Analysis

  • max time kernel
    134s
  • max time network
    94s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05-04-2024 00:40

General

  • Target

    c627515de0166a6526f4ad9f5a7be0da_JaffaCakes118.exe

  • Size

    88KB

  • MD5

    c627515de0166a6526f4ad9f5a7be0da

  • SHA1

    1960b94da73b75bc5e8ad2860f454af17a846983

  • SHA256

    1302f1aff384aa2a421895552a96cb4eaa93b67c4746190cb93b2d0910ebacc6

  • SHA512

    4d5e7e0325ea905f6d48b4d56a202b9b752a705bb8fe57ed20902e6a39b36cb058b07b583a5c7362ac274049c4d7df4c722ea197fca4eae329699d0ae5c75e9e

  • SSDEEP

    1536:W5nfmIpxDWbUfd3aOPmxxEhvgCooXqRQqjh+rmKVsN:W5fvp12UFKcD/6jwqWsN

Malware Config

Signatures

  • Tinba / TinyBanker

    Banking trojan which uses packet sniffing to steal data.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
      PID:3020
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
      1⤵
        PID:3052
      • C:\Windows\Explorer.EXE
        C:\Windows\Explorer.EXE
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of UnmapMainImage
        PID:3452
        • C:\Users\Admin\AppData\Local\Temp\c627515de0166a6526f4ad9f5a7be0da_JaffaCakes118.exe
          "C:\Users\Admin\AppData\Local\Temp\c627515de0166a6526f4ad9f5a7be0da_JaffaCakes118.exe"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:1636
          • C:\Windows\SysWOW64\winver.exe
            winver
            3⤵
            • Adds Run key to start application
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of WriteProcessMemory
            PID:4452
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 356
              4⤵
              • Program crash
              PID:2196
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4452 -ip 4452
        1⤵
          PID:2496

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/1636-9-0x0000000000400000-0x0000000000417000-memory.dmp

          Filesize

          92KB

        • memory/1636-3-0x0000000002190000-0x0000000002B90000-memory.dmp

          Filesize

          10.0MB

        • memory/1636-0-0x0000000000590000-0x0000000000591000-memory.dmp

          Filesize

          4KB

        • memory/1636-10-0x0000000002190000-0x0000000002B90000-memory.dmp

          Filesize

          10.0MB

        • memory/3020-15-0x00000000002E0000-0x00000000002E6000-memory.dmp

          Filesize

          24KB

        • memory/3052-16-0x0000000000F70000-0x0000000000F76000-memory.dmp

          Filesize

          24KB

        • memory/3052-14-0x0000000000F70000-0x0000000000F76000-memory.dmp

          