Analysis
- user interaction
yes - max time kernel
35s - max time network
33s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/07/2026, 16:13
Behavioral task
behavioral1
Sample
MiniBin-6.6.0.0-Setup.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
14 signatures
150 seconds
General
- Target MiniBin-6.6.0.0-Setup.exe
- Size 102KB
- Sample260730-tpjxtaca54
- SHA256 5b4a0e1530237a6c13c483ab8852187f090ea386a8bdc59f58d0143e1d9cb57d
- MD5 cc4346b199fccd38c7c4eded2da70e46
- SHA1 69fc15d4be35a20fa9f85566f28ea29b45fbc088
- SHA512 7a2abbf9e7241cfc48c7b7bd9f45df4191a2221f9060213363264e916ae61685805d6cea1e680acc1b5b1343f5715d87513ca6a7360114e61169e58677062901
- SSDEEP 3072:R5TDpNFVbxDSXJFolx/h47i+67sYn7zKKsz7HYaY:R57TcfolXa0sA7WvzY
- TLSH T1D3A3E19576D398AFD59201B10976FBB5E376FAFC17215A432BC09F3B28712868F461C0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x000c00000001c627-18.dat acprotect - Executes dropped EXE 2 IoCs
pid Process 4200 MiniBin.exe 2072 MiniBin.exe - Loads dropped DLL 5 IoCs
pid Process 4452 MiniBin-6.6.0.0-Setup.exe 4452 MiniBin-6.6.0.0-Setup.exe 4452 MiniBin-6.6.0.0-Setup.exe 4452 MiniBin-6.6.0.0-Setup.exe 4452 MiniBin-6.6.0.0-Setup.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MiniBin = "C:\\Program Files (x86)\\MiniBin\\MiniBin.exe" MiniBin-6.6.0.0-Setup.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\F: MiniBin.exe -
resource yara_rule behavioral1/files/0x000c00000001c627-18.dat upx behavioral1/memory/4452-21-0x0000000073900000-0x000000007390A000-memory.dmp upx - Drops file in Program Files directory 6 IoCs
description ioc Process File created C:\Program Files (x86)\MiniBin\MiniBin.exe MiniBin-6.6.0.0-Setup.exe File created C:\Program Files (x86)\MiniBin\license.txt MiniBin-6.6.0.0-Setup.exe File created C:\Program Files (x86)\MiniBin\changelog.txt MiniBin-6.6.0.0-Setup.exe File created C:\Program Files (x86)\MiniBin\minibin.ini MiniBin-6.6.0.0-Setup.exe File created C:\Program Files (x86)\MiniBin\minibin-language.ini MiniBin-6.6.0.0-Setup.exe File created C:\Program Files (x86)\MiniBin\uninst.exe MiniBin-6.6.0.0-Setup.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MiniBin-6.6.0.0-Setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MiniBin.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MiniBin.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NOTEPAD.EXE - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings MiniBin-6.6.0.0-Setup.exe - Suspicious use of FindShellTrayWindow 32 IoCs
