Trojan.Agent.CCPK_b1f44a7f6d

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

vjnfk.exe:3624
%original file name%.exe:3864

The Trojan injects its code into the following process(es):No processes have been created.

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process vjnfk.exe:3624 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

C:\original .exe (1963131 bytes)
C:\config.sys .exe (1963131 bytes)
C:\bootmgr .exe (1963131 bytes)
C:\Boot .exe (1963131 bytes)
C:\Windows .exe (1963131 bytes)
C:\ProgramData .exe (1963131 bytes)
C:\$Recycle.Bin .exe (1963131 bytes)
C:\BOOTSECT.BAK .exe (1963131 bytes)
%Documents and Settings% .exe (1963131 bytes)
C:\%original file name%.exe .exe (1963131 bytes)
C:\totalcmd .exe (1963131 bytes)
C:\Users .exe (1963131 bytes)
C:\XELDZ .exe (1963131 bytes)
C:\autoexec.bat .exe (1963131 bytes)
C:\System Volume Information .exe (1963131 bytes)
C:\marker .exe (1963131 bytes)
%Program Files% .exe (1963131 bytes)
C:\pagefile.sys .exe (1963131 bytes)

The Trojan deletes the following file(s):

C:\Miray (0 bytes)
C:\Mirat (0 bytes)
C:\Mirav (0 bytes)
C:\Miraw (0 bytes)
C:\Mirap (0 bytes)
C:\Mirar (0 bytes)
C:\Miras (0 bytes)
C:\Miral (0 bytes)
C:\Mirao (0 bytes)
C:\Mirai (0 bytes)
C:\Mirak (0 bytes)
C:\Mirad (0 bytes)
C:\Mirae (0 bytes)
C:\Mirag (0 bytes)
C:\Miraa (0 bytes)
C:\Mirab (0 bytes)

The process %original file name%.exe:3864 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

C:\ProgramData\Saaaalamm\Mira.h (960208 bytes)
C:\ProgramData\vjnfk.exe (1020884 bytes)

Registry activity

The process vjnfk.exe:3624 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Microsoft® Windows® Operating System" = "C:\ProgramData\vjnfk.exe"

Dropped PE files

MD5	File path
a88dd34654b176d2743e28ffae0dca4f	c:\$Recycle.Bin .exe
a835b82a83416bcf213eb4a1b0d01c7e	c:\BOOTSECT.BAK .exe
faf3b7fbbdef911a01a9414c211a8d89	c:\Boot .exe
b1b7af136d04c164b6e838964c067e9b	c:\Documents and Settings .exe
d477a1a01df7d8f8703a50e9c2d50f9f	c:\Perl .exe
e581c52c8d1e97aca92f021b9bf14d36	c:\Program Files .exe
5cb155c4e2f307c20ed24094be3f152f	c:\ProgramData .exe
0097732504850319971faed87f071fd4	c:\ProgramData\Saaaalamm\Mira.h
3ef1e5595053d83587678fa7c8ee25f5	c:\ProgramData\vjnfk.exe
886f205bc770fa96c4bae68595ac55a8	c:\System Volume Information .exe
81b19176bd79601ec71c3bd5db199923	c:\Users .exe
0097732504850319971faed87f071fd4	c:\Users\All Users\Saaaalamm\Mira.h
3ef1e5595053d83587678fa7c8ee25f5	c:\Users\All Users\vjnfk.exe
84c1e190b8ee224b99ffef6307400c8a	c:\Windows .exe
cfdca2beb51e12811e0a0b5f0e846b1c	c:\XELDZ .exe
82d25c14c8b13ce1f09456edc2654ffe	c:\autoexec.bat .exe
7c343af4016b1dc8542eb7726158ec12	c:\%original file name%.exe .exe
50796a53ad653d21baf0a1e64a181bd8	c:\bootmgr .exe
68e92b0129b0aa6b8c977accaf424c03	c:\config.sys .exe
bcf5a57e9d4ca489ca9098e575366f8c	c:\marker .exe
2c99eca8b3d19eb703a24d6efc410a98	c:\original .exe
eb928c685b8ad8a6e532a8fafd37afc7	c:\pagefile.sys .exe
99d29195725f4ba1a22a66a3ab4fed13	c:\totalcmd .exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):

