Gen.Heur.Minggy.1_d0cbe99814

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

%original file name%.exe:2180
fkyowu.exe:3408

The Trojan injects its code into the following process(es):No processes have been created.

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process %original file name%.exe:2180 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

C:\ProgramData\Saaaalamm\Mira.h (542872 bytes)
C:\ProgramData\fkyowu.exe (646029 bytes)

The process fkyowu.exe:3408 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

C:\original .exe (1188695 bytes)
C:\config.sys .exe (1188695 bytes)
C:\%original file name%.exe .exe (1188695 bytes)
C:\bootmgr .exe (1188695 bytes)
C:\Boot .exe (1188695 bytes)
C:\Windows .exe (1188695 bytes)
C:\ProgramData .exe (1188695 bytes)
C:\$Recycle.Bin .exe (1188695 bytes)
C:\BOOTSECT.BAK .exe (1188695 bytes)
%Documents and Settings% .exe (1188695 bytes)
C:\totalcmd .exe (1188695 bytes)
C:\Users .exe (1188695 bytes)
C:\XELDZ .exe (1188695 bytes)
C:\autoexec.bat .exe (1188695 bytes)
C:\System Volume Information .exe (1188695 bytes)
C:\marker .exe (1188695 bytes)
%Program Files% .exe (1188695 bytes)
C:\pagefile.sys .exe (1188695 bytes)

The Trojan deletes the following file(s):

C:\Mirat (0 bytes)
C:\Mirau (0 bytes)
C:\Mirav (0 bytes)
C:\Miraq (0 bytes)
C:\Mirar (0 bytes)
C:\Miras (0 bytes)
C:\Miran (0 bytes)
C:\Mirao (0 bytes)
C:\Mirai (0 bytes)
C:\Mirak (0 bytes)
C:\Mirad (0 bytes)
C:\Miraf (0 bytes)
C:\Miraa (0 bytes)
C:\Mirab (0 bytes)

Registry activity

The process fkyowu.exe:3408 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Microsoft® Windows® Operating System" = "C:\ProgramData\fkyowu.exe"

Dropped PE files

MD5	File path
6486e36d6d84a7ea3a50f254c514b0a7	c:\$Recycle.Bin .exe
0d51e70e291eb67079af3a5ea8efcb4d	c:\BOOTSECT.BAK .exe
5dec469a55bd6f73512af40694625a7f	c:\Boot .exe
f99702097345696a367ffb950e452c61	c:\Documents and Settings .exe
519cdf43953959a1310ac81d66c2382e	c:\Perl .exe
154c01465efb17c5e2871f4dd8df1884	c:\Program Files .exe
bcf835ce4c16c549045cd6ad0d57833e	c:\ProgramData .exe
a17c5d4d029b25865e8d97986fd5aaa3	c:\ProgramData\Saaaalamm\Mira.h
8d1400d87240da16f54b6ef2a264ea50	c:\ProgramData\fkyowu.exe
803ea23e20f9a373151f16b61f452e35	c:\System Volume Information .exe
b3e565749496ad9b8ab0b0d78807651b	c:\Users .exe
a17c5d4d029b25865e8d97986fd5aaa3	c:\Users\All Users\Saaaalamm\Mira.h
8d1400d87240da16f54b6ef2a264ea50	c:\Users\All Users\fkyowu.exe
c6182cb817111ee01cfa1b53321e4e3b	c:\Windows .exe
0478d4c1b6bf1d139c935f0556442476	c:\XELDZ .exe
0747feebb38f254ff1975ad9e606ea6a	c:\autoexec.bat .exe
45d17b098697da4fcff74e19353e95ea	c:\bootmgr .exe
974423dcc4543f9181013bec733e1947	c:\config.sys .exe
45b6d3afbdbb5b59278094432b811afb	c:\%original file name%.exe .exe
da2af00b8e5d872ef5f5bf572ec672e7	c:\marker .exe
c9db04a1b7228d1658dbf060c38adc37	c:\original .exe
3696a4be87ed3303e33ca2520a034294	c:\pagefile.sys .exe
590f5d083bac11e28005622f20631fad	c:\totalcmd .exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):

