Overview

overview

8

Static

static

mingw-w64-install.exe

windows7_x64

8

mingw-w64-install.exe

windows10_x64

7

Analysis

  • max time kernel
    300s
  • max time network
    302s
  • submitted
    01-01-1970 00:00

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    mingw-w64-install.exe

  • Size

    937KB

  • MD5

    9670c3701f0b546ca63a3e6d7749e59e

  • SHA1

    224af96ce7b76c4d27c8d44061b1bf633cdd4eb1

  • SHA256

    19b9a267a5b79913bf6a3a53cda83c3f7711cb6c879d48ccb97b4ed15c21fcf1

  • SHA512

    4a7376d1a0913ed649f2ec54121acf86c03aa42c4a8c1fbbca85a35097baa282940399dcb6a7fe7f9401c8215787116a9a8d4f426f05a85644099a334be4ac87

Score
8/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 6 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\mingw-w64-install.exe
    "C:\Users\Admin\AppData\Local\Temp\mingw-w64-install.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:676
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\deldll.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1284
      • C:\Windows\SysWOW64\PING.EXE
        ping -n 2 -w 1000 127.0.0.1
        3⤵
        • Runs ping.exe
        PID:1548
  • C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe"
    1⤵
      PID:1864
    • C:\Windows\explorer.exe
      "C:\Windows\explorer.exe"
      1⤵
        PID:1088
      • C:\Windows\system32\AUDIODG.EXE
        C:\Windows\system32\AUDIODG.EXE 0x404
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1656
      • C:\Windows\system32\cmd.exe
        cmd /c ""C:\Program Files (x86)\mingw-w64\i686-8.1.0-win32-dwarf-rt_v6-rev0\mingw-w64.bat" "
        1⤵
        • Suspicious use of WriteProcessMemory
        PID:592
        • C:\Windows\system32\cmd.exe
          "C:\Windows\system32\cmd.exe"
          2⤵
            PID:1088
        • C:\Windows\system32\cmd.exe
          cmd /c ""C:\Program Files (x86)\mingw-w64\i686-8.1.0-win32-dwarf-rt_v6-rev0\mingw-w64.bat" "
          1⤵
          • Suspicious use of WriteProcessMemory
          PID:868
          • C:\Windows\system32\cmd.exe
            "C:\Windows\system32\cmd.exe"
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:872
            • C:\Program Files (x86)\mingw-w64\i686-8.1.0-win32-dwarf-rt_v6-rev0\mingw32\bin\g++.exe
              g++
              3⤵
              • Executes dropped EXE
              • Suspicious behavior: CmdExeWriteProcessMemorySpam
              PID:1460

        Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/676-64-0x0000000002B90000-0x0000000002B91000-memory.dmp

          Filesize

          4KB

          Download

        • memory/676-55-0x0000000075BD1000-0x0000000075BD3000-memory.dmp

          Filesize

          8KB

          Download

        • memory/676-60-0x0000000000320000-0x000000000033A000-memory.dmp

          Filesize

          104KB

          Download

        • memory/676-65-0x0000000002A70000-0x0000000002A71000-memory.dmp

          Filesize

          4KB

          Download

        • memory/676-63-0x0000000002A60000-0x0000000002A61000-memory.dmp

          Filesize

          4KB

          Download

        • memory/676-62-0x0000000002A40000-0x0000000002A41000-memory.dmp

          Filesize

          4KB

          Download

        • memory/676-61-0x0000000074BD1000-0x0000000074BD3000-memory.dmp

          Filesize

          8KB

          Download

        • memory/1088-71-0x000007FEFBF91000-0x000007FEFBF93000-memory.dmp

          Filesize

          8KB

          Download