Worm:Win32/Synigh.A is a worm that spreads to other computers across a network. It also has a backdoor component that is capable of connecting to an IRC server and executing commands from a remote attacker.
Installation
Worm:Win32/Synigh.A creates the following files in the system:
- <system folder>\system.exe - copy of itself as a hidden file
- <system folder>\<3 digit number>.exe - another copy of itself
- %temp%\<5 digit number>.sys - a rootkit driver, detected as VirTool:WinNT/Rootkitdrv.GH
Note - <system folder> refers to a variable location that is determined by the malware by querying the Operating System. The default installation location for the System folder for Windows 2000 and NT is C:\Winnt\System32; and for XP and Vista is C:\Windows\System32.
It creates the mutex "NvCplDaemon" and the following registry entry:
Adds value: "Content Type"
With data: "text/x-component"
To subkey: HKCR\.htc\
It also creates the following registry entry to enable its copy to run every time Windows starts:
Modifies value: ""
From data: "<system folder>\userinit.exe"
With data: "<system folder>\userinit.exe,<system folder>\system.exe"
To subkey: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Adds value: "NvCplDaemon"
With data: "<system folder>\system.exe"
To subkey: HKLM\Software\Microsoft\Windows\CurrentVersion\Run
If any of the above autorun registry entries are modified or deleted, Worm:Win32/Synigh.A recreates them.
It also monitors the following registry key to check if its copies are pending for renaming:
HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\PendingFileRenameOperations
If an entry exists for any of its copies, that entry is removed to prevent them from being renamed.
Worm:Win32/Synigh.A also injects malware code into "explorer.exe".
Spreads Via...
Removable Drives
Worm:Win32/Synigh.A may spread to other systems via removable drives. If a removable drive, such as a flash drive or a portable hard disk, is present in the system, Worm:Win32/Synigh.A drops the following files in it:
- explorer.exe - copy of itself
- autorun.inf - INF file that enables the backdoor copy to automatically run every time the drive is accessed and Autorun is enabled
MS08-067
Worm:Win32/Synigh.A may spread to other systems that are unpatched against the vulnerability discussed in Microsoft
Security Bulletin MS08-067. It creates a thread that scans for possible exploitable machines and, if found, copies itself in the system.
Yahoo! Messenger
Worm:Win32/Synigh.A may spread via Yahoo! Messenger. If Yahoo! Messenger is currently active in the system, it spreads by sending a copy of itself to all of the user's contacts.
Payload
Bypasses Firewall
Worm:Win32/Synigh.A bypasses the system firewall by adding itself to the firewall exception list:
Adds value: ""
With data: "<system folder>\system.exe:*:Enabled:NvCplDaemon"
To subkey: HKLM\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
Modifies System Date
Worm:Win32/Synigh.A modifies the system date to January 1, 2090.
Backdoor Functionality
Worm:Win32/Synigh.A attempts to connect to the IRC server "sex.pornoturkiye.com" via TCP port 81. Once connected, an attacker can instruct this backdoor to download and execute files, scan for other systems, perform Denial of Service attacks, and attempt to access systems vulnerable to certain exploits.
Blocks MSN Communication
Worm:Win32/Synigh.A checks if MSN Messenger is active in the system. If it is, it blocks all communication between the user and the user's contacts.
Analysis by Scott Molenkamp and Patrik Vicol
