Analysis
-
max time kernel
99s -
max time network
102s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
19-03-2024 11:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
MiraLauncher_12.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
MiraLauncher_12.exe
-
Size
18.3MB
-
MD5
15c131a1736cae2b01ed17a4f36621a2
-
SHA1
3accb120ac36c171ff939d84beabecc56682630a
-
SHA256
ad1b7a836beb0596caa66b1945513a61f5f52b57da1495f7c5e3a16c706024c5
-
SHA512
081f03624f4a4e43a06af05b93cb26babf6fe16174da49a3ded3a3e0de0bb89a4dac99359f2d157e68bead04521b3000364a86d293fea6d48ea9f3f3fccb465a
-
SSDEEP
393216:CWEMuFCUYURj60BWM/T/OzcAa7OOAvpBg04HtDKrJr3N6PSGgDTjn23+znyV3Aej:Cn/OzcAa7OrS0du3NFdXaOWGl0i
Score
1/10
Malware Config
Signatures
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 25 IoCs
pid Process 3088 MiraLauncher_12.exe 4424 MiraLauncher_12.exe 4880 taskmgr.exe 4880 taskmgr.exe 4880 taskmgr.exe 4880 taskmgr.exe 4880 taskmgr.exe 4880 taskmgr.exe 4880 taskmgr.exe 1948 MiraLauncher_12.exe 4880 taskmgr.exe 4880 taskmgr.exe 4880 taskmgr.exe 4880 taskmgr.exe 4880 taskmgr.exe 4880 taskmgr.exe 4880 taskmgr.exe 4880 taskmgr.exe 4880 taskmgr.exe 2012 MiraLauncher_12.exe 4880 taskmgr.exe 4880 taskmgr.exe 4412 MiraLauncher_12.exe 3532 MiraLauncher_12.exe 1532 MiraLauncher_12.exe -
Suspicious use of AdjustPrivilegeToken 16 IoCs
description pid Process Token: SeDebugPrivilege 3088 MiraLauncher_12.exe Token: SeDebugPrivilege 4424 MiraLauncher_12.exe Token: SeDebugPrivilege 4880 taskmgr.exe Token: SeSystemProfilePrivilege 4880 taskmgr.exe Token: SeCreateGlobalPrivilege 4880 taskmgr.exe Token: SeDebugPrivilege 1948 MiraLauncher_12.exe Token: SeDebugPrivilege 2012 MiraLauncher_12.exe Token: 33 4880 taskmgr.exe Token: SeIncBasePriorityPrivilege 4880 taskmgr.exe Token: SeDebugPrivilege 4412 MiraLauncher_12.exe Token: SeDebugPrivilege 3532 MiraLauncher_12.exe Token: SeRestorePrivilege 3652 7zG.exe Token: 35 3652 7zG.exe Token: SeSecurityPrivilege 3652 7zG.exe Token: SeSecurityPrivilege 3652 7zG.exe Token: SeDebugPrivilege 1532 MiraLauncher_12.exe -
Suspicious use of FindShellTrayWindow 45 IoCs
pid Process 4880 taskmgr.exe 4880 taskmgr.exe 4880 taskmgr.exe 4880 taskmgr.exe 4880 taskmgr.exe 4880 taskmgr.exe 4880 taskmgr.exe 4880 taskmgr.exe 4880 taskmgr.exe 4880 taskmgr.exe 4880 taskmgr.exe 4880 taskmgr.exe 4880 taskmgr.exe 4880 taskmgr.exe 4880 taskmgr.exe 4880 taskmgr.exe 4880 taskmgr.exe 4880 taskmgr.exe 4880 taskmgr.exe 4880 taskmgr.exe 4880 taskmgr.exe 4880 taskmgr.exe 4880 taskmgr.exe 4880 taskmgr.exe 4880 taskmgr.exe 4880 taskmgr.exe 4880 taskmgr.exe 4880 taskmgr.exe 4880 taskmgr.exe 4880 taskmgr.exe 4880 taskmgr.exe 4880 taskmgr.exe 4880 taskmgr.exe 4880 taskmgr.exe 4880 taskmgr.exe 4880 taskmgr.exe 4880 taskmgr.exe 4880 taskmgr.exe 4880 taskmgr.exe 4880 taskmgr.exe 4880 taskmgr.exe 4880 taskmgr.exe 4880 taskmgr.exe 4880 taskmgr.exe 3652 7zG.exe -
Suspicious use of SendNotifyMessage 44 IoCs
pid Process 4880 taskmgr.exe 4880 taskmgr.exe 4880 taskmgr.exe 4880 taskmgr.exe 4880 taskmgr.exe 4880 taskmgr.exe 4880 taskmgr.exe 4880 taskmgr.exe 4880 taskmgr.exe 4880 taskmgr.exe 4880 taskmgr.exe 4880 taskmgr.exe 4880 taskmgr.exe 4880 taskmgr.exe 4880 taskmgr.exe 4880 taskmgr.exe 4880 taskmgr.exe 4880 taskmgr.exe 4880 taskmgr.exe 4880 taskmgr.exe 4880 taskmgr.exe 4880 taskmgr.exe 4880 taskmgr.exe 4880 taskmgr.exe 4880 taskmgr.exe 4880 taskmgr.exe 4880 taskmgr.exe 4880 taskmgr.exe 4880 taskmgr.exe 4880 taskmgr.exe 4880 taskmgr.exe 4880 taskmgr.exe 4880 taskmgr.exe 4880 taskmgr.exe 4880 taskmgr.exe 4880 taskmgr.exe 4880 taskmgr.exe 4880 taskmgr.exe 4880 taskmgr.exe 4880 taskmgr.exe 4880 taskmgr.exe 4880 taskmgr.exe 4880 taskmgr.exe 4880 taskmgr.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 4424 MiraLauncher_12.exe 1948 MiraLauncher_12.exe 2012 MiraLauncher_12.exe 4412 MiraLauncher_12.exe 3532 MiraLauncher_12.exe 1532 MiraLauncher_12.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\MiraLauncher_12.exe"C:\Users\Admin\AppData\Local\Temp\MiraLauncher_12.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3088
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:912
-
C:\Users\Admin\AppData\Local\Temp\MiraLauncher_12.exe"C:\Users\Admin\AppData\Local\Temp\MiraLauncher_12.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4424
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4880
-
C:\Users\Admin\AppData\Local\Temp\MiraLauncher_12.exe"C:\Users\Admin\AppData\Local\Temp\MiraLauncher_12.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1948
-
C:\Users\Admin\Desktop\MiraLauncher_12.exe"C:\Users\Admin\Desktop\MiraLauncher_12.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2012
-
C:\Users\Admin\Downloads\MiraLauncher_12.exe"C:\Users\Admin\Downloads\MiraLauncher_12.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4412
-
C:\Users\Admin\Downloads\MiraLauncher_12.exe"C:\Users\Admin\Downloads\MiraLauncher_12.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3532
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\MiraLauncher_12\" -spe -an -ai#7zMap30472:92:7zEvent257081⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3652
-
C:\Users\Admin\Downloads\MiraLauncher_12.exe"C:\Users\Admin\Downloads\MiraLauncher_12.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1532