Gen.Heur.Minggy.1_33f6c8415a

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

giafjs.exe:228
%original file name%.exe:860

The Trojan injects its code into the following process(es):No processes have been created.

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process giafjs.exe:228 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

C:\AUTOEXEC.BAT .exe (1455811 bytes)
C:\MSDOS.SYS .exe (1455811 bytes)
C:\IO.SYS .exe (1455811 bytes)
C:\boot.ini .exe (1455811 bytes)
%Documents and Settings% .exe (1455811 bytes)
C:\RECYCLER .exe (1455811 bytes)
C:\ntldr .exe (1455811 bytes)
C:\original .exe (1455811 bytes)
C:\%original file name%.exe .exe (1455811 bytes)
C:\totalcmd .exe (1455811 bytes)
C:\NTDETECT.COM .exe (1455811 bytes)
C:\System Volume Information .exe (1455811 bytes)
C:\CONFIG.SYS .exe (1455811 bytes)
C:\marker .exe (1455811 bytes)
%Program Files% .exe (1455811 bytes)
%WinDir% .exe (1455811 bytes)
C:\pagefile.sys .exe (1455811 bytes)

The Trojan deletes the following file(s):

C:\Mirat (0 bytes)
C:\Mirau (0 bytes)
C:\Mirav (0 bytes)
C:\Mirap (0 bytes)
C:\Mirar (0 bytes)
C:\Mirai (0 bytes)
C:\Miraj (0 bytes)
C:\Mirak (0 bytes)
C:\Mirad (0 bytes)
C:\Miraf (0 bytes)
C:\Mirag (0 bytes)
C:\Mirac (0 bytes)

The process %original file name%.exe:860 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\All Users\Application Data\giafjs.exe (914498 bytes)
%Documents and Settings%\All Users\Application Data\Saaaalamm\Mira.h (542871 bytes)

Registry activity

The process giafjs.exe:228 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Microsoft® Windows® Operating System" = "%Documents and Settings%\All Users\Application Data\giafjs.exe"

The process %original file name%.exe:860 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "8C 68 91 FE E0 98 25 C9 25 EB B0 8D 4F 86 19 E2"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

Dropped PE files

MD5	File path
2dc21bf681018326cea18bd5c5111fbc	c:\%original file name%.exe .exe
fa9e85e41e99e0aa8f039e02f0459067	c:\AUTOEXEC.BAT .exe
7f4df66445d6754cfab659295d8f7a0b	c:\CONFIG.SYS .exe
99365e29a6cac539e3e1c81e76d00ee5	c:\Documents and Settings .exe
a17c5d4d029b25865e8d97986fd5aaa3	c:\Documents and Settings\All Users\Application Data\Saaaalamm\Mira.h
8b51ccd21601f94e06fdacb9bd3779d5	c:\Documents and Settings\All Users\Application Data\giafjs.exe
a6452e785db176eb2a134be2dc3d3538	c:\IO.SYS .exe
314f346ff8f46daa49b1bbd0bf2e7282	c:\MSDOS.SYS .exe
81ca5fe93b9a93bb36ce69a888e88ac7	c:\NTDETECT.COM .exe
604a7dc245db616c293e2229714c99fc	c:\Perl .exe
5a7baf8d5a7ceccb2f884b8d6e3e7691	c:\Program Files .exe
78fef07656f245b30f717647046f709c	c:\RECYCLER .exe
24a44eec9518bb9b09f5047107bc202f	c:\System Volume Information .exe
a907b688e4e30963df8b80cd62c10d40	c:\WINDOWS .exe
612e75545b19f8575842006c225e5e4d	c:\boot.ini .exe
d78d33cf7dfca224019ebabef57edbf0	c:\marker .exe
bc8016124e6cd04d5e3e71e46ead0bfa	c:\ntldr .exe
8f0a92b6a3becaa26376a22b0afb7a71	c:\original .exe
6ecce11e4065818c5c725546ab2579c6	c:\pagefile.sys .exe
c9cd75efb4919ce7dadf9207c2c0e542	c:\totalcmd .exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):

   giafjs.exe:228
   %original file name%.exe:860

2. Delete the original Trojan file.
   
3. Delete or disinfect the following files created/modified by the Trojan:

   C:\AUTOEXEC.BAT .exe (1455811 bytes)
   C:\MSDOS.SYS .exe (1455811 bytes)
   C:\IO.SYS .exe (1455811 bytes)
   C:\boot.ini .exe (1455811 bytes)
   %Documents and Settings% .exe (1455811 bytes)
   C:\RECYCLER .exe (1455811 bytes)
   C:\ntldr .exe (1455811 bytes)
   C:\original .exe (1455811 bytes)
   C:\%original file name%.exe .exe (1455811 bytes)
   C:\totalcmd .exe (1455811 bytes)
   C:\NTDETECT.COM .exe (1455811 bytes)
   C:\System Volume Information .exe (1455811 bytes)
   C:\CONFIG.SYS .exe (1455811 bytes)
   C:\marker .exe (1455811 bytes)
   %Program Files% .exe (1455811 bytes)
   %WinDir% .exe (1455811 bytes)
   C:\pagefile.sys .exe (1455811 bytes)
   %Documents and Settings%\All Users\Application Data\giafjs.exe (914498 bytes)
   %Documents and Settings%\All Users\Application Data\Saaaalamm\Mira.h (542871 bytes)

4. Delete the following value(s) in the autorun key (How to Work with System Registry):

   [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
   "Microsoft® Windows® Operating System" = "%Documents and Settings%\All Users\Application Data\giafjs.exe"

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

No information is available.

No information is available.

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	245368	245760	3.92625	a2b4f664355a47ef637ab1b69cef2c5e
.data	249856	608	1024	0.488703	6fda88cf7188a8245a53dfde927250fd
.rdata	253952	9384	9728	3.47165	dbe852009dbd077a9976cb0ecfb9aadf
.bss	266240	18576	0	0	d41d8cd98f00b204e9800998ecf8427e
.idata	286720	2212	2560	2.97703	5e5242c565219f3bd33a6568632559dc
.rsrc	290816	26552	26624	4.20086	b82451078c3cf219566d6c1c302f408b

Dropped from:

d4402ffd64ea27222cb9fe025c25febf

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

giafjs.exe_228:

.text

.text

`.data

`.data

.rdata

.rdata

@.bss

@.bss

.idata

.idata

%Documents and Settings%\All Users\Application Data\giafjs.exe

%Documents and Settings%\All Users\Application Data\giafjs.exe

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Run

Windows

Windows

Operating System

Operating System

%H:%M:%S

%H:%M:%S

%m/%d/%y

%m/%d/%y

-0123456789

-0123456789

%s:%u: failed assertion `%s'

%s:%u: failed assertion `%s'

RegCloseKey

RegCloseKey

RegOpenKeyA

RegOpenKeyA

ADVAPI32.DLL

ADVAPI32.DLL

KERNEL32.dll

KERNEL32.dll

msvcrt.dll

msvcrt.dll

SHELL32.DLL

SHELL32.DLL