tinba | 1242d8575a9129cb9e86467638aa7317daea0722f87fc444a43e26b2d0accc79

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/03/2024, 10:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
02c39461a3fc985bcee79bc2cf04b793_JaffaCakes118.exe
Size 160KB
Sample240328-l4hdjaab2t
SHA256 1242d8575a9129cb9e86467638aa7317daea0722f87fc444a43e26b2d0accc79
MD5 02c39461a3fc985bcee79bc2cf04b793
SHA1 0ff6b0ce7d391f078ed14eda5c237f6727bf5c8a
SHA512 a13aa9d582e698d1381414e5416a351bf6119a1ee576daf229eddc564e9896587aacc01d4b4ecac0460dc23b02a05c6f78144fa2008793ef9cd3e3df9798752e
SSDEEP 1536:QEY+mFM2HXKZgi0Iksu+XM5/HtAQ9J6xph:DY+4MiIkLZJNAQ9J6v
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

tinba banker persistence trojan upx

Malware Config

Signatures

Tinba / TinyBanker
Banking trojan which uses packet sniffing to steal data.
trojan banker tinba

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4868-0-0x0000000000400000-0x0000000000428000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ED1AE734 = "C:\\Users\\Admin\\AppData\\Roaming\\ED1AE734\\bin.exe"	winver.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3604	winver.exe
3604	winver.exe
3604	winver.exe
3604	winver.exe
3604	winver.exe
3604	winver.exe
3604	winver.exe
3604	winver.exe
3604	winver.exe
3604	winver.exe
3604	winver.exe
3604	winver.exe
3604	winver.exe
3604	winver.exe
3604	winver.exe
3604	winver.exe
3604	winver.exe
3604	winver.exe
3604	winver.exe
3604	winver.exe
3604	winver.exe
3604	winver.exe
3604	winver.exe
3604	winver.exe
3604	winver.exe
3604	winver.exe
3604	winver.exe
3604	winver.exe
3604	winver.exe
3604	winver.exe
3604	winver.exe
3604	winver.exe
3604	winver.exe
3604	winver.exe
3604	winver.exe
3604	winver.exe
3604	winver.exe
3604	winver.exe
3604	winver.exe
3604	winver.exe
3604	winver.exe
3604	winver.exe
3604	winver.exe
3604	winver.exe
3604	winver.exe
3604	winver.exe
3604	winver.exe
3604	winver.exe
3604	winver.exe
3604	winver.exe
3604	winver.exe
3604	winver.exe
3604	winver.exe
3604	winver.exe
3604	winver.exe
3604	winver.exe
3604	winver.exe
3604	winver.exe
3604	winver.exe
3604	winver.exe
3604	winver.exe
3604	winver.exe
3604	winver.exe
3604	winver.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3332	Explorer.EXE
Token: SeCreatePagefilePrivilege	3332	Explorer.EXE
Token: SeShutdownPrivilege	3332	Explorer.EXE
Token: SeCreatePagefilePrivilege	3332	Explorer.EXE
Token: SeShutdownPrivilege	3332	Explorer.EXE
Token: SeCreatePagefilePrivilege	3332	Explorer.EXE
Token: SeShutdownPrivilege	3944	RuntimeBroker.exe
Token: SeShutdownPrivilege	3944	RuntimeBroker.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3604	winver.exe
3332	Explorer.EXE
3332	Explorer.EXE

