Gen.Heur.Minggy.1_f0cb2696ef

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

%original file name%.exe:3816
qvxwx.exe:3956

The Trojan injects its code into the following process(es):No processes have been created.

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process %original file name%.exe:3816 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

C:\ProgramData\Saaaalamm\Mira.h (542872 bytes)
C:\ProgramData\qvxwx.exe (646029 bytes)

The process qvxwx.exe:3956 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

C:\original .exe (1188695 bytes)
C:\config.sys .exe (1188695 bytes)
C:\bootmgr .exe (1188695 bytes)
C:\Boot .exe (1188695 bytes)
C:\Windows .exe (1188695 bytes)
C:\ProgramData .exe (1188695 bytes)
C:\$Recycle.Bin .exe (1188695 bytes)
C:\BOOTSECT.BAK .exe (1188695 bytes)
C:\%original file name%.exe .exe (1188695 bytes)
%Documents and Settings% .exe (1188695 bytes)
C:\totalcmd .exe (1188695 bytes)
C:\Users .exe (1188695 bytes)
C:\XELDZ .exe (1188695 bytes)
C:\autoexec.bat .exe (1188695 bytes)
C:\System Volume Information .exe (1188695 bytes)
C:\marker .exe (1188695 bytes)
%Program Files% .exe (1188695 bytes)
C:\pagefile.sys .exe (1188695 bytes)

The Trojan deletes the following file(s):

C:\Miray (0 bytes)
C:\Mirat (0 bytes)
C:\Mirav (0 bytes)
C:\Miraw (0 bytes)
C:\Mirar (0 bytes)
C:\Miral (0 bytes)
C:\Miram (0 bytes)
C:\Miran (0 bytes)
C:\Mirao (0 bytes)
C:\Miraj (0 bytes)
C:\Mirad (0 bytes)
C:\Mirae (0 bytes)
C:\Miraf (0 bytes)
C:\Mirag (0 bytes)
C:\Miraa (0 bytes)
C:\Mirab (0 bytes)

Registry activity

The process qvxwx.exe:3956 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Microsoft® Windows® Operating System" = "C:\ProgramData\qvxwx.exe"

Dropped PE files

MD5	File path
6d3e6198f9a8719aa8f6684a5cc887f6	c:\$Recycle.Bin .exe
07f300bf5e569783869037f740d9d1ca	c:\BOOTSECT.BAK .exe
44d385ab054943af2bde87628dc8f2c5	c:\Boot .exe
0cdf1d2bd3220e76409560ee4b6e6820	c:\Documents and Settings .exe
cfd73d1b719d9e642c9bc4d9e92087ee	c:\Perl .exe
9006bc055d2ad10346536c7fd18a7d51	c:\Program Files .exe
ccee0f204254c2934da2a2abe4412985	c:\ProgramData .exe
a17c5d4d029b25865e8d97986fd5aaa3	c:\ProgramData\Saaaalamm\Mira.h
ff7b5cddd533b7d8b4b0225c0ac4a43d	c:\ProgramData\qvxwx.exe
46d11ec30089cde81a493e9063d82d35	c:\System Volume Information .exe
b50de10ce9e03e6a727b67808ba6c860	c:\Users .exe
a17c5d4d029b25865e8d97986fd5aaa3	c:\Users\All Users\Saaaalamm\Mira.h
ff7b5cddd533b7d8b4b0225c0ac4a43d	c:\Users\All Users\qvxwx.exe
5d40c7902f905fad775f21b0e942a9c1	c:\Windows .exe
5c1c499f19af1277f737f33c9d593522	c:\XELDZ .exe
0322411a739e9301e63d9be22a4a0c12	c:\autoexec.bat .exe
dc9207efc7a43e866bbab2444dd94257	c:\bootmgr .exe
7e2a68386f926d997f3a994bdfe22ac6	c:\config.sys .exe
e4a12be1e16bf0f90bca46ea100e4ebb	c:\%original file name%.exe .exe
43262660c90157f80a3d57b5c04b6ca6	c:\marker .exe
c519fd04bdd81993a23a4ef30a848fc7	c:\original .exe
5a41e3288fb5da5aa6388da86a8a31bc	c:\pagefile.sys .exe
72bf6b5f13f716f7f12d31b97edb01be	c:\totalcmd .exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):

