Overview

overview

8

Static

static

mingw-w64-install.exe

windows7_x64

8

mingw-w64-install.exe

windows10_x64

7

Analysis

  • max time kernel
    158s
  • max time network
    124s
  • submitted
    01-01-1970 00:00

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    mingw-w64-install.exe

  • Size

    937KB

  • MD5

    9670c3701f0b546ca63a3e6d7749e59e

  • SHA1

    224af96ce7b76c4d27c8d44061b1bf633cdd4eb1

  • SHA256

    19b9a267a5b79913bf6a3a53cda83c3f7711cb6c879d48ccb97b4ed15c21fcf1

  • SHA512

    4a7376d1a0913ed649f2ec54121acf86c03aa42c4a8c1fbbca85a35097baa282940399dcb6a7fe7f9401c8215787116a9a8d4f426f05a85644099a334be4ac87

Score
7/10
discovery

Malware Config

Signatures

  • Loads dropped DLL 7 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\mingw-w64-install.exe
    "C:\Users\Admin\AppData\Local\Temp\mingw-w64-install.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:2700
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\deldll.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1380
      • C:\Windows\SysWOW64\PING.EXE
        ping -n 2 -w 1000 127.0.0.1
        3⤵
        • Runs ping.exe
        PID:1988

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2700-123-0x00000000030D0000-0x00000000030D1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2700-124-0x0000000003120000-0x0000000003121000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2700-125-0x0000000003110000-0x0000000003111000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2700-126-0x00000000004F0000-0x000000000059E000-memory.dmp

    Filesize

    696KB

    Download