W32/Expiro-H

Category: Viruses and Spyware Protection available since:08 Mar 2011 05:55:33 (GMT)
Type: Win32 executable file virus Last Updated:21 Oct 2016 01:45:16 (GMT)
Prevalence: Small Number of Reports

Download Download our free Virus Removal Tool - Find and remove threats your antivirus missed

W32/Expiro-H is a file infector for the Windows platform.

 

Expiro is a family of polymorphic file infectors, meaning that the viral code inserted into each infected file is unique, while still maintaining the same malicious functionality.

 

The viral payload includes functionality to inject malicious code into web pages visited as well as steal login credentials.

 

As W32/Expiro-H is a file infector, any filename is fair game.

Additionally, the W32/Expiro-H infection routine has additional code to handle files protected by System File Checker (SFC).

 

The W32/Expiro-H code also appears to use files named as below in the APPDATA directory as small data files (i.e. not DLLs, though they have a .dll extension), where the [0-9] represent a single digit between 0 and 9:

  'kf[0-9][0-9]z32.dll'

  'dfl[0-9][0-9]z32.dll'

  'wsr[0-9][0-9]zt32.dll'

 

Notably, W32/Expiro-H does not create any registry keys. Instead, to achieve persistance, the infection routine ensures that it initially infects at least one executable file that already has a pre-existing RunKey associated.

 

If W32/Expiro-H attempts to infect SAV files, this will trigger

  HIPS/FileWriteMod-003

Examples of W32/Expiro-H include:

Example 1

File Information

Size
447K
SHA-1
00010c89b7f6973c2716351c244138b80cab0144
MD5
58f7cfd05b7d9103162adeb09d29be3b
CRC-32
df9196f9
File type
Windows executable
First seen
2011-04-20