   %original file name%.exe:3816
   qvxwx.exe:3956

2. Delete the original Trojan file.
   
3. Delete or disinfect the following files created/modified by the Trojan:

   C:\ProgramData\Saaaalamm\Mira.h (542872 bytes)
   C:\ProgramData\qvxwx.exe (646029 bytes)
   C:\original .exe (1188695 bytes)
   C:\config.sys .exe (1188695 bytes)
   C:\bootmgr .exe (1188695 bytes)
   C:\Boot .exe (1188695 bytes)
   C:\Windows .exe (1188695 bytes)
   C:\ProgramData .exe (1188695 bytes)
   C:\$Recycle.Bin .exe (1188695 bytes)
   C:\BOOTSECT.BAK .exe (1188695 bytes)
   C:\%original file name%.exe .exe (1188695 bytes)
   %Documents and Settings% .exe (1188695 bytes)
   C:\totalcmd .exe (1188695 bytes)
   C:\Users .exe (1188695 bytes)
   C:\XELDZ .exe (1188695 bytes)
   C:\autoexec.bat .exe (1188695 bytes)
   C:\System Volume Information .exe (1188695 bytes)
   C:\marker .exe (1188695 bytes)
   %Program Files% .exe (1188695 bytes)
   C:\pagefile.sys .exe (1188695 bytes)

4. Delete the following value(s) in the autorun key (How to Work with System Registry):

   [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
   "Microsoft® Windows® Operating System" = "C:\ProgramData\qvxwx.exe"

5. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

No information is available.

No information is available.

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	245368	245760	3.92625	a2b4f664355a47ef637ab1b69cef2c5e
.data	249856	608	1024	0.488703	6fda88cf7188a8245a53dfde927250fd
.rdata	253952	9384	9728	3.47165	dbe852009dbd077a9976cb0ecfb9aadf
.bss	266240	18576	0	0	d41d8cd98f00b204e9800998ecf8427e
.idata	286720	2212	2560	2.97703	5e5242c565219f3bd33a6568632559dc
.rsrc	290816	26552	26624	4.19485	c0c773c5888b4ec9876382b73a992610

Dropped from:

b48cd90c7e7bc6cf8c5e8d2e38e285d6

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

qvxwx.exe_3956:

.text

.text

`.data

`.data

.rdata

.rdata

@.bss

@.bss

.idata

.idata

C:\ProgramData\qvxwx.exe

C:\ProgramData\qvxwx.exe

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Run

Windows

Windows

Operating System

Operating System

%H:%M:%S

%H:%M:%S

%m/%d/%y

%m/%d/%y

-0123456789

-0123456789

%s:%u: failed assertion `%s'

%s:%u: failed assertion `%s'

RegCloseKey

RegCloseKey

RegOpenKeyA

RegOpenKeyA

ADVAPI32.DLL

ADVAPI32.DLL

KERNEL32.dll

KERNEL32.dll

msvcrt.dll

msvcrt.dll

SHELL32.DLL

SHELL32.DLL

SearchProtocolHost.exe_3632:

