W32/Expiro-H

Category: Viruses and Spyware Protection available since:08 Mar 2011 05:55:33 (GMT)
Type: Win32 executable file virus Last Updated:01 Jul 2014 06:03:56 (GMT)
Prevalence: Small Number of Reports

Download Download our free Virus Removal Tool - Find and remove threats your antivirus missed

W32/Expiro-H is a file infector for the Windows platform.

 

Expiro is a family of polymorphic file infectors, meaning that the viral code inserted into each infected file is unique, while still maintaining the same malicious functionality.

 

The viral payload includes functionality to inject malicious code into web pages visited as well as steal login credentials.

 

As W32/Expiro-H is a file infector, any filename is fair game.

Additionally, the W32/Expiro-H infection routine has additional code to handle files protected by System File Checker (SFC).

 

The W32/Expiro-H code also appears to use files named as below in the APPDATA directory as small data files (i.e. not DLLs, though they have a .dll extension), where the [0-9] represent a single digit between 0 and 9:

  'kf[0-9][0-9]z32.dll'

  'dfl[0-9][0-9]z32.dll'

  'wsr[0-9][0-9]zt32.dll'

 

Notably, W32/Expiro-H does not create any registry keys. Instead, to achieve persistance, the infection routine ensures that it initially infects at least one executable file that already has a pre-existing RunKey associated.

 

If W32/Expiro-H attempts to infect SAV files, this will trigger

  HIPS/FileWriteMod-003

Examples of W32/Expiro-H include:

Example 1

File Information

Size
238K
SHA-1
0000ab901cbfb66fd965cf9eaa930ee1fc4687bf
MD5
9be50fe744523a0fee21e0f6c16069b1
CRC-32
09d7dcd6
File type
Windows executable
First seen
2011-04-26

Runtime Analysis

Dropped Files
  • C:\WINDOWS\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{3E1B65FC-E440-45D2-A936-27A87D6B8E9E}.crmlog
Modified Files
  • %SYSTEM%\netdde.exe
    • Changed the file contents
  • %SYSTEM%\locator.exe
    • Changed the file contents
  • %SYSTEM%\imapi.exe
    • Changed the file contents
  • %SYSTEM%\dmadmin.exe
    • Changed the file contents
  • %SYSTEM%\msiexec.exe
    • Changed the file contents
  • %SYSTEM%\rsvp.exe
    • Changed the file contents
  • %SYSTEM%\dllhost.exe
    • Changed the file contents
  • %SYSTEM%\msdtc.exe
    • Changed the file contents
  • %SYSTEM%\sessmgr.exe
    • Changed the file contents
  • %SYSTEM%\ups.exe
    • Changed the file contents
  • %SYSTEM%\tlntsvr.exe
    • Changed the file contents
  • %SYSTEM%\smlogsvc.exe
    • Changed the file contents
  • %SYSTEM%\wbem\wmiapsrv.exe
    • Changed the file contents
  • %SYSTEM%\cmd.exe
    • Changed the file contents
  • %SYSTEM%\vssvc.exe
    • Changed the file contents
  • %SYSTEM%\alg.exe
    • Changed the file contents
  • %SYSTEM%\spoolsv.exe
    • Changed the file contents
  • %SYSTEM%\cisvc.exe
    • Changed the file contents
  • %SYSTEM%\mnmsrvc.exe
    • Changed the file contents
  • %SYSTEM%\scardsvr.exe
    • Changed the file contents
  • %SYSTEM%\clipsrv.exe
    • Changed the file contents
Registry Keys Created
  • HKLM\SYSTEM\CurrentControlSet\Services\CiSvc\Enum
    0
    Root\LEGACY_CISVC\0000
  • HKLM\SYSTEM\CurrentControlSet\Services\ClipSrv\Enum
    0
    Root\LEGACY_CLIPSRV\0000
Registry Keys Modified
  • HKLM\SYSTEM\CurrentControlSet\Services\VSS
    Type
    0x00000110
  • HKLM\SYSTEM\CurrentControlSet\Services\mnmsrvc
    Start
    0x00000002
  • HKLM\SYSTEM\CurrentControlSet\Services\RDSessMgr
    Start
    0x00000002
  • HKLM\SYSTEM\CurrentControlSet\Services\MSIServer
    Type
    0x00000120
  • HKLM\SYSTEM\CurrentControlSet\Services\ImapiService
    Start
    0x00000002
  • HKLM\SYSTEM\CurrentControlSet\Services\RSVP
    Type
    0x00000110
  • HKLM\SYSTEM\CurrentControlSet\Services\COMSysApp
    Start
    0x00000002
  • HKLM\SYSTEM\CurrentControlSet\Services\TlntSvr
    Type
    0x00000110
  • HKLM\SYSTEM\CurrentControlSet\Services\NetDDE
    Start
    0x00000002
  • HKLM\SYSTEM\CurrentControlSet\Services\Spooler
    Start
    0x00000002
  • HKLM\SYSTEM\CurrentControlSet\Services\CiSvc
    Start
    0x00000002
  • HKLM\SYSTEM\CurrentControlSet\Services\ClipSrv
    Start
    0x00000002
  • HKLM\SYSTEM\CurrentControlSet\Services\dmadmin
    Type
    0x00000120
Processes Created
  • c:\windows\system32\cisvc.exe
  • c:\windows\system32\dllhost.exe