Runtime Analysis

Dropped Files
  • c:\Documents and Settings\test user\Local Settings\Application Data\wsr18zt32.dll
  • C:\WINDOWS\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{7B587C61-4829-4D0E-99D1-30381380DAE6}.crmlog
Modified Files
  • %SYSTEM%\wbem\wmiapsrv.exe
    • Changed the file contents
  • %SYSTEM%\alg.exe
    • Changed the file contents
  • %SYSTEM%\cisvc.exe
    • Changed the file contents
  • %SYSTEM%\mobsync.exe
    • Changed the file contents
  • %SYSTEM%\dllhost.exe
    • Changed the file contents
  • %WINDOWS%\regedit.exe
    • Changed the file contents
  • %SYSTEM%\narrator.exe
    • Changed the file contents
  • %SYSTEM%\clipsrv.exe
    • Changed the file contents
  • %SYSTEM%\netdde.exe
    • Changed the file contents
  • %SYSTEM%\tourstart.exe
    • Changed the file contents
  • %SYSTEM%\msdtc.exe
    • Changed the file contents
  • %SYSTEM%\ups.exe
    • Changed the file contents
  • %SYSTEM%\locator.exe
    • Changed the file contents
  • %PROGRAM FILES%\Windows Media Player\wmplayer.exe
    • Changed the file contents
  • %SYSTEM%\tlntsvr.exe
    • Changed the file contents
  • %PROGRAM FILES%\Outlook Express\wab.exe
    • Changed the file contents
  • %PROGRAM FILES%\Internet Explorer\iexplore.exe
    • Changed the file contents
  • %PROGRAM FILES%\notepadpp\notepad++.exe
    • Changed the file contents
  • %SYSTEM%\dmadmin.exe
    • Changed the file contents
  • %SYSTEM%\spoolsv.exe
    • Changed the file contents
  • %SYSTEM%\smlogsvc.exe
    • Changed the file contents
  • %SYSTEM%\rsvp.exe
    • Changed the file contents
  • %PROGRAM FILES%\Outlook Express\msimn.exe
    • Changed the file contents
  • %SYSTEM%\vssvc.exe
    • Changed the file contents
  • %SYSTEM%\osk.exe
    • Changed the file contents
  • %SYSTEM%\sessmgr.exe
    • Changed the file contents
  • %SYSTEM%\imapi.exe
    • Changed the file contents
  • %SYSTEM%\scardsvr.exe
    • Changed the file contents
  • %SYSTEM%\rcimlby.exe
    • Changed the file contents
  • %SYSTEM%\utilman.exe
    • Changed the file contents
  • %SYSTEM%\notepad.exe
    • Changed the file contents
  • %SYSTEM%\mnmsrvc.exe
    • Changed the file contents
  • %SYSTEM%\cmd.exe
    • Changed the file contents
  • %SYSTEM%\magnify.exe
    • Changed the file contents
  • %SYSTEM%\msiexec.exe
    • Changed the file contents
Registry Keys Created
  • HKLM\SYSTEM\CurrentControlSet\Services\CiSvc\Enum
    Count
    0x00000001
  • HKLM\SYSTEM\CurrentControlSet\Services\VSS\Enum
    NextInstance
    0x00000001
  • HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2
    2103
    0x00000000
  • HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0
    2103
    0x00000000
  • HKLM\SYSTEM\CurrentControlSet\Services\ImapiService\Enum
    0
    Root\LEGACY_IMAPISERVICE\0000
  • HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1
    2103
    0x00000000
  • HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4
    2103
    0x00000000
  • HKLM\SYSTEM\CurrentControlSet\Services\ClipSrv\Enum
    Count
    0x00000001
  • HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3
    2103
    0x00000000
Registry Keys Modified
  • HKLM\SYSTEM\CurrentControlSet\Services\ImapiService
    Start
    0x00000002
  • HKLM\SYSTEM\CurrentControlSet\Services\MSIServer
    Type
    0x00000120
  • HKLM\SYSTEM\CurrentControlSet\Services\COMSysApp
    Start
    0x00000002
  • HKLM\SYSTEM\CurrentControlSet\Services\Spooler
    Start
    0x00000002
  • HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1
    1406
    0x00000000
  • HKLM\SYSTEM\CurrentControlSet\Services\TlntSvr
    Type
    0x00000110
  • HKLM\SYSTEM\CurrentControlSet\Services\VSS
    Type
    0x00000110
  • HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0
    1609
    0x00000000
  • HKLM\SYSTEM\CurrentControlSet\Services\NetDDE
    Start
    0x00000002
  • HKLM\SYSTEM\CurrentControlSet\Services\CiSvc
    Start
    0x00000002
  • HKLM\SYSTEM\CurrentControlSet\Services\ClipSrv
    Start
    0x00000002
  • HKLM\SYSTEM\CurrentControlSet\Services\dmadmin
    Type
    0x00000120
  • HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4
    1609
    0x00000000
  • HKLM\SYSTEM\CurrentControlSet\Services\RSVP
    Type
    0x00000110
  • HKLM\SYSTEM\CurrentControlSet\Services\mnmsrvc
    Start
    0x00000002
  • HKLM\SYSTEM\CurrentControlSet\Services\RDSessMgr
    Start
    0x00000002
  • HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2
    1609
    0x00000000
Processes Created
  • c:\windows\system32\cisvc.exe
  • c:\windows\system32\dllhost.exe
  • c:\windows\system32\imapi.exe
  • c:\windows\system32\msiexec.exe
  • c:\windows\system32\vssvc.exe

Example 2

File Information

Size
166K
SHA-1
00012ff97ba4e7af16bf0c84138577188f9e91c3
MD5
10ec9e27ded435179ae43ac45b242151
CRC-32
22db2e0c
File type
Windows executable
First seen
2015-09-04

