MD5: be839c8483496ab025756e0378624170
SHA1: 3fc038232394be045b4615be37bcf8e1b1a35f29
SHA256: 9107e208eba4a6f8c079ef47c91da3123d5e8f11cd5cc53f06bfd32a41271c8b
SSDeep: 12288:71/aGLDCMNpNAkoSzZWD8ayX2MQCw7D0kOjdHt8F0bywWV13AzgtCsYpduP3No87:71/aGLDCM4D8ayGMwedH60tWV13AgCsX
Size: 688200 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: Mail.Ru
Created at: 2014-02-27 08:41:59
Analyzed on: Windows7 SP1 32-bit

Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

vgmah.exe:3104
%original file name%.exe:848

The Trojan injects its code into the following process(es):
No processes have been created.

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process vgmah.exe:3104 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\original .exe (1346717 bytes)
C:\config.sys .exe (1346717 bytes)
C:\bootmgr .exe (1346717 bytes)
C:\Boot .exe (1346717 bytes)
C:\Windows .exe (1346717 bytes)
C:\ProgramData .exe (1346717 bytes)
C:\$Recycle.Bin .exe (1346717 bytes)
C:\BOOTSECT.BAK .exe (1346717 bytes)
%Documents and Settings% .exe (1346717 bytes)
C:\totalcmd .exe (1346717 bytes)
C:\Users .exe (1346717 bytes)
C:\XELDZ .exe (1346717 bytes)
C:\autoexec.bat .exe (1346717 bytes)
C:\System Volume Information .exe (1346717 bytes)
C:\marker .exe (1346717 bytes)
C:\%original file name%.exe .exe (1346717 bytes)
%Program Files% .exe (1346717 bytes)
C:\pagefile.sys .exe (1346717 bytes)

The Trojan deletes the following file(s):

C:\Mirax (0 bytes)
C:\Mirau (0 bytes)
C:\Mirav (0 bytes)
C:\Miraw (0 bytes)
C:\Mirap (0 bytes)
C:\Mirar (0 bytes)
C:\Miras (0 bytes)
C:\Miram (0 bytes)
C:\Mirah (0 bytes)
C:\Mirai (0 bytes)
C:\Miraj (0 bytes)
C:\Mirad (0 bytes)
C:\Mirae (0 bytes)
C:\Mirag (0 bytes)
C:\Miraa (0 bytes)
C:\Mirac (0 bytes)

The process %original file name%.exe:848 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\ProgramData\Saaaalamm\Mira.h (542872 bytes)
C:\ProgramData\vgmah.exe (804670 bytes)

Registry activity

The process vgmah.exe:3104 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Microsoft® Windows® Operating System" = "C:\ProgramData\vgmah.exe"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

No information is available.

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 4
ccd3719cc98cbc5e9efd295dabeb0f11
1955975b7640580714c3abd149d23ee5
afb7759d5b2e688b66822c500aaf6315
7b09c2fda50e1f28f57bf54e0a1132f2

URLs

No activity has been detected.

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Web Traffic was not found.

The Trojan connects to the servers at the folowing location(s):

.text

`.data

.rdata

@.bss

.idata

C:\ProgramData\vgmah.exe

Software\Microsoft\Windows\CurrentVersion\Run

Windows

Operating System

%H:%M:%S

%m/%d/%y

-0123456789

%s:%u: failed assertion `%s'

RegCloseKey

RegOpenKeyA

ADVAPI32.DLL

KERNEL32.dll

msvcrt.dll

SHELL32.DLL

SearchProtocolHost.exe_3776:

.text

`.data

.rsrc

@.reloc

ADVAPI32.dll

ntdll.DLL

KERNEL32.dll

msvcrt.dll

USER32.dll

ole32.dll

OLEAUT32.dll

TQUERY.DLL

MSSHooks.dll

IMM32.dll

SHLWAPI.dll

SrchCollatorCatalogInfo

SrchDSSLogin

SrchDSSPortManager

SrchPHHttp

SrchIndexerQuery

SrchIndexerProperties

SrchIndexerPlugin

SrchIndexerClient

SrchIndexerSchema

Msidle.dll

Failed to get REGKEY_FLTRDMN_MS_TO_IDLE, using default

pfps->psProperty.ulKind is LPWSTR but psProperty.lpwstr is NULL or empty

d:\win7sp1_gdr\enduser\mssearch2\common\utils\crchash.cxx

d:\win7sp1_gdr\enduser\mssearch2\search\search\gather\fltrdmn\fltrdaemon.cxx

d:\win7sp1_gdr\enduser\mssearch2\search\common\include\secutil.hxx

d:\win7sp1_gdr\enduser\mssearch2\common\tracer\tracerhelpers.h

d:\win7sp1_gdr\enduser\mssearch2\common\tracer\mutex.cpp

d:\win7sp1_gdr\enduser\mssearch2\common\include\srchxcpt.hxx

RegDeleteKeyW

RegDeleteKeyExW

8%uiP

Invalid parameter passed to C runtime function.

d:\win7sp1_gdr\enduser\mssearch2\common\tracer\tracersecutil.h

d:\win7sp1_gdr\enduser\mssearch2\common\tracer\tracmain.cpp

-d-d-d-d-d-d-d-%d

d:\win7sp1_gdr\enduser\mssearch2\common\tracer\tracmain.h

</MSG></TRC>

<MSG>

<ERR> 0xx=

<LOC> %s(%d) </LOC>

tid="0x%x"

pid="0x%x"

tagname="%s"

tagid="0x%x"

el="0x%x"

time="d/d/d d:d:d.d"

logname="%s"

d:\win7sp1_gdr\enduser\mssearch2\common\tracer\sysimprs.cxx

SHELL32.dll

PROPSYS.dll

ntdll.dll

RegCloseKey

RegCreateKeyExW

RegOpenKeyExW

RegQueryInfoKeyW

RegEnumKeyExW

ReportEventW

_amsg_exit

MsgWaitForMultipleObjects

SearchProtocolHost.pdb

2 2(20282|2

4%5S5

Software\Microsoft\Windows Search

https

kernel32.dll

msTracer.dll

msfte.dll

lX-X-X-XX-XXXXXX

SOFTWARE\Microsoft\Windows Search

tquery.dll

%s\%s

HKEY_CLASSES_ROOT

HKEY_CURRENT_USER

HKEY_LOCAL_MACHINE

HKEY_USERS

HKEY_PERFORMANCE_DATA

HKEY_DYN_DATA

HKEY_CURRENT_CONFIG

Windows Search Service

<Exception><HR>0xx</HR><eip>%p</eip><module>%S</module><line>%d</line></Exception>

advapi32.dll

WAPI-MS-Win-Core-LocalRegistry-L1-1-0.dll

winhttp.dll

Software\Microsoft\Windows Search\Tracing

Software\Microsoft\Windows Search\Tracing\EventThrottleLastReported

Software\Microsoft\Windows Search\Tracing\EventThrottleState

<MSG>

<LOC> %S(%d) </LOC>

tagname="%S"

logname="%S"

Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}

.\%s.mui

.\%s\%s.mui

%s\%s.mui

%s\%s\%s.mui

Microsoft Windows Search Protocol Host

7.00.7601.17610 (win7sp1_gdr.110503-1502)

SearchProtocolHost.exe

Windows

7.00.7601.17610

SearchFilterHost.exe_1948:

.text

`.data

.rsrc

@.reloc

ADVAPI32.dll

ntdll.DLL

KERNEL32.dll

msvcrt.dll

USER32.dll

ole32.dll

OLEAUT32.dll

TQUERY.DLL

IMM32.dll

MSSHooks.dll

mscoree.dll

SHLWAPI.dll

d:\win7sp1_gdr\enduser\mssearch2\search\search\gather\fltrhost\bufstm.cxx

d:\win7sp1_gdr\enduser\mssearch2\common\tracer\mutex.cpp

RegDeleteKeyW

RegDeleteKeyExW

8%uiP

d:\win7sp1_gdr\enduser\mssearch2\common\include\srchxcpt.hxx

Invalid parameter passed to C runtime function.