   vjnfk.exe:3624
   %original file name%.exe:3864

2. Delete the original Trojan file.
   
3. Delete or disinfect the following files created/modified by the Trojan:

   C:\original .exe (1963131 bytes)
   C:\config.sys .exe (1963131 bytes)
   C:\bootmgr .exe (1963131 bytes)
   C:\Boot .exe (1963131 bytes)
   C:\Windows .exe (1963131 bytes)
   C:\ProgramData .exe (1963131 bytes)
   C:\$Recycle.Bin .exe (1963131 bytes)
   C:\BOOTSECT.BAK .exe (1963131 bytes)
   %Documents and Settings% .exe (1963131 bytes)
   C:\%original file name%.exe .exe (1963131 bytes)
   C:\totalcmd .exe (1963131 bytes)
   C:\Users .exe (1963131 bytes)
   C:\XELDZ .exe (1963131 bytes)
   C:\autoexec.bat .exe (1963131 bytes)
   C:\System Volume Information .exe (1963131 bytes)
   C:\marker .exe (1963131 bytes)
   %Program Files% .exe (1963131 bytes)
   C:\pagefile.sys .exe (1963131 bytes)
   C:\ProgramData\Saaaalamm\Mira.h (960208 bytes)
   C:\ProgramData\vjnfk.exe (1020884 bytes)

4. Delete the following value(s) in the autorun key (How to Work with System Registry):

   [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
   "Microsoft® Windows® Operating System" = "C:\ProgramData\vjnfk.exe"

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name: Microsoft Corporation
Product Name: Mira Malware
Product Version: 1.0.0.155
Legal Copyright: Microsoft Corporation
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 1.0.0.155
File Description: Mira Malware
Comments:
Language: English (United States)

Company Name: Microsoft CorporationProduct Name: Mira MalwareProduct Version: 1.0.0.155Legal Copyright: Microsoft CorporationLegal Trademarks: Original Filename: Internal Name: File Version: 1.0.0.155File Description: Mira MalwareComments: Language: English (United States)

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	245368	245760	4.22546	1999eec8e9c4cd12139326da6738ca99
.data	249856	608	1024	0.488703	6fda88cf7188a8245a53dfde927250fd
.rdata	253952	9384	9728	3.47165	dbe852009dbd077a9976cb0ecfb9aadf
.bss	266240	18576	0	0	d41d8cd98f00b204e9800998ecf8427e
.idata	286720	2212	2560	2.97703	5e5242c565219f3bd33a6568632559dc
.rsrc	290816	758300	750855	4.88663	8c4224c3740d28523ccf8099c5a7eb30

Dropped from:

fb35649bd137f156d69ff48182e47750

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 5
4cc1649a00723d63d0df81c2a1288796
68d0729e9ec8ac3eb4c3a8ff854bb0dd
c19ebd1ea2090329ebeadd4c8a5bc2ad
c1ec345b48cd79a404188bb87be4a31f
ac6219f1fd4d9efa720534228989e631

Network Activity

URLs

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

vjnfk.exe_3624:

.text

.text

`.data

`.data

.rdata

.rdata

@.bss

@.bss

.idata

.idata

C:\ProgramData\vjnfk.exe

C:\ProgramData\vjnfk.exe

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Run

Windows

Windows

Operating System

Operating System

%H:%M:%S

%H:%M:%S

%m/%d/%y

%m/%d/%y

-0123456789

-0123456789

%s:%u: failed assertion `%s'

%s:%u: failed assertion `%s'

RegCloseKey

RegCloseKey

RegOpenKeyA

RegOpenKeyA

ADVAPI32.DLL

ADVAPI32.DLL

KERNEL32.dll

KERNEL32.dll

msvcrt.dll

msvcrt.dll

SHELL32.DLL

SHELL32.DLL

SearchProtocolHost.exe_3616:

.text

.text

`.data

`.data

.rsrc

.rsrc

@.reloc

@.reloc

ADVAPI32.dll

ADVAPI32.dll

ntdll.DLL

ntdll.DLL

KERNEL32.dll

KERNEL32.dll

msvcrt.dll

msvcrt.dll

USER32.dll

USER32.dll

ole32.dll

ole32.dll

OLEAUT32.dll

OLEAUT32.dll

TQUERY.DLL

TQUERY.DLL

MSSHooks.dll

MSSHooks.dll

IMM32.dll

IMM32.dll

SHLWAPI.dll

SHLWAPI.dll

SrchCollatorCatalogInfo

SrchCollatorCatalogInfo

SrchDSSLogin

SrchDSSLogin

SrchDSSPortManager

SrchDSSPortManager

SrchPHHttp

SrchPHHttp

SrchIndexerQuery

SrchIndexerQuery

SrchIndexerProperties

SrchIndexerProperties

SrchIndexerPlugin

SrchIndexerPlugin

SrchIndexerClient

SrchIndexerClient

SrchIndexerSchema

SrchIndexerSchema

Msidle.dll

Msidle.dll

Failed to get REGKEY_FLTRDMN_MS_TO_IDLE, using default

Failed to get REGKEY_FLTRDMN_MS_TO_IDLE, using default

pfps->psProperty.ulKind is LPWSTR but psProperty.lpwstr is NULL or empty

pfps->psProperty.ulKind is LPWSTR but psProperty.lpwstr is NULL or empty

d:\win7sp1_gdr\enduser\mssearch2\common\utils\crchash.cxx

d:\win7sp1_gdr\enduser\mssearch2\common\utils\crchash.cxx

d:\win7sp1_gdr\enduser\mssearch2\search\search\gather\fltrdmn\fltrdaemon.cxx

d:\win7sp1_gdr\enduser\mssearch2\search\search\gather\fltrdmn\fltrdaemon.cxx

d:\win7sp1_gdr\enduser\mssearch2\search\common\include\secutil.hxx

d:\win7sp1_gdr\enduser\mssearch2\search\common\include\secutil.hxx

d:\win7sp1_gdr\enduser\mssearch2\common\tracer\tracerhelpers.h

d:\win7sp1_gdr\enduser\mssearch2\common\tracer\tracerhelpers.h

d:\win7sp1_gdr\enduser\mssearch2\common\tracer\mutex.cpp

d:\win7sp1_gdr\enduser\mssearch2\common\tracer\mutex.cpp

d:\win7sp1_gdr\enduser\mssearch2\common\include\srchxcpt.hxx

d:\win7sp1_gdr\enduser\mssearch2\common\include\srchxcpt.hxx

RegDeleteKeyW

RegDeleteKeyW

RegDeleteKeyExW

RegDeleteKeyExW

8%uiP

8%uiP

Invalid parameter passed to C runtime function.

Invalid parameter passed to C runtime function.

d:\win7sp1_gdr\enduser\mssearch2\common\tracer\tracersecutil.h

d:\win7sp1_gdr\enduser\mssearch2\common\tracer\tracersecutil.h

d:\win7sp1_gdr\enduser\mssearch2\common\tracer\tracmain.cpp

d:\win7sp1_gdr\enduser\mssearch2\common\tracer\tracmain.cpp

-d-d-d-d-d-d-d-%d

-d-d-d-d-d-d-d-%d

d:\win7sp1_gdr\enduser\mssearch2\common\tracer\tracmain.h

d:\win7sp1_gdr\enduser\mssearch2\common\tracer\tracmain.h

0xx=

0xx=

%s(%d)

%s(%d)

tid="0x%x"

tid="0x%x"

pid="0x%x"

pid="0x%x"

tagname="%s"

tagname="%s"

tagid="0x%x"

tagid="0x%x"

el="0x%x"

el="0x%x"

time="d/d/d d:d:d.d"

time="d/d/d d:d:d.d"

logname="%s"

logname="%s"

d:\win7sp1_gdr\enduser\mssearch2\common\tracer\sysimprs.cxx

d:\win7sp1_gdr\enduser\mssearch2\common\tracer\sysimprs.cxx

SHELL32.dll

SHELL32.dll

PROPSYS.dll

PROPSYS.dll

ntdll.dll

ntdll.dll

RegCloseKey

RegCloseKey

RegCreateKeyExW

RegCreateKeyExW

RegOpenKeyExW

RegOpenKeyExW

RegQueryInfoKeyW

RegQueryInfoKeyW

RegEnumKeyExW

RegEnumKeyExW

ReportEventW

ReportEventW

_amsg_exit

_amsg_exit

MsgWaitForMultipleObjects

MsgWaitForMultipleObjects

SearchProtocolHost.pdb

SearchProtocolHost.pdb

2 2(20282|2

2 2(20282|2

4%5S5

4%5S5

Software\Microsoft\Windows Search

Software\Microsoft\Windows Search

https

https

kernel32.dll

kernel32.dll

msTracer.dll

msTracer.dll

msfte.dll

msfte.dll