.text

.text

`.data

`.data

.rsrc

.rsrc

@.reloc

@.reloc

ADVAPI32.dll

ADVAPI32.dll

ntdll.DLL

ntdll.DLL

KERNEL32.dll

KERNEL32.dll

msvcrt.dll

msvcrt.dll

USER32.dll

USER32.dll

ole32.dll

ole32.dll

OLEAUT32.dll

OLEAUT32.dll

TQUERY.DLL

TQUERY.DLL

MSSHooks.dll

MSSHooks.dll

IMM32.dll

IMM32.dll

SHLWAPI.dll

SHLWAPI.dll

SrchCollatorCatalogInfo

SrchCollatorCatalogInfo

SrchDSSLogin

SrchDSSLogin

SrchDSSPortManager

SrchDSSPortManager

SrchPHHttp

SrchPHHttp

SrchIndexerQuery

SrchIndexerQuery

SrchIndexerProperties

SrchIndexerProperties

SrchIndexerPlugin

SrchIndexerPlugin

SrchIndexerClient

SrchIndexerClient

SrchIndexerSchema

SrchIndexerSchema

Msidle.dll

Msidle.dll

Failed to get REGKEY_FLTRDMN_MS_TO_IDLE, using default

Failed to get REGKEY_FLTRDMN_MS_TO_IDLE, using default

pfps->psProperty.ulKind is LPWSTR but psProperty.lpwstr is NULL or empty

pfps->psProperty.ulKind is LPWSTR but psProperty.lpwstr is NULL or empty

d:\win7sp1_gdr\enduser\mssearch2\common\utils\crchash.cxx

d:\win7sp1_gdr\enduser\mssearch2\common\utils\crchash.cxx

d:\win7sp1_gdr\enduser\mssearch2\search\search\gather\fltrdmn\fltrdaemon.cxx

d:\win7sp1_gdr\enduser\mssearch2\search\search\gather\fltrdmn\fltrdaemon.cxx

d:\win7sp1_gdr\enduser\mssearch2\search\common\include\secutil.hxx

d:\win7sp1_gdr\enduser\mssearch2\search\common\include\secutil.hxx

d:\win7sp1_gdr\enduser\mssearch2\common\tracer\tracerhelpers.h

d:\win7sp1_gdr\enduser\mssearch2\common\tracer\tracerhelpers.h

d:\win7sp1_gdr\enduser\mssearch2\common\tracer\mutex.cpp

d:\win7sp1_gdr\enduser\mssearch2\common\tracer\mutex.cpp

d:\win7sp1_gdr\enduser\mssearch2\common\include\srchxcpt.hxx

d:\win7sp1_gdr\enduser\mssearch2\common\include\srchxcpt.hxx

RegDeleteKeyW

RegDeleteKeyW

RegDeleteKeyExW

RegDeleteKeyExW

8%uiP

8%uiP

Invalid parameter passed to C runtime function.

Invalid parameter passed to C runtime function.

d:\win7sp1_gdr\enduser\mssearch2\common\tracer\tracersecutil.h

d:\win7sp1_gdr\enduser\mssearch2\common\tracer\tracersecutil.h

d:\win7sp1_gdr\enduser\mssearch2\common\tracer\tracmain.cpp

d:\win7sp1_gdr\enduser\mssearch2\common\tracer\tracmain.cpp

-d-d-d-d-d-d-d-%d

-d-d-d-d-d-d-d-%d

d:\win7sp1_gdr\enduser\mssearch2\common\tracer\tracmain.h

d:\win7sp1_gdr\enduser\mssearch2\common\tracer\tracmain.h

0xx=

0xx=

%s(%d)

%s(%d)

tid="0x%x"

tid="0x%x"

pid="0x%x"

pid="0x%x"

tagname="%s"

tagname="%s"

tagid="0x%x"

tagid="0x%x"

el="0x%x"

el="0x%x"

time="d/d/d d:d:d.d"

time="d/d/d d:d:d.d"

logname="%s"

logname="%s"

d:\win7sp1_gdr\enduser\mssearch2\common\tracer\sysimprs.cxx

d:\win7sp1_gdr\enduser\mssearch2\common\tracer\sysimprs.cxx

SHELL32.dll

SHELL32.dll

PROPSYS.dll

PROPSYS.dll

ntdll.dll

ntdll.dll

RegCloseKey

RegCloseKey

RegCreateKeyExW

RegCreateKeyExW

RegOpenKeyExW

RegOpenKeyExW

RegQueryInfoKeyW

RegQueryInfoKeyW

RegEnumKeyExW

RegEnumKeyExW

ReportEventW

ReportEventW

_amsg_exit

_amsg_exit

MsgWaitForMultipleObjects

MsgWaitForMultipleObjects

SearchProtocolHost.pdb

SearchProtocolHost.pdb

2 2(20282|2

2 2(20282|2

4%5S5

4%5S5

Software\Microsoft\Windows Search

Software\Microsoft\Windows Search

https

https

kernel32.dll

kernel32.dll

msTracer.dll

msTracer.dll

msfte.dll

msfte.dll