:\_\deviceconfigmanager.exe
<Drive name for removable media>:\.lnk
<Drive name for removable media>:\autorun.inf
<Drive name for removable media>:\hadac_newsletter_july_2010_final.docx
<Drive name for removable media>:\sdszfo.docx
<Drive name for removable media>:\utorrent.exe
<Drive name for removable media>:\dotnetfx45_full_setup.exe
<Drive name for removable media>:\2.jpg
<Drive name for removable media>:\210252809.jpg
<Drive name for removable media>:\pushkin.jpeg
<Drive name for removable media>:\13.jpeg
<Drive name for removable media>:\210252809.jpeg
<Drive name for removable media>:\4f0bf7ff71f28.jpeg
<Drive name for removable media>:\168.jpeg
<Drive name for removable media>:\api-hashmap.html
<Drive name for removable media>:\trivial-merge.html
<Drive name for removable media>:\browse.html
<Drive name for removable media>:\ituneshelpunavailable.html
<Drive name for removable media>:\about.html
<Drive name for removable media>:\ituneshelpunavailable.htm
<Drive name for removable media>:\adadsi.html
<Drive name for removable media>:\about.htm
<Drive name for removable media>:\browse.htm
<Drive name for removable media>:\trivial-merge.htm
<Drive name for removable media>:\tree_view.htm
<Drive name for removable media>:\advice_process.htm
<Drive name for removable media>:\64bit_notes.htm
<Drive name for removable media>:\chromesetup.exe
<Drive name for removable media>:\notepad.exe
<Drive name for removable media>:\tcm851ax32.exe
<Drive name for removable media>:\jre-7u75-windows-i586-iftw.exe
<Drive name for removable media>:\wrar520.exe
<Drive name for removable media>:\winmine.exe
<Drive name for removable media>:\pushkin.jpg
<Drive name for removable media>:\productos.zip

Malicious functions

To bypass firewall, removes or modifies the following registry keys

[<HKLM>\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%WINDIR%\M-505076092760247692762946920\winmgr.exe' = '%WINDIR%\M-5...

Injects code into

the following user processes:

winmgr.exe

Modifies file system

Creates the following files

%WINDIR%\m-505076092760247692762946920\winmgr.exe
%TEMP%\otwqsdhsmq.bat
C:\deviceconfigmanager.vbs
C:\autorun.inf
C:\.lnk
C:\_\deviceconfigmanager.exe
D:\deviceconfigmanager.vbs
D:\autorun.inf
D:\.lnk
D:\_\deviceconfigmanager.exe

Sets the 'hidden' attribute to the following files

%WINDIR%\m-505076092760247692762946920\winmgr.exe
C:\deviceconfigmanager.vbs
C:\autorun.inf
C:\_\deviceconfigmanager.exe
D:\deviceconfigmanager.vbs
D:\autorun.inf
D:\_\deviceconfigmanager.exe
<Drive name for removable media>:\deviceconfigmanager.vbs
<Drive name for removable media>:\autorun.inf
<Drive name for removable media>:\_\deviceconfigmanager.exe

Deletes itself.

Network activity

Connects to

'22#.#81.87.80':5050
'go#####osrsohgsri.ru':5050

TCP

HTTP GET requests

http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt

UDP

DNS ASK go#####osrsohgsri.ru
DNS ASK oa#####oeohuanoen.ru
DNS ASK ou#####uebfkiurufiu.ru

Miscellaneous

Creates and executes the following

'%WINDIR%\m-505076092760247692762946920\winmgr.exe'
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\otwqsdhsmq.bat" "' (with hidden window)

Executes the following

'<SYSTEM32>\cmd.exe' /c ""%TEMP%\otwqsdhsmq.bat" "

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information