Runtime Analysis

Dropped Files
  • C:\WINDOWS\system32\clipsrv.vir
    Size
    193K
    SHA-1
    cf259271a899e9d889b448fbdd9a2e327aa653d6
    MD5
    3fc11b16d3fc51c264f5c26c89d6185f
    CRC-32
    2cf4c6ff
    File type
    Windows executable
    First seen
    2015-09-04
Modified Files
  • %SYSTEM%\tlntsvr.exe
    • Changed the file contents
  • %SYSTEM%\alg.exe
    • Changed the file contents
  • %SYSTEM%\msdtc.exe
    • Changed the file contents
  • %SYSTEM%\scardsvr.exe
    • Changed the file contents
  • %SYSTEM%\dmadmin.exe
    • Changed the file contents
  • %SYSTEM%\narrator.exe
    • Changed the file contents
  • %SYSTEM%\mobsync.exe
    • Changed the file contents
  • %WINDOWS%\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe
    • Changed the file contents
  • %SYSTEM%\vssvc.exe
    • Changed the file contents
  • %SYSTEM%\locator.exe
    • Changed the file contents
  • %PROGRAM FILES%\Java\jre6\bin\jqs.exe
    • Changed the file contents
  • %WINDOWS%\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
    • Changed the file contents
  • %SYSTEM%\utilman.exe
    • Changed the file contents
  • %SYSTEM%\msiexec.exe
    • Changed the file contents
  • %SYSTEM%\smlogsvc.exe
    • Changed the file contents
  • %SYSTEM%\magnify.exe
    • Changed the file contents
  • %SYSTEM%\wbem\wmiapsrv.exe
    • Changed the file contents
  • %SYSTEM%\spoolsv.exe
    • Changed the file contents
  • %SYSTEM%\rsvp.exe
    • Changed the file contents
  • %SYSTEM%\mnmsrvc.exe
    • Changed the file contents
  • %WINDOWS%\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
    • Changed the file contents
  • %SYSTEM%\rcimlby.exe
    • Changed the file contents
  • %SYSTEM%\cmd.exe
    • Changed the file contents
  • %WINDOWS%\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
    • Changed the file contents
  • %WINDOWS%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
    • Changed the file contents
  • %SYSTEM%\netdde.exe
    • Changed the file contents
  • %SYSTEM%\cisvc.exe
    • Changed the file contents
  • %SYSTEM%\osk.exe
    • Changed the file contents
  • %SYSTEM%\sessmgr.exe
    • Changed the file contents
  • %PROGRAM FILES%\Outlook Express\msimn.exe
    • Changed the file contents
  • %SYSTEM%\clipsrv.exe
    • Changed the file contents
  • %SYSTEM%\imapi.exe
    • Changed the file contents
  • %PROGRAM FILES%\Windows Media Player\wmplayer.exe
    • Changed the file contents
  • %PROGRAM FILES%\Outlook Express\wab.exe
    • Changed the file contents
Registry Keys Created
  • HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3
    2103
    0x00000000
  • HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1
    2103
    0x00000000
  • HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4
    2103
    0x00000000
  • HKLM\SYSTEM\CurrentControlSet\Services\CiSvc\Enum
    NextInstance
    0x00000001
  • HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0
    2103
    0x00000000
  • HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2
    2103
    0x00000000
Registry Keys Modified
  • HKLM\SYSTEM\CurrentControlSet\Services\dmadmin
    Start
    0x00000002
  • HKLM\SYSTEM\CurrentControlSet\Services\idsvc
    Start
    0x00000002
  • HKLM\SYSTEM\CurrentControlSet\Services\wscsvc
    Start
    0x00000004
  • HKLM\SYSTEM\CurrentControlSet\Services\NetDDE
    Type
    0x00000120
  • HKLM\SYSTEM\CurrentControlSet\Services\VSS
    Type
    0x00000110
  • HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1
    1609
    0x00000000
  • HKLM\SYSTEM\CurrentControlSet\Services\Spooler
    Start
    0x00000002
  • HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0
    1609
    0x00000000
  • HKLM\SYSTEM\CurrentControlSet\Services\ImapiService
    Start
    0x00000002
  • HKLM\SYSTEM\CurrentControlSet\Services\clr_optimization_v4.0.30319_32
    Type
    0x00000110
  • HKLM\SYSTEM\CurrentControlSet\Services\swi_update
    Type
    0x00000110
  • HKLM\SYSTEM\CurrentControlSet\Services\TlntSvr
    Start
    0x00000002
  • HKLM\SYSTEM\CurrentControlSet\Services\JavaQuickStarterService
    Start
    0x00000002
  • HKLM\SYSTEM\CurrentControlSet\Services\MSIServer
    Start
    0x00000002
  • HKLM\SYSTEM\CurrentControlSet\Services\RSVP
    Start
    0x00000002
  • HKLM\SYSTEM\CurrentControlSet\Services\mnmsrvc
    Start
    0x00000002
  • HKLM\SYSTEM\CurrentControlSet\Services\RDSessMgr
    Start
    0x00000002
  • HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2
    1609
    0x00000000
  • HKLM\SYSTEM\CurrentControlSet\Services\CiSvc
    Start
    0x00000002
  • HKLM\SYSTEM\CurrentControlSet\Services\swi_service
    Start
    0x00000002
  • HKLM\SYSTEM\CurrentControlSet\Services\clr_optimization_v2.0.50727_32
    Start
    0x00000002
  • HKLM\SYSTEM\CurrentControlSet\Services\Sophos AutoUpdate Service
    Start
    0x00000002
  • HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4
    1609
    0x00000000
Processes Created
  • c:\windows\system32\cisvc.exe

