Threat behavior
Win32/Haxdoor is a family of rootkit-capable backdoor trojans which gather and send private user data to remote attackers. Collected data might include user names and passwords, credit card numbers, bank logon credentials, or other sensitive financial information. Files and processes related to a Win32/Haxdoor infection may be hidden by a kernel-mode rootkit component, detected by Microsoft as WinNT/Haxdoor. Win32/Haxdoor can also disable security-related software and redirect the infected user’s URL connection requests. Depending on the version of the operation system infected, Win32/Haxdoor may perform other malicious actions, such as clearing CMOS settings, destroying disk data, and shutting down Windows unexpectedly.
Installation
Win32/Haxdoor is a family of backdoor trojans with rootkit capabilities. When a Win32/Haxdoor trojan is run, it typically performs the following operations:
- Drops two identical DLLs; one of the DLLs is a backup in case the other DLL is modified or deleted.
- Drops two identical system driver (.sys) files; one of these files is a backup in case the other driver is modified or deleted. Alternatively, the trojan may drop two distinct system driver (.sys) files and two additional driver files as backups in case the originals are modified or deleted. The trojan's rootkit functionality is contained in a system driver file.
- Drops an empty .ini file in the Windows system folder. The trojan uses this file to store configuration information for its operations.
- Creates services for the dropped system drivers and may modify the registry so that Windows loads the drivers each time it starts, even in safe mode.
- Modifies the registry so that each time a user logs on, the dropped DLL is loaded and a specified function in the DLL is called at the privilege level of the current user. This is accomplished as follows:
- On an infected host running a Windows NT-based operating system such as Windows XP or Windows Server 2003:
Creates a subkey under registry subkey
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify
and creates the following values and data in that subkey:
Adds value: DllName
with data: <name of dropped DLL>
Adds value: Startup
with data: <name of an exported function in dropped DLL>
Adds value: Impersonate
with data: 1
Adds value: Asynchronous
with data: 1
Adds value: MaxWait
with data: 1 - On an infected host running Windows 95, Windows 98, or Windows ME:
Adds values to registry subkey
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\MPRServices\TestService
as follows:
Adds value: DllName
with data: <name of dropped DLL>
Adds value: Entrypoint
with data: <name of an exported function in dropped DLL>
Adds value: StackSize
with data: 0
Runs the Windows system file mprexe.exe. This causes the dropped DLL to be loaded due to the Win32/Haxdoor modifications in the MPRServices subkey.
A system driver (.sys) file dropped by Win32/Haxdoor may take the following actions (Windows NT-based operating systems only):
Clear CMOS settings.
Destroy disk data.
Enable or disable the keyboard or floppy drive.
Act as a rootkit. The rootkit intercepts calls to certain Windows API functions. Win32/Haxdoor uses this method to hide files and ports, hide and prevent termination of Win32/Haxdoor processes, disable firewalls and antivirus software, steal user data (such as data exchanged with certain Web sites), and redirect certain URL-connection user requests.
Payload
Resists Removal
The same system driver may perform the following additional operations (alternatively, some Win32/Haxdoor variants drop a second driver to perform these operations):
Reset registry entries, if necessary, to match registry modifications that Win32/Haxdoor makes during installation. The Win32/Haxdoor DLL monitors the trojan registry entries and calls this system driver to restore modified or deleted entries as necessary.
Restore Win32/Haxdoor files, if necessary. This system driver may attempt to open files that Win32/Haxdoor drops during installation. If a file-open operation fails, the driver can restore the file using a backup file dropped by Win32/Haxdoor during installation.
Lock files that Win32/Haxdoor drops at installation so that the files cannot be modified or deleted.
Steals Data
The DLL code may perform the following operations when it runs:
Additional Information
Many of the Win32/Haxdoor trojans are created using a commercially available trojan-creator kit. The kernel-mode component of Win32/Haxdoor is detected as WinNT/Haxdoor.
In the wild, this trojan may be distributed via spam e-mail messages to users disguised as a useful file, or in some cases as a security update for Windows. The attached file may named ‘KB######.exe’, where ‘######’ is a sequence of six numbers as in the following examples:
KB631829.exe
KB519287.exe
And so on. The following is example text of spam e-mail text:
Dear Microsoft Customer, Please notice that Microsoft company has recently issued a Security Update for OS Microsoft Windows. The update applies to the following OS versions: Microsoft Windows 98, Microsoft Windows 2000, Microsoft Windows Millenium, Microsoft Windows XP, Microsoft Windows Vista. Please notice, that present update applies to high-priority updates category. In order to help protect your computer against security threats and performance problems, we strongly recommend you to install this update. Since public distribution of this Update through the official website http://www.microsoft.com would have result in efficient creation of a malicious software, we made a decision to issue an experimental private version of an update for all Microsoft Windows OS users. As your computer is set to receive notifications when new updates are available, you have received this notice. In order to start the update, please follow the step-by-step instruction:
1. Run the file, that you have received along with this message.
2. Carefully follow all the instructions you see on the screen. If nothing changes after you have run the file, probably in the settings of your OS you have an indication to run all the updates at a background routine. In that case, at this point the upgrade of your OS will be finished. We apologize for any inconvenience this back order may be causing you.
Thank you,
Steve Lipner
Director of Security Assurance
Microsoft Corp. |
Prevention