d:\win7sp1_gdr\enduser\mssearch2\common\tracer\tracersecutil.h

d:\win7sp1_gdr\enduser\mssearch2\common\tracer\tracmain.cpp

-d-d-d-d-d-d-d-%d

d:\win7sp1_gdr\enduser\mssearch2\common\tracer\tracmain.h

d:\win7sp1_gdr\enduser\mssearch2\common\tracer\sysimprs.cxx

RegCloseKey

RegCreateKeyExW

RegOpenKeyExW

RegQueryInfoKeyW

RegEnumKeyExW

ReportEventW

_amsg_exit

SearchFilterHost.pdb

version="5.1.0.0"

name="Microsoft.Windows.Search.MSSFH"

<requestedExecutionLevel

3 3(30383|3

kernel32.dll

Software\Microsoft\Windows Search

SOFTWARE\Microsoft\Windows Search

HKEY_CLASSES_ROOT

HKEY_CURRENT_USER

HKEY_LOCAL_MACHINE

HKEY_USERS

HKEY_PERFORMANCE_DATA

HKEY_DYN_DATA

HKEY_CURRENT_CONFIG

Windows Search Service

tquery.dll

advapi32.dll

API-MS-Win-Core-LocalRegistry-L1-1-0.dll

<Exception><HR>0xx</HR><eip>%p</eip><module>%S</module><line>%d</line></Exception>

Software\Microsoft\Windows Search\Tracing

Software\Microsoft\Windows Search\Tracing\EventThrottleLastReported

Software\Microsoft\Windows Search\Tracing\EventThrottleState

<MSG>

<ERR> 0xx=

<LOC> %S(%d) </LOC>

tid="0x%x"

pid="0x%x"

tagname="%S"

tagid="0x%x"

el="0x%x"

time="d/d/d d:d:d.d"

logname="%S"

</MSG></TRC>

Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}

.\%s.mui

.\%s\%s.mui

%s\%s.mui

%s\%s\%s.mui

%s\%s

winhttp.dll

Microsoft Windows Search Filter Host

7.00.7601.17610 (win7sp1_gdr.110503-1502)

SearchFilterHost.exe

Windows

7.00.7601.17610

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):
   

   vgmah.exe:3104
   %original file name%.exe:848

2. Delete the original Trojan file.
   
3. Delete or disinfect the following files created/modified by the Trojan:
   

   C:\original .exe (1346717 bytes)
   C:\config.sys .exe (1346717 bytes)
   C:\bootmgr .exe (1346717 bytes)
   C:\Boot .exe (1346717 bytes)
   C:\Windows .exe (1346717 bytes)
   C:\ProgramData .exe (1346717 bytes)
   C:\$Recycle.Bin .exe (1346717 bytes)
   C:\BOOTSECT.BAK .exe (1346717 bytes)
   %Documents and Settings% .exe (1346717 bytes)
   C:\totalcmd .exe (1346717 bytes)
   C:\Users .exe (1346717 bytes)
   C:\XELDZ .exe (1346717 bytes)
   C:\autoexec.bat .exe (1346717 bytes)
   C:\System Volume Information .exe (1346717 bytes)
   C:\marker .exe (1346717 bytes)
   C:\%original file name%.exe .exe (1346717 bytes)
   %Program Files% .exe (1346717 bytes)
   C:\pagefile.sys .exe (1346717 bytes)
   C:\ProgramData\Saaaalamm\Mira.h (542872 bytes)
   C:\ProgramData\vgmah.exe (804670 bytes)

4. Delete the following value(s) in the autorun key (How to Work with System Registry):
   

   [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
   "Microsoft® Windows® Operating System" = "C:\ProgramData\vgmah.exe"

5. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.