Analysis
- max time kernel
150s - max time network
151s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
- submitted
02/04/2024, 19:53
General
- Target 95ba507c62f9bfbe0bc258702450e634_JaffaCakes118.exe
- Size 49KB
- Sample240402-ymf6csbg7x
- SHA256 640db2b24b1ff39f4c6c8eb1d177c7d9882d55839744901e55891a496bab7304
Malware Config
Signatures
- Tinba / TinyBanker
Banking trojan which uses packet sniffing to steal data.
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\95ba507c62f9bfbe0bc258702450e634_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\95ba507c62f9bfbe0bc258702450e634_JaffaCakes118.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\winver.exewinver3⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1124-22-0x00000000002D0000-0x00000000002D6000-memory.dmp
memory/1124-23-0x0000000076E81000-0x0000000076E82000-memory.dmp
memory/1188-19-0x0000000000380000-0x0000000000386000-memory.dmp
memory/1188-24-0x0000000000380000-0x0000000000386000-memory.dmp
memory/1220-25-0x0000000002A60000-0x0000000002A66000-memory.dmp
memory/1220-5-0x0000000002AB0000-0x0000000002AB6000-memory.dmp
memory/1220-3-0x0000000002AB0000-0x0000000002AB6000-memory.dmp
memory/1220-1-0x0000000002AB0000-0x0000000002AB6000-memory.dmp
memory/1220-9-0x0000000076E81000-0x0000000076E82000-memory.dmp
memory/1220-21-0x0000000002A60000-0x0000000002A66000-memory.dmp
memory/1960-0-0x0000000000020000-0x0000000000021000-memory.dmp
memory/1960-2-0x0000000001ED0000-0x00000000028D0000-memory.dmp
memory/1960-11-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1960-12-0x0000000001ED0000-0x00000000028D0000-memory.dmp
memory/3044-4-0x0000000000090000-0x0000000000096000-memory.dmp
memory/3044-15-0x0000000000180000-0x0000000000181000-memory.dmp
memory/3044-14-0x0000000000090000-0x0000000000096000-memory.dmp
memory/3044-10-0x0000000000650000-0x0000000000666000-memory.dmp
memory/3044-8-0x0000000077030000-0x0000000077031000-memory.dmp
memory/3044-6-0x000000007702F000-0x0000000077030000-memory.dmp
memory/3044-7-0x000000007702F000-0x0000000077031000-memory.dmp
memory/3044-29-0x0000000000090000-0x0000000000096000-memory.dmp
memory/3044-30-0x0000000000190000-0x0000000000191000-memory.dmp