Overview
overview
7Static
static
1mirage 1.16 v.0.2.zip
windows7-x64
1mirage 1.16 v.0.2.zip
windows10-2004-x64
1Mirage 1.1...ies.gz
windows7-x64
3Mirage 1.1...ies.gz
windows10-2004-x64
3Mirage 1.1...ids.gz
windows7-x64
3Mirage 1.1...ids.gz
windows10-2004-x64
3Mirage 1.1...her.gz
windows7-x64
3Mirage 1.1...her.gz
windows10-2004-x64
3Mirage 1.1...ks.dat
windows7-x64
3Mirage 1.1...ks.dat
windows10-2004-x64
3Mirage 1.1...ies.gz
windows7-x64
3Mirage 1.1...ies.gz
windows10-2004-x64
7Mirage 1.1...end.gz
windows7-x64
3Mirage 1.1...end.gz
windows10-2004-x64
3Mirage 1.1...end.gz
windows7-x64
3Mirage 1.1...end.gz
windows10-2004-x64
3Mirage 1.1...ks.dat
windows7-x64
3Mirage 1.1...ks.dat
windows10-2004-x64
3Mirage 1.1...0.json
windows7-x64
3Mirage 1.1...0.json
windows10-2004-x64
3Mirage 1.1...0.json
windows7-x64
3Mirage 1.1...0.json
windows10-2004-x64
3Mirage 1.1...ies.gz
windows7-x64
3Mirage 1.1...ies.gz
windows10-2004-x64
3Mirage 1.1...ids.gz
windows7-x64
3Mirage 1.1...ids.gz
windows10-2004-x64
7Mirage 1.1...ges.gz
windows7-x64
3Mirage 1.1...ges.gz
windows10-2004-x64
3Mirage 1.1...ks.dat
windows7-x64
3Mirage 1.1...ks.dat
windows10-2004-x64
3Mirage 1.1...on.png
windows7-x64
1Mirage 1.1...on.png
windows10-2004-x64
3Analysis
-
max time kernel
118s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
25/05/2024, 17:12
Static task
static1
Behavioral task
behavioral1
Sample
mirage 1.16 v.0.2.zip
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
mirage 1.16 v.0.2.zip
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
Mirage 1.16 v0.2/DIM-1/data/capabilities.gz
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
Mirage 1.16 v0.2/DIM-1/data/capabilities.gz
Resource
win10v2004-20240426-en
Behavioral task
behavioral5
Sample
Mirage 1.16 v0.2/DIM-1/data/raids.gz
Resource
win7-20240508-en
Behavioral task
behavioral6
Sample
Mirage 1.16 v0.2/DIM-1/data/raids.gz
Resource
win10v2004-20240426-en
Behavioral task
behavioral7
Sample
Mirage 1.16 v0.2/DIM-1/data/villages_nether.gz
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
Mirage 1.16 v0.2/DIM-1/data/villages_nether.gz
Resource
win10v2004-20240426-en
Behavioral task
behavioral9
Sample
Mirage 1.16 v0.2/DIM-1/forcedchunks.dat
Resource
win7-20240508-en
Behavioral task
behavioral10
Sample
Mirage 1.16 v0.2/DIM-1/forcedchunks.dat
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
Mirage 1.16 v0.2/DIM1/data/capabilities.gz
Resource
win7-20240508-en
Behavioral task
behavioral12
Sample
Mirage 1.16 v0.2/DIM1/data/capabilities.gz
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
Mirage 1.16 v0.2/DIM1/data/raids_end.gz
Resource
win7-20240419-en
Behavioral task
behavioral14
Sample
Mirage 1.16 v0.2/DIM1/data/raids_end.gz
Resource
win10v2004-20240426-en
Behavioral task
behavioral15
Sample
Mirage 1.16 v0.2/DIM1/data/villages_end.gz
Resource
win7-20240508-en
Behavioral task
behavioral16
Sample
Mirage 1.16 v0.2/DIM1/data/villages_end.gz
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
Mirage 1.16 v0.2/DIM1/forcedchunks.dat
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
Mirage 1.16 v0.2/DIM1/forcedchunks.dat
Resource
win10v2004-20240426-en
Behavioral task
behavioral19
Sample
Mirage 1.16 v0.2/advancements/00000000-0000-0000-0000-000000000000.json
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
Mirage 1.16 v0.2/advancements/00000000-0000-0000-0000-000000000000.json
Resource
win10v2004-20240426-en
Behavioral task
behavioral21
Sample
Mirage 1.16 v0.2/advancements/c4447e81-96d0-4a3e-8ba0-f49a22115ac0.json
Resource
win7-20240508-en
Behavioral task
behavioral22
Sample
Mirage 1.16 v0.2/advancements/c4447e81-96d0-4a3e-8ba0-f49a22115ac0.json
Resource
win10v2004-20240426-en
Behavioral task
behavioral23
Sample
Mirage 1.16 v0.2/data/capabilities.gz
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
Mirage 1.16 v0.2/data/capabilities.gz
Resource
win10v2004-20240508-en
Behavioral task
behavioral25
Sample
Mirage 1.16 v0.2/data/raids.gz
Resource
win7-20240508-en
Behavioral task
behavioral26
Sample
Mirage 1.16 v0.2/data/raids.gz
Resource
win10v2004-20240226-en
Behavioral task
behavioral27
Sample
Mirage 1.16 v0.2/data/villages.gz
Resource
win7-20240221-en
Behavioral task
behavioral28
Sample
Mirage 1.16 v0.2/data/villages.gz
Resource
win10v2004-20240426-en
Behavioral task
behavioral29
Sample
Mirage 1.16 v0.2/forcedchunks.dat
Resource
win7-20240508-en
Behavioral task
behavioral30
Sample
Mirage 1.16 v0.2/forcedchunks.dat
Resource
win10v2004-20240426-en
Behavioral task
behavioral31
Sample
Mirage 1.16 v0.2/icon.png
Resource
win7-20240419-en
Behavioral task
behavioral32
Sample
Mirage 1.16 v0.2/icon.png
Resource
win10v2004-20240508-en
General
-
Target
Mirage 1.16 v0.2/data/villages.gz
-
Size
56B
-
MD5
4a953ec23b717ac9262df9e7f74102b4
-
SHA1
959a9d7a83849841699dad64175a453fea9f28d8
-
SHA256
8a85f0223d4d4ba9215ef52da31ddafec004a0b7d3565780fec09762b57cd649
-
SHA512
b47378b91682f5b56eaa2e21bb7c9251b39ebead1fbc38655188f1493097ec2350d9ae58777eb04985479a8ee7fe87f5785059f60fdd7e080c19e802648fb85b
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2636 7zFM.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeRestorePrivilege 2636 7zFM.exe Token: 35 2636 7zFM.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2636 7zFM.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1912 wrote to memory of 2636 1912 cmd.exe 29 PID 1912 wrote to memory of 2636 1912 cmd.exe 29 PID 1912 wrote to memory of 2636 1912 cmd.exe 29
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\Mirage 1.16 v0.2\data\villages.gz"1⤵
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Mirage 1.16 v0.2\data\villages.gz"2⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2636
-