Example 3

File Information

Size
532K
SHA-1
0007089e4c11210429504eb233c7c120eca27396
MD5
e32a88ac6244b347513abf2e4bde6adf
CRC-32
40314a21
File type
Windows executable
First seen
2015-02-15

Runtime Analysis

Modified Files
  • %SYSTEM%\tlntsvr.exe
    • Changed the file contents
  • %SYSTEM%\mnmsrvc.exe
    • Changed the file contents
  • %WINDOWS%\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
    • Changed the file contents
  • %SYSTEM%\smlogsvc.exe
    • Changed the file contents
  • %SYSTEM%\wbem\wmiapsrv.exe
    • Changed the file contents
  • %WINDOWS%\regedit.exe
    • Changed the file contents
  • %WINDOWS%\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
    • Changed the file contents
  • %SYSTEM%\netdde.exe
    • Changed the file contents
  • %PROGRAM FILES%\notepadpp\notepad++.exe
    • Changed the file contents
  • %SYSTEM%\clipsrv.exe
    • Changed the file contents
  • %SYSTEM%\sessmgr.exe
    • Changed the file contents
  • %WINDOWS%\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe
    • Changed the file contents
  • %PROGRAM FILES%\Java\jre6\bin\jqs.exe
    • Changed the file contents
  • %SYSTEM%\spoolsv.exe
    • Changed the file contents
  • %SYSTEM%\cisvc.exe
    • Changed the file contents
  • %SYSTEM%\imapi.exe
    • Changed the file contents
  • %WINDOWS%\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
    • Changed the file contents
  • %WINDOWS%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
    • Changed the file contents
  • %SYSTEM%\locator.exe
    • Changed the file contents
  • %SYSTEM%\cmd.exe
    • Changed the file contents
  • %SYSTEM%\dmadmin.exe
    • Changed the file contents
  • %SYSTEM%\scardsvr.exe
    • Changed the file contents
  • %SYSTEM%\msiexec.exe
    • Changed the file contents
  • %SYSTEM%\vssvc.exe
    • Changed the file contents
  • %SYSTEM%\alg.exe
    • Changed the file contents
Registry Keys Created
  • HKLM\SYSTEM\CurrentControlSet\Services\CiSvc\Enum
    NextInstance
    0x00000001
Registry Keys Modified
  • HKLM\SYSTEM\CurrentControlSet\Services\clr_optimization_v4.0.30319_32
    Type
    0x00000110
  • HKLM\SYSTEM\CurrentControlSet\Services\mnmsrvc
    Start
    0x00000002
  • HKLM\SYSTEM\CurrentControlSet\Services\MSIServer
    Start
    0x00000002
  • HKLM\SYSTEM\CurrentControlSet\Services\wscsvc
    Start
    0x00000004
  • HKLM\SYSTEM\CurrentControlSet\Services\ImapiService
    Start
    0x00000002
  • HKLM\SYSTEM\CurrentControlSet\Services\clr_optimization_v2.0.50727_32
    Start
    0x00000002
  • HKLM\SYSTEM\CurrentControlSet\Services\TlntSvr
    Start
    0x00000002
  • HKLM\SYSTEM\CurrentControlSet\Services\JavaQuickStarterService
    Start
    0x00000002
  • HKLM\SYSTEM\CurrentControlSet\Services\swi_update
    Type
    0x00000110
  • HKLM\SYSTEM\CurrentControlSet\Services\ClipSrv
    Type
    0x00000110
  • HKLM\SYSTEM\CurrentControlSet\Services\dmadmin
    Start
    0x00000002
  • HKLM\SYSTEM\CurrentControlSet\Services\VSS
    Type
    0x00000110
  • HKLM\SYSTEM\CurrentControlSet\Services\swi_service
    Start
    0x00000002
  • HKLM\SYSTEM\CurrentControlSet\Services\CiSvc
    Start
    0x00000002
  • HKLM\SYSTEM\CurrentControlSet\Services\Spooler
    Start
    0x00000002
  • HKLM\SYSTEM\CurrentControlSet\Services\idsvc
    Start
    0x00000002
  • HKLM\SYSTEM\CurrentControlSet\Services\RDSessMgr
    Start
    0x00000002
  • HKLM\SYSTEM\CurrentControlSet\Services\NetDDE
    Type
    0x00000120
  • HKLM\SYSTEM\CurrentControlSet\Services\Sophos AutoUpdate Service
    Start
    0x00000002
Processes Created
  • c:\windows\system32\cisvc.exe

download Try Sophos products for free
Download now