MALICIOUS — Documents and Settings .exe

MALICIOUS — Documents and Settings .exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Mira family. 4 of 52 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 339568c927a8d9bf8d735113c3c0586706c18cafc8db91cee574239c73ab03b6
SHA-1: 19d6093f953d8d1cc5c1888e09544b6c648423a2
MD5: 4c3092422b836bcc7631ee2319bf4a21
imphash: 3a2003ea545fe942681da9e7683ebb58
ssdeep: 12288:CxIK9V14ImyHYF6f50i4lkz3cIIOOOkjZfJ74zOvM1lj/8rT3K17vqKh0hB:CJEyYF6R0i4mbcIIOOOk9fJ79M1lj8rF
TLSH: T1F449AD8186AD86A5DB6798CCBE074CFC68AD7BAD490C2C91DEA71C4C032418337DE975
Submitted as: Documents and Settings .exe
File type: pe · Size: 420288 bytes
Verdict: malicious (98/100) · Family: Mira

Detections (4 of 52 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.lol 1
ClamAV (daily): Win.Packed.Mira-7330891-0
Microsoft Defender: Trojan:Win32/Krap!pz
Kaspersky (KVRT): HEUR:Trojan.Win32.Generic

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 6 weighted signals:

ClamAV (daily) flagged Win.Packed.Mira-7330891-0 (rule Win.Packed.Mira-7330891-0) - engine signal, weight 0.90, confidence 0.95
1 behavioral detection(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Dropped a suspicious payload (Persistence): scoobe-fix.cmd - dynamic signal, weight 0.40, confidence 0.90
Contacted 25 external host(s) at runtime (21 HTTP) - network signal, weight 0.40, confidence 0.80
Packing/obfuscation: high-entropy-sections:.lol 1 - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

5959 behavior events · 1 ATT&CK techniques · 34 dropped files.

Dropped files

C:\$Recycle.Bin .exe - 19ca4b2c73af146c1c7ef06d241586a9efaa671fcbd21a0ad874320f6efd0e2b
C:\uac.ps1 .exe - 40ee4d56ceff0c739c2234db07fc12c93d7d4283b335dd933152bb431f59afd8
C:\ThreatLens .exe - 5892bea969c473e5b5070d10dfbd64afb50df687097af4db9f810566905b5c04
C:\ProgramData\ngsta.exe - 4086b5849a4a2962d18553613aa8a7c92d232275a168bb636906f70597b72436
b46705ec2cebad74b2a56c2a5539856fa2f37c1d2e2e14598641232fc7c793ff - b46705ec2cebad74b2a56c2a5539856fa2f37c1d2e2e14598641232fc7c793ff
C:\swapfile.sys .exe - c477e851b126ed52aabdde94db21fa94fb1c23dba3acdf827fb2776d397ca459
C:\uac-done.txt - ad38b76382f56940b22fc920702dbd4bff308a93bf3ad3b0b705686aa4245e9a
C:\Documents and Settings .exe - 6a36a94330c28d7d5ac7c03a7185df716d3563c65e18c86d424af2b024c966d7
C:\Users .exe - ef9c19e4c3fd24c11313ab5d24c8e332c447c80f112e61a995b0f221ee575949
C:\uac.ps1 - a42e57db93b93ecb2224fdb1276f4ebb0b6705cc4a95ec1899772df8dc47a684
C:\ProgramData .exe - 338bc45530d5d622a94f4fa15d94033898f4e5e910331b871f7c95a2933545ae
C:\$WinREAgent .exe - 9ccf78fc7d68678b1f6c444c0641b2a4b8394a3412647e90e664f2179ae9bf98
C:\PerfLogs .exe - f4073cfe266abaccb538514ab177e681b0289ac89a3918e49c9eca551a21206c
C:\p.ps1 .exe - 80a7221eecadb61bb78c1e10d835cd5576b880721036c7a294b932ec5142d8d2
C:\792.ini .exe - acf9ed5f2f28dc13a772e4179f5170614413032d8fb785af42ad09013986f60d

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787700991&P2=404&P3=2&P4=Twtx4wJBiSp5AXjIu3cFVbV6xxyZgAcCVJTeUbdHocC21V6j%2bJ%2f0fI5px9DERXuWJcQL6H%2bGAXXr4mOsxz%2bRJA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787701067&P2=404&P3=2&P4=Y7Wc4w5qd8SNel%2bT7vywqvrv%2fAEuTavLm%2bkjGmey6inaE3Lz%2bBBXb7mAH8S8u4%2bz5exl%2fYrreZp%2fRD4m%2bTzPqw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

135.233.95.80
203.26.79.13
20.184.175.20
4.230.171.124
4.247.188.224
52.230.59.222
74.179.77.204
135.233.95.135
4.150.223.97
4.150.223.106
20.112.250.133
52.123.128.14
40.99.133.242
172.178.240.163
162.159.142.9
52.123.252.203
52.148.114.188
20.42.72.131
51.104.15.253
52.123.252.204
92.223.78.30
74.178.232.29
72.153.5.134
52.110.12.4
52.110.12.30

More Mira samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report