pid Process 4200 MiniBin.exe 4200 MiniBin.exe 4200 MiniBin.exe 4200 MiniBin.exe 4200 MiniBin.exe 4200 MiniBin.exe 4200 MiniBin.exe 4200 MiniBin.exe 4200 MiniBin.exe 4200 MiniBin.exe 4200 MiniBin.exe 4200 MiniBin.exe 4200 MiniBin.exe 4200 MiniBin.exe 4200 MiniBin.exe 4200 MiniBin.exe 4200 MiniBin.exe 4200 MiniBin.exe 4200 MiniBin.exe 4200 MiniBin.exe 4200 MiniBin.exe 4200 MiniBin.exe 4200 MiniBin.exe 4200 MiniBin.exe 4200 MiniBin.exe 4200 MiniBin.exe 4200 MiniBin.exe 4200 MiniBin.exe 4200 MiniBin.exe 4200 MiniBin.exe 4200 MiniBin.exe 4200 MiniBin.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 4200 MiniBin.exe 4200 MiniBin.exe 4200 MiniBin.exe 4200 MiniBin.exe 4200 MiniBin.exe 4200 MiniBin.exe 4200 MiniBin.exe 4200 MiniBin.exe 4200 MiniBin.exe 4200 MiniBin.exe 4200 MiniBin.exe 4200 MiniBin.exe 4200 MiniBin.exe 4200 MiniBin.exe 4200 MiniBin.exe 4200 MiniBin.exe 4200 MiniBin.exe 4200 MiniBin.exe 4200 MiniBin.exe 4200 MiniBin.exe 4200 MiniBin.exe 4200 MiniBin.exe 4200 MiniBin.exe 4200 MiniBin.exe 4200 MiniBin.exe 4200 MiniBin.exe 4200 MiniBin.exe 4200 MiniBin.exe 4200 MiniBin.exe 4200 MiniBin.exe 4200 MiniBin.exe 4200 MiniBin.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4452 wrote to memory of 2072 4452 MiniBin-6.6.0.0-Setup.exe 91 PID 4452 wrote to memory of 460 4452 MiniBin-6.6.0.0-Setup.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\MiniBin-6.6.0.0-Setup.exe"C:\Users\Admin\AppData\Local\Temp\MiniBin-6.6.0.0-Setup.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Program Files (x86)\MiniBin\MiniBin.exe"C:\Program Files (x86)\MiniBin\MiniBin.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2072
-
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files (x86)\MiniBin\changelog.txt2⤵
- System Location Discovery: System Language Discovery
PID:460
-
-
C:\Program Files (x86)\MiniBin\MiniBin.exe"C:\Program Files (x86)\MiniBin\MiniBin.exe"1⤵
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4200
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\MiniBin\MiniBin.exe
- Size 69KB
- SHA256 6cd155efe3591a5edcdd1cfd588de0fbd40ec98ead9fbeb52ee664e9bcfe6ff8
- MD5 f4fa099a4249bf979d8f29d27a98c77b
- SHA1 4b7590142130d967e5dd684893e599f16fe28848
- SHA512 54526b4ded18701a9246d1c7c6e02b8b5b62f6f0316737196a0aeec3685c153b158a4965b13b479e0b5b32329a41d0261b50ac6f9e33bc71cfc68a10455e7c91
- SSDEEP 768:Mvjz2xcF7z7S1/8K1aqQllhGp4mEn/AVfXPe7HEDYxSnpA4WhtTDIb9j:wX2xx/8K1wGOn4VfXPLk/2
- TLSH T111634C1272D18C75E0925A3458B5D7B52A7EFC132635098F6BE52BEF2E706C08E34367
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\MiniBin\changelog.txt
- Size 696B
- SHA256 ad88f6f48d8c3ca6ac1f2151c3e38b6b5d4297894816f51e96697b9c72a3c42f
- MD5 67bd6309dba8687eac432d323f3c7ca7
- SHA1 27020653a93abc32f0e8029a26a96562eee58af8
- SHA512 6b293cd47127ba708b9eddbb2a3fe2e698556e1e528295898edede2abd0f679f3e51328c050743e0bec92d2ef587b21f03d58870201a5653827accf911c17d59
- TLSH T1B701D3ABB407715A62B74112A1157331D92C13D1CF183A7AF55D365C17FA051E04F55C
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\MiniBin\minibin-language.ini
- Size 1KB
- SHA256 ee4e77da422e3df0b006293c8c991f42e23e0452e3fcc8c6dfedcb9eaeebeda7
- MD5 1e7a32139a56c7746b5b40564035e125
- SHA1 7efa541aea713165f5ad760c283e0532e24e3a92
- SHA512 b9106abb4beea08b6fd47897026f0c091008e9083885ea32cfb94278c9aee3342c8021a33353d05e74935c3220e8e9255aa991df87606ca5193a011c9c2ecc31
- TLSH T16E11006277F80668B2F42FA0BE7C68245B36FCE21C1A90CC56C2204904E1E409DBA7B7
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\MiniBin\minibin.ini
- Size 392B
- SHA256 3a47e3801c0fe41e4a210e521183be8500ab11c0badc9284b96523beef0e49d5
- MD5 4a6f3f640023df556e6218990449b40e
- SHA1 be50b904f6744ecd3dfe5ca4e062c36d3e7569be
- SHA512 1cf80e0bd13080d30b0f341276cbdc21231d70288e1cb959108ab5aeb6382460295dc366c721b306d2701f9dd190b9c4b58e46f79e624fb553750f24b4c5b147
- TLSH T125E09A333BF90C24E4A26F98FABE58311F25FC542C1D94DD91C2515B89E2E408C663E7
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsg9DED.tmp\AccessControl.dll
- Size 8KB
- SHA256 8a8f5bafc105186c85f14e017ab6da33ae8f88a9635e51756f90b6d95381d80d
- MD5 9f1a88b953fd2a2c23b09703b253186c
- SHA1 29d5a5a24e7f782a07e9f5d2ec1d1a6218fec737
- SHA512 10b3a812c92b7324bddcd23adf923fcaec2532f31bdd9fbf17494fc33f99aa0a0a48b94f1fdd6599fa0189567626a90b324a1d132bf9cb8b00a6afc547e64018
- SSDEEP 192:RmcLe8uWVNz5ZalBK/7rUlYg5q5LcywvX5:RJdNzMKXUlYg5qPq5
- TLSH T1E3029D8643A40179E8730BFC4FAD4C1A1B2EFFB0CBB1569D2158356F6820B1488B6F31
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsg9DED.tmp\System.dll
- Size 11KB
- SHA256 484f8e9f194ed9016274ef3672b2c52ed5f574fb71d3884edf3c222b758a75a2
- MD5 960a5c48e25cf2bca332e74e11d825c9
- SHA1 da35c6816ace5daf4c6c1d57b93b09a82ecdc876
- SHA512 cc450179e2d0d56aee2ccf8163d3882978c4e9c1aa3d3a95875fe9ba9831e07ddfd377111dc67f801fa53b6f468a418f086f1de7c71e0a5b634e1ae2a67cd3da
- SSDEEP 192:jVL7iZJX76BiqsO7+UZEw+RlthVEoC0O3XB:g7ssOpZs/hS3X
- TLSH T19A323918036442F3E5D5C83D186A3BAB5B28252196F08F53DFB39881FE386D66D39362
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsg9DED.tmp\modern-wizard.bmp
- Size 100KB
- SHA256 93e8662fe9506df0e4dbea8b8421047cf99b79979be300a86898d3e9ceb1a358
- MD5 a0b74ed88cbbb2fa4e92604433ca350b
- SHA1 877864400bc0cef1aac1102e54fae4f72ad2e033
- SHA512 0b08647af32c304640a4cc71cf2a4344a614f9eeca4fce447f20f507603800f1d128afb895d7df21615db76b64d4fc8a94ac0bfa33dd2ac71a8376357c5dede3
- SSDEEP 96:tuTY/qwzKvjLWxzqiiI/p1H3S5P4vTGzAT3/t5/66UtgV8eeSYSP:tuk/qwzK3EAI/pp3WPiTGzy3/3vVleo
- TLSH T1E5A3A6839859A6FCD0A43E7D73E984164E999D8348D92194468C7DEF8C436C22CFF2AC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsg9DED.tmp\nsDialogs.dll
- Size 9KB
- SHA256 495bddc0be6e18e981db82fab9d1de55c7e269ab4ec3ff43035193bc017a307b
- MD5 8ced0b79f7b9033d0795aab3be6d627c
- SHA1 90c2043ffccd068f407c624c50ac7b795db1e132
- SHA512 e38f63a342729f5ff6d0db607d7877b65c33ed19e2b5a97dd868ece8c2a3e829d4153624943444be2f0de885496161d54c1da9594bdc0a5a0bcc8b727e2facb0
- SSDEEP 96:3Rp41CMj95rKhkfL5RkEdKkcxM2DjDf3GEEE9v5E9av+Yx4indY7ndS27gA:3RujesS4HREEK5MYxDdqn420
- TLSH T1FC12F9675A0010B3E9A36239316A2D3F8B7C9325D0A37C03C677AE562BF431A7D3A355
- MD5 SHA1 SHA512 SSDEEP TLSH