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3332	Explorer.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4868 wrote to memory of 3604	4868	02c39461a3fc985bcee79bc2cf04b793_JaffaCakes118.exe	95
PID 4868 wrote to memory of 3604	4868	02c39461a3fc985bcee79bc2cf04b793_JaffaCakes118.exe	95
PID 4868 wrote to memory of 3604	4868	02c39461a3fc985bcee79bc2cf04b793_JaffaCakes118.exe	95
PID 4868 wrote to memory of 3604	4868	02c39461a3fc985bcee79bc2cf04b793_JaffaCakes118.exe	95
PID 3604 wrote to memory of 3332	3604	winver.exe	57
PID 3604 wrote to memory of 2416	3604	winver.exe	42
PID 3604 wrote to memory of 2448	3604	winver.exe	43
PID 3604 wrote to memory of 2520	3604	winver.exe	46
PID 3604 wrote to memory of 3332	3604	winver.exe	57
PID 3604 wrote to memory of 3468	3604	winver.exe	58
PID 3604 wrote to memory of 3732	3604	winver.exe	59
PID 3604 wrote to memory of 3880	3604	winver.exe	60
PID 3604 wrote to memory of 3944	3604	winver.exe	61
PID 3604 wrote to memory of 4028	3604	winver.exe	62
PID 3604 wrote to memory of 2140	3604	winver.exe	63
PID 3604 wrote to memory of 2260	3604	winver.exe	65
PID 3604 wrote to memory of 544	3604	winver.exe	75
PID 3604 wrote to memory of 4880	3604	winver.exe	76
PID 3604 wrote to memory of 3856	3604	winver.exe	78
PID 3604 wrote to memory of 4920	3604	winver.exe	79
PID 3604 wrote to memory of 3124	3604	winver.exe	80
PID 3604 wrote to memory of 1576	3604	winver.exe	81
PID 3604 wrote to memory of 4988	3604	winver.exe	82
PID 3604 wrote to memory of 3612	3604	winver.exe	84
PID 3604 wrote to memory of 4156	3604	winver.exe	85
PID 3604 wrote to memory of 4300	3604	winver.exe	91
PID 3604 wrote to memory of 2320	3604	winver.exe	96
PID 3604 wrote to memory of 5036	3604	winver.exe	97
PID 3856 wrote to memory of 4412	3856	msedge.exe	109
PID 3856 wrote to memory of 4412	3856	msedge.exe	109
PID 3856 wrote to memory of 4412	3856	msedge.exe	109
PID 3856 wrote to memory of 4412	3856	msedge.exe	109
PID 3856 wrote to memory of 4412	3856	msedge.exe	109
PID 3856 wrote to memory of 4412	3856	msedge.exe	109
PID 3856 wrote to memory of 4412	3856	msedge.exe	109
PID 3856 wrote to memory of 4412	3856	msedge.exe	109
PID 3856 wrote to memory of 4412	3856	msedge.exe	109
PID 3856 wrote to memory of 4412	3856	msedge.exe	109
PID 3856 wrote to memory of 4412	3856	msedge.exe	109
PID 3856 wrote to memory of 4412	3856	msedge.exe	109
PID 3856 wrote to memory of 4412	3856	msedge.exe	109
PID 3856 wrote to memory of 4412	3856	msedge.exe	109
PID 3856 wrote to memory of 4412	3856	msedge.exe	109
PID 3856 wrote to memory of 4412	3856	msedge.exe	109
PID 3856 wrote to memory of 4412	3856	msedge.exe	109
PID 3856 wrote to memory of 4412	3856	msedge.exe	109
PID 3856 wrote to memory of 4412	3856	msedge.exe	109
PID 3856 wrote to memory of 4412	3856	msedge.exe	109
PID 3856 wrote to memory of 4412	3856	msedge.exe	109
PID 3856 wrote to memory of 4412	3856	msedge.exe	109
PID 3856 wrote to memory of 4412	3856	msedge.exe	109
PID 3856 wrote to memory of 4412	3856	msedge.exe	109
PID 3856 wrote to memory of 4412	3856	msedge.exe	109
PID 3856 wrote to memory of 4412	3856	msedge.exe	109
PID 3856 wrote to memory of 4412	3856	msedge.exe	109
PID 3856 wrote to memory of 4412	3856	msedge.exe	109
PID 3856 wrote to memory of 4412	3856	msedge.exe	109
PID 3856 wrote to memory of 4412	3856	msedge.exe	109
PID 3856 wrote to memory of 4412	3856	msedge.exe	109
PID 3856 wrote to memory of 4412	3856	msedge.exe	109
PID 3856 wrote to memory of 4412	3856	msedge.exe	109
PID 3856 wrote to memory of 4412	3856	msedge.exe	109
PID 3856 wrote to memory of 4412	3856	msedge.exe	109
PID 3856 wrote to memory of 4412	3856	msedge.exe	109

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2416

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2448

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2520

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of UnmapMainImage
PID:3332
- C:\Users\Admin\AppData\Local\Temp\02c39461a3fc985bcee79bc2cf04b793_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\02c39461a3fc985bcee79bc2cf04b793_JaffaCakes118.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4868
- - C:\Windows\SysWOW64\winver.exe
    winver
    3⤵
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3604

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3468

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3732

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3880

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3944

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:4028

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:2140

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:2260

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
1⤵
PID:544

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4880

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
1⤵
- Suspicious use of WriteProcessMemory
PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=122.0.2365.52 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b0,0x7ffce2632e98,0x7ffce2632ea4,0x7ffce2632eb0
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2324 --field-trial-handle=2328,i,5873823382323802923,13134441441264702821,262144 --variations-seed-version /prefetch:2
  2⤵
  PID:3124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=2936 --field-trial-handle=2328,i,5873823382323802923,13134441441264702821,262144 --variations-seed-version /prefetch:3
  2⤵
  PID:1576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=3384 --field-trial-handle=2328,i,5873823382323802923,13134441441264702821,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --mojo-platform-channel-handle=5248 --field-trial-handle=2328,i,5873823382323802923,13134441441264702821,262144 --variations-seed-version /prefetch:1
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --mojo-platform-channel-handle=5304 --field-trial-handle=2328,i,5873823382323802923,13134441441264702821,262144 --variations-seed-version /prefetch:1
  2⤵
  PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1404 --field-trial-handle=2328,i,5873823382323802923,13134441441264702821,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:4412

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:4300

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:2320

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:5036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 14a8b13edc8106456e238e06aeb7be9200a1b66aac110ee9d060f8b60b419f3e
MD5 1b32a393d54edbf2fc696a1aecef764e
SHA1 a1a2fa3e7dd971e6eef5e71403f724049b1d62a1
SHA512 eb18ce3ac1f1dd6c9d4ce52fa7ce6acec00fab2ef5edbb8f406c8c5f46d2703db7476ba61ae863de48612fb0403f98e5d779aee78bc2c1a76a665785c1358b16
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 ba3f318e72441aa635bc45f11c6e88e7a41c414a5c7f3c66db9daa5f51dadf8c
MD5 6aa4362af41649441a7f8a709e0bb7fb
SHA1 47e3827918f3c996ce3f4b949a8eed5b1dc83e04
SHA512 cd77c1962c0fb0fcf2b26d0cb717784549774e7c4e66c784a77f30d8f5900815410f926adc8ecb55cdad0b2642008c3b0261f9e354cc3a5c096216e0e6465477
SSDEEP 96:sVTZVEIIrIscDW4H1bDyXhwXuKj4PmAboo5H16ZZS9/x+6M8muecmje1yK+g59BE:sVT/I8saWc8xwpobooASj+FVj0VI6wHJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/544-33-0x0000000000420000-0x0000000000426000-memory.dmp

Download

memory/544-40-0x0000000000420000-0x0000000000426000-memory.dmp

Download

memory/2140-31-0x0000000000D30000-0x0000000000D36000-memory.dmp

Download

memory/2140-36-0x0000000000D30000-0x0000000000D36000-memory.dmp

Download

memory/2260-32-0x0000000000770000-0x0000000000776000-memory.dmp

Download

memory/2260-37-0x0000000000770000-0x0000000000776000-memory.dmp

Download

memory/2320-38-0x00000000008F0000-0x00000000008F6000-memory.dmp

Download

memory/2320-43-0x00000000008F0000-0x00000000008F6000-memory.dmp

Download

memory/2416-17-0x0000000000B30000-0x0000000000B36000-memory.dmp

Download

memory/2448-18-0x00000000006F0000-0x00000000006F6000-memory.dmp

Download

memory/2448-15-0x00000000006F0000-0x00000000006F6000-memory.dmp

Download

memory/2520-22-0x0000000000A50000-0x0000000000A56000-memory.dmp

Download

memory/2520-16-0x0000000000A50000-0x0000000000A56000-memory.dmp

Download

memory/3332-11-0x00007FFD07F20000-0x00007FFD07F21000-memory.dmp

Download

memory/3332-21-0x00000000078E0000-0x00000000078E6000-memory.dmp

Download

memory/3332-10-0x00007FFD07F40000-0x00007FFD07F41000-memory.dmp

Download

memory/3332-5-0x0000000000890000-0x0000000000896000-memory.dmp

Download

memory/3332-7-0x00007FFD07DAD000-0x00007FFD07DAE000-memory.dmp

Download

memory/3332-19-0x00000000078E0000-0x00000000078E6000-memory.dmp

Download

memory/3468-20-0x0000000000A80000-0x0000000000A86000-memory.dmp

Download

memory/3468-25-0x0000000000A80000-0x0000000000A86000-memory.dmp

Download

memory/3604-13-0x0000000000B90000-0x0000000000B96000-memory.dmp

Download

memory/3604-6-0x0000000077912000-0x0000000077913000-memory.dmp

Download

memory/3604-28-0x0000000000B90000-0x0000000000B96000-memory.dmp

Download

memory/3604-3-0x0000000000B90000-0x0000000000B96000-memory.dmp

Download

memory/3732-23-0x00000000009D0000-0x00000000009D6000-memory.dmp

Download

memory/3880-27-0x0000000000230000-0x0000000000236000-memory.dmp

Download

memory/3880-24-0x0000000000230000-0x0000000000236000-memory.dmp

Download

memory/3944-29-0x0000000000240000-0x0000000000246000-memory.dmp

Download

memory/3944-26-0x0000000000240000-0x0000000000246000-memory.dmp

Download

memory/4300-45-0x0000000000E80000-0x0000000000E86000-memory.dmp

Download

memory/4300-35-0x0000000000E80000-0x0000000000E86000-memory.dmp

Download

memory/4300-46-0x00007FFD07F30000-0x00007FFD07F31000-memory.dmp

Download

memory/4868-8-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/4868-9-0x0000000002290000-0x0000000002C90000-memory.dmp

Download

memory/4868-1-0x0000000000480000-0x0000000000481000-memory.dmp

Download

memory/4868-0-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/4868-2-0x0000000002290000-0x0000000002C90000-memory.dmp

Download

memory/4880-42-0x0000000000770000-0x0000000000776000-memory.dmp

Download

memory/4880-34-0x0000000000770000-0x0000000000776000-memory.dmp

Download

memory/5036-39-0x00000000009F0000-0x00000000009F6000-memory.dmp

Download

memory/5036-44-0x00000000009F0000-0x00000000009F6000-memory.dmp

Download

memory/5036-41-0x00007FFD07DAD000-0x00007FFD07DAE000-memory.dmp

Download