   %original file name%.exe:2180
   fkyowu.exe:3408

2. Delete the original Trojan file.
   
3. Delete or disinfect the following files created/modified by the Trojan:

   C:\ProgramData\Saaaalamm\Mira.h (542872 bytes)
   C:\ProgramData\fkyowu.exe (646029 bytes)
   C:\original .exe (1188695 bytes)
   C:\config.sys .exe (1188695 bytes)
   C:\%original file name%.exe .exe (1188695 bytes)
   C:\bootmgr .exe (1188695 bytes)
   C:\Boot .exe (1188695 bytes)
   C:\Windows .exe (1188695 bytes)
   C:\ProgramData .exe (1188695 bytes)
   C:\$Recycle.Bin .exe (1188695 bytes)
   C:\BOOTSECT.BAK .exe (1188695 bytes)
   %Documents and Settings% .exe (1188695 bytes)
   C:\totalcmd .exe (1188695 bytes)
   C:\Users .exe (1188695 bytes)
   C:\XELDZ .exe (1188695 bytes)
   C:\autoexec.bat .exe (1188695 bytes)
   C:\System Volume Information .exe (1188695 bytes)
   C:\marker .exe (1188695 bytes)
   %Program Files% .exe (1188695 bytes)
   C:\pagefile.sys .exe (1188695 bytes)

4. Delete the following value(s) in the autorun key (How to Work with System Registry):

   [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
   "Microsoft® Windows® Operating System" = "C:\ProgramData\fkyowu.exe"

5. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

No information is available.

No information is available.

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	245368	245760	3.92625	a2b4f664355a47ef637ab1b69cef2c5e
.data	249856	608	1024	0.488703	6fda88cf7188a8245a53dfde927250fd
.rdata	253952	9384	9728	3.47165	dbe852009dbd077a9976cb0ecfb9aadf
.bss	266240	18576	0	0	d41d8cd98f00b204e9800998ecf8427e
.idata	286720	2212	2560	2.97703	5e5242c565219f3bd33a6568632559dc
.rsrc	290816	26552	26624	4.22416	36ba7aa05ed08662818944523dacee9e

Dropped from:

05adf9f97dae3c9aa77fc40be1cea74a

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

fkyowu.exe_3408:

.text

.text

`.data

`.data

.rdata

.rdata

@.bss

@.bss

.idata

.idata

C:\ProgramData\fkyowu.exe

C:\ProgramData\fkyowu.exe

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Run

Windows

Windows

Operating System

Operating System

%H:%M:%S

%H:%M:%S

%m/%d/%y

%m/%d/%y

-0123456789

-0123456789

%s:%u: failed assertion `%s'

%s:%u: failed assertion `%s'

RegCloseKey

RegCloseKey

RegOpenKeyA

RegOpenKeyA

ADVAPI32.DLL

ADVAPI32.DLL

KERNEL32.dll

KERNEL32.dll

msvcrt.dll

msvcrt.dll

SHELL32.DLL

SHELL32.DLL

SearchProtocolHost.exe_3508:

.text

.text

`.data

`.data

.rsrc

.rsrc

@.reloc

@.reloc

ADVAPI32.dll

ADVAPI32.dll

ntdll.DLL

ntdll.DLL

KERNEL32.dll

KERNEL32.dll

msvcrt.dll

msvcrt.dll

USER32.dll

USER32.dll

ole32.dll

ole32.dll

OLEAUT32.dll

OLEAUT32.dll

TQUERY.DLL

TQUERY.DLL

MSSHooks.dll

MSSHooks.dll

IMM32.dll

IMM32.dll

SHLWAPI.dll

SHLWAPI.dll

SrchCollatorCatalogInfo

SrchCollatorCatalogInfo

SrchDSSLogin

SrchDSSLogin

SrchDSSPortManager

SrchDSSPortManager

SrchPHHttp

SrchPHHttp

SrchIndexerQuery

SrchIndexerQuery

SrchIndexerProperties

SrchIndexerProperties

SrchIndexerPlugin

SrchIndexerPlugin

SrchIndexerClient

SrchIndexerClient

SrchIndexerSchema

SrchIndexerSchema

Msidle.dll

Msidle.dll

Failed to get REGKEY_FLTRDMN_MS_TO_IDLE, using default

Failed to get REGKEY_FLTRDMN_MS_TO_IDLE, using default

pfps->psProperty.ulKind is LPWSTR but psProperty.lpwstr is NULL or empty

pfps->psProperty.ulKind is LPWSTR but psProperty.lpwstr is NULL or empty

d:\win7sp1_gdr\enduser\mssearch2\common\utils\crchash.cxx

d:\win7sp1_gdr\enduser\mssearch2\common\utils\crchash.cxx

d:\win7sp1_gdr\enduser\mssearch2\search\search\gather\fltrdmn\fltrdaemon.cxx

d:\win7sp1_gdr\enduser\mssearch2\search\search\gather\fltrdmn\fltrdaemon.cxx

d:\win7sp1_gdr\enduser\mssearch2\search\common\include\secutil.hxx

d:\win7sp1_gdr\enduser\mssearch2\search\common\include\secutil.hxx

d:\win7sp1_gdr\enduser\mssearch2\common\tracer\tracerhelpers.h

d:\win7sp1_gdr\enduser\mssearch2\common\tracer\tracerhelpers.h

d:\win7sp1_gdr\enduser\mssearch2\common\tracer\mutex.cpp

d:\win7sp1_gdr\enduser\mssearch2\common\tracer\mutex.cpp

d:\win7sp1_gdr\enduser\mssearch2\common\include\srchxcpt.hxx

d:\win7sp1_gdr\enduser\mssearch2\common\include\srchxcpt.hxx

RegDeleteKeyW

RegDeleteKeyW

RegDeleteKeyExW

RegDeleteKeyExW

8%uiP

8%uiP

Invalid parameter passed to C runtime function.

Invalid parameter passed to C runtime function.

d:\win7sp1_gdr\enduser\mssearch2\common\tracer\tracersecutil.h

d:\win7sp1_gdr\enduser\mssearch2\common\tracer\tracersecutil.h

d:\win7sp1_gdr\enduser\mssearch2\common\tracer\tracmain.cpp

d:\win7sp1_gdr\enduser\mssearch2\common\tracer\tracmain.cpp

-d-d-d-d-d-d-d-%d

-d-d-d-d-d-d-d-%d

d:\win7sp1_gdr\enduser\mssearch2\common\tracer\tracmain.h

d:\win7sp1_gdr\enduser\mssearch2\common\tracer\tracmain.h

0xx=

0xx=

%s(%d)

%s(%d)

tid="0x%x"

tid="0x%x"

pid="0x%x"

pid="0x%x"

tagname="%s"

tagname="%s"

tagid="0x%x"

tagid="0x%x"

el="0x%x"

el="0x%x"

time="d/d/d d:d:d.d"

time="d/d/d d:d:d.d"

logname="%s"

logname="%s"

d:\win7sp1_gdr\enduser\mssearch2\common\tracer\sysimprs.cxx

d:\win7sp1_gdr\enduser\mssearch2\common\tracer\sysimprs.cxx

SHELL32.dll

SHELL32.dll

PROPSYS.dll

PROPSYS.dll

ntdll.dll

ntdll.dll

RegCloseKey

RegCloseKey

RegCreateKeyExW

RegCreateKeyExW

RegOpenKeyExW

RegOpenKeyExW

RegQueryInfoKeyW

RegQueryInfoKeyW

RegEnumKeyExW

RegEnumKeyExW

ReportEventW

ReportEventW

_amsg_exit

_amsg_exit

MsgWaitForMultipleObjects

MsgWaitForMultipleObjects

SearchProtocolHost.pdb

SearchProtocolHost.pdb

2 2(20282|2

2 2(20282|2

4%5S5

4%5S5

Software\Microsoft\Windows Search

Software\Microsoft\Windows Search

https

https

kernel32.dll

kernel32.dll

msTracer.dll

msTracer.dll

msfte.dll

msfte.dll