Analysis

  • max time kernel
    149s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    04-04-2024 11:40

General

  • Target

    b7620b6adf5f0bd58d84f7cde0e3dcfb_JaffaCakes118.exe

  • Size

    88KB

  • MD5

    b7620b6adf5f0bd58d84f7cde0e3dcfb

  • SHA1

    a20820d463caece8930917c193d2c344049740d3

  • SHA256

    8a3c975f041bcec99b0495f9e67366b68baac6d0c5deb11dd11a77270892befe

  • SHA512

    f40511b157528f234cea14bea4b9357ec913ebde8fe2245c6a6e646433d1cc5581d3f5178f3c3b2c569dcf38d0a1a415dbd7abfe3d60f033ea74ebba25dc12e9

  • SSDEEP

    1536:v5nfmIpxDWbUfd3aOPmxxEhvgCooXqRQqjh+rmKVsN:v5fvp12UFKcD/6jwqWsN

Malware Config

Signatures

  • Tinba / TinyBanker

    Banking trojan which uses packet sniffing to steal data.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    1⤵
      PID:1248
    • C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      1⤵
        PID:1332
      • C:\Windows\Explorer.EXE
        C:\Windows\Explorer.EXE
        1⤵
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:1380
        • C:\Users\Admin\AppData\Local\Temp\b7620b6adf5f0bd58d84f7cde0e3dcfb_JaffaCakes118.exe
          "C:\Users\Admin\AppData\Local\Temp\b7620b6adf5f0bd58d84f7cde0e3dcfb_JaffaCakes118.exe"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:2848
          • C:\Windows\SysWOW64\winver.exe
            winver
            3⤵
            • Adds Run key to start application
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of WriteProcessMemory
            PID:840

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/840-9-0x00000000777A0000-0x00000000777A1000-memory.dmp

        Filesize

        4KB

      • memory/840-32-0x0000000000170000-0x0000000000171000-memory.dmp

        Filesize

        4KB

      • memory/840-3-0x0000000000120000-0x0000000000126000-memory.dmp

        Filesize

        24KB

      • memory/840-31-0x0000000000120000-0x0000000000126000-memory.dmp

        Filesize

        24KB

      • memory/840-15-0x0000000000160000-0x0000000000161000-memory.dmp

        Filesize

        4KB

      • memory/840-8-0x000000007779F000-0x00000000777A1000-memory.dmp

        Filesize

        8KB

      • memory/840-7-0x000000007779F000-0x00000000777A0000-memory.dmp

        Filesize

        4KB

      • memory/840-6-0x00000000007E0000-0x00000000007F6000-memory.dmp

        Filesize

        88KB

      • memory/840-14-0x0000000000120000-0x0000000000126000-memory.dmp

        Filesize

        24KB

      • memory/1248-25-0x00000000775F1000-0x00000000775F2000-memory.dmp

        Filesize

        4KB

      • memory/1248-24-0x00000000000F0000-0x00000000000F6000-memory.dmp

        Filesize

        24KB

      • memory/1332-26-0x0000000000150000-0x0000000000156000-memory.dmp

        Filesize

        24KB

      • memory/1332-21-0x0000000000150000-0x0000000000156000-memory.dmp

        Filesize

        24KB

      • memory/1380-23-0x0000000002460000-0x0000000002466000-memory.dmp

        Filesize

        24KB

      • memory/1380-10-0x00000000775F1000-0x00000000775F2000-memory.dmp

        Filesize

        4KB

      • memory/1380-5-0x00000000024B0000-0x00000000024B6000-memory.dmp

        Filesize

        24KB

      • memory/1380-27-0x0000000002460000-0x0000000002466000-memory.dmp

        Filesize

        24KB

      • memory/1380-1-0x00000000024B0000-0x00000000024B6000-memory.dmp

        Filesize

        24KB

      • memory/2848-12-0x0000000001C80000-0x0000000002680000-memory.dmp

        Filesize

        10.0MB

      • memory/2848-0-0x0000000000020000-0x0000000000021000-memory.dmp

        Filesize

        4KB

      • memory/2848-11-0x0000000000400000-0x0000000000417000-memory.dmp

        Filesize

        92KB

      • memory/2848-2-0x0000000001C80000-0x0000000002680000-memory.dmp

        Filesize

        10.0MB