Example 2

File Information

Size
447K
SHA-1
00010c89b7f6973c2716351c244138b80cab0144
MD5
58f7cfd05b7d9103162adeb09d29be3b
CRC-32
df9196f9
File type
Windows executable
First seen
2011-04-20

Runtime Analysis

Dropped Files
  • c:\Documents and Settings\test user\Local Settings\Application Data\wsr18zt32.dll
  • C:\WINDOWS\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{7B587C61-4829-4D0E-99D1-30381380DAE6}.crmlog
Modified Files
  • %SYSTEM%\vssvc.exe
    • Changed the file contents
  • %SYSTEM%\mnmsrvc.exe
    • Changed the file contents
  • %SYSTEM%\tourstart.exe
    • Changed the file contents
  • %SYSTEM%\rsvp.exe
    • Changed the file contents
  • %SYSTEM%\mobsync.exe
    • Changed the file contents
  • %SYSTEM%\tlntsvr.exe
    • Changed the file contents
  • %WINDOWS%\regedit.exe
    • Changed the file contents
  • %SYSTEM%\ups.exe
    • Changed the file contents
  • %SYSTEM%\msiexec.exe
    • Changed the file contents
  • %SYSTEM%\narrator.exe
    • Changed the file contents
  • %SYSTEM%\cisvc.exe
    • Changed the file contents
  • %PROGRAM FILES%\Windows Media Player\wmplayer.exe
    • Changed the file contents
  • %SYSTEM%\notepad.exe
    • Changed the file contents
  • %SYSTEM%\dmadmin.exe
    • Changed the file contents
  • %SYSTEM%\locator.exe
    • Changed the file contents
  • %SYSTEM%\wbem\wmiapsrv.exe
    • Changed the file contents
  • %SYSTEM%\msdtc.exe
    • Changed the file contents
  • %SYSTEM%\clipsrv.exe
    • Changed the file contents
  • %SYSTEM%\cmd.exe
    • Changed the file contents
  • %SYSTEM%\alg.exe
    • Changed the file contents
  • %SYSTEM%\smlogsvc.exe
    • Changed the file contents
  • %SYSTEM%\dllhost.exe
    • Changed the file contents
  • %PROGRAM FILES%\Outlook Express\wab.exe
    • Changed the file contents
  • %SYSTEM%\spoolsv.exe
    • Changed the file contents
  • C:\bin\_PX.exe
    • Changed the file contents
  • %PROGRAM FILES%\Outlook Express\msimn.exe
    • Changed the file contents
  • %SYSTEM%\rcimlby.exe
    • Changed the file contents
  • %SYSTEM%\magnify.exe
    • Changed the file contents
  • %PROGRAM FILES%\Internet Explorer\iexplore.exe
    • Changed the file contents
  • %SYSTEM%\scardsvr.exe
    • Changed the file contents
  • %SYSTEM%\osk.exe
    • Changed the file contents
  • %SYSTEM%\imapi.exe
    • Changed the file contents
  • %PROGRAM FILES%\notepadpp\notepad++.exe
    • Changed the file contents
  • %SYSTEM%\netdde.exe
    • Changed the file contents
  • %SYSTEM%\utilman.exe
    • Changed the file contents
  • %SYSTEM%\sessmgr.exe
    • Changed the file contents
Registry Keys Created
  • HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0
    2103
    0x00000000
  • HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3
    2103
    0x00000000
  • HKLM\SYSTEM\CurrentControlSet\Services\VSS\Enum
    NextInstance
    0x00000001
  • HKLM\SYSTEM\CurrentControlSet\Services\ImapiService\Enum
    0
    Root\LEGACY_IMAPISERVICE\0000
  • HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2
    2103
    0x00000000
  • HKLM\SYSTEM\CurrentControlSet\Services\CiSvc\Enum
    Count
    0x00000001
  • HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1
    2103
    0x00000000
  • HKLM\SYSTEM\CurrentControlSet\Services\ClipSrv\Enum
    Count
    0x00000001
  • HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4
    2103
    0x00000000
Registry Keys Modified
  • HKLM\SYSTEM\CurrentControlSet\Services\MSIServer
    Type
    0x00000120
  • HKLM\SYSTEM\CurrentControlSet\Services\mnmsrvc
    Start
    0x00000002
  • HKLM\SYSTEM\CurrentControlSet\Services\ClipSrv
    Start
    0x00000002
  • HKLM\SYSTEM\CurrentControlSet\Services\CiSvc
    Start
    0x00000002
  • HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4
    1609
    0x00000000
  • HKLM\SYSTEM\CurrentControlSet\Services\dmadmin
    Type
    0x00000120
  • HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2
    1609
    0x00000000
  • HKLM\SYSTEM\CurrentControlSet\Services\ImapiService
    Start
    0x00000002
  • HKLM\SYSTEM\CurrentControlSet\Services\TlntSvr
    Type
    0x00000110
  • HKLM\SYSTEM\CurrentControlSet\Services\COMSysApp
    Start
    0x00000002
  • HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1
    1406
    0x00000000
  • HKLM\SYSTEM\CurrentControlSet\Services\Spooler
    Start
    0x00000002
  • HKLM\SYSTEM\CurrentControlSet\Services\NetDDE
    Start
    0x00000002
  • HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0
    1609
    0x00000000
  • HKLM\SYSTEM\CurrentControlSet\Services\RDSessMgr
    Start
    0x00000002
  • HKLM\SYSTEM\CurrentControlSet\Services\RSVP
    Type
    0x00000110
  • HKLM\SYSTEM\CurrentControlSet\Services\VSS
    Type
    0x00000110
Processes Created
  • c:\windows\system32\cisvc.exe
  • c:\windows\system32\dllhost.exe
  • c:\windows\system32\imapi.exe
  • c:\windows\system32\msiexec.exe
  • c:\windows\system32\vssvc.exe

Example 3

File Information

Size
596K
SHA-1
00013787947fa3becedc33707ff531ae5ac919d4
MD5
04d31e0969017a6cea528e1158fcac2c
CRC-32
c58697df
File type
Windows executable
First seen
2013-08-18

Runtime Analysis

Dropped Files
  • C:\WINDOWS\system32\osk.vir
    Size
    719K
    SHA-1
    e7d0c5213212159e022c48b0e2bf6154211910b1
    MD5
    000d6e13917b35f0a90ef992005ce5a3
    CRC-32
    cdf3cb05
    File type
    Windows executable
    First seen
    2013-08-18
Modified Files
  • %SYSTEM%\dmadmin.exe
    • Changed the file contents
  • %SYSTEM%\smlogsvc.exe
    • Changed the file contents
  • %SYSTEM%\wbem\wmiapsrv.exe
    • Changed the file contents
  • %WINDOWS%\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe
    • Changed the file contents
  • %WINDOWS%\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
    • Changed the file contents
  • %SYSTEM%\imapi.exe
    • Changed the file contents
  • %SYSTEM%\alg.exe
    • Changed the file contents
  • %SYSTEM%\narrator.exe
    • Changed the file contents
  • %SYSTEM%\sessmgr.exe
    • Changed the file contents
  • %SYSTEM%\mnmsrvc.exe
    • Changed the file contents
  • %SYSTEM%\cisvc.exe
    • Changed the file contents
  • %SYSTEM%\scardsvr.exe
    • Changed the file contents
  • %SYSTEM%\vssvc.exe
    • Changed the file contents
  • %SYSTEM%\spoolsv.exe
    • Changed the file contents
  • %SYSTEM%\tlntsvr.exe
    • Changed the file contents
  • %SYSTEM%\msiexec.exe
    • Changed the file contents
  • %SYSTEM%\clipsrv.exe
    • Changed the file contents
  • %WINDOWS%\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
    • Changed the file contents
  • %SYSTEM%\cmd.exe
    • Changed the file contents
  • %SYSTEM%\magnify.exe
    • Changed the file contents
  • %WINDOWS%\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
    • Changed the file contents
  • %SYSTEM%\locator.exe
    • Changed the file contents
  • %PROGRAM FILES%\Java\jre6\bin\jqs.exe
    • Changed the file contents
  • %WINDOWS%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
    • Changed the file contents
  • %SYSTEM%\netdde.exe
    • Changed the file contents
Registry Keys Created
  • HKLM\SYSTEM\CurrentControlSet\Services\CiSvc\Enum
    NextInstance
    0x00000001
Registry Keys Modified
  • HKLM\SYSTEM\CurrentControlSet\Services\swi_service
    Start
    0x00000002
  • HKLM\SYSTEM\CurrentControlSet\Services\CiSvc
    Start
    0x00000002
  • HKLM\SYSTEM\CurrentControlSet\Services\Sophos AutoUpdate Service
    Start
    0x00000002
  • HKLM\SYSTEM\CurrentControlSet\Services\Spooler
    Start
    0x00000002
  • HKLM\SYSTEM\CurrentControlSet\Services\ImapiService
    Start
    0x00000002
  • HKLM\SYSTEM\CurrentControlSet\Services\idsvc
    Start
    0x00000002
  • HKLM\SYSTEM\CurrentControlSet\Services\NetDDE
    Type
    0x00000120
  • HKLM\SYSTEM\CurrentControlSet\Services\dmadmin
    Start
    0x00000002
  • HKLM\SYSTEM\CurrentControlSet\Services\wscsvc
    Start
    0x00000004
  • HKLM\SYSTEM\CurrentControlSet\Services\MSIServer
    Start
    0x00000002
  • HKLM\SYSTEM\CurrentControlSet\Services\VSS
    Type
    0x00000110
  • HKLM\SYSTEM\CurrentControlSet\Services\swi_update
    Type
    0x00000110
  • HKLM\SYSTEM\CurrentControlSet\Services\clr_optimization_v2.0.50727_32
    Start
    0x00000002
  • HKLM\SYSTEM\CurrentControlSet\Services\RDSessMgr
    Start
    0x00000002
  • HKLM\SYSTEM\CurrentControlSet\Services\clr_optimization_v4.0.30319_32
    Type
    0x00000110
  • HKLM\SYSTEM\CurrentControlSet\Services\TlntSvr
    Start
    0x00000002
  • HKLM\SYSTEM\CurrentControlSet\Services\ClipSrv
    Type
    0x00000110
  • HKLM\SYSTEM\CurrentControlSet\Services\mnmsrvc
    Start
    0x00000002
  • HKLM\SYSTEM\CurrentControlSet\Services\JavaQuickStarterService
    Start
    0x00000002
Processes Created
  • c:\windows\system32\cisvc.exe

download Try Sophos products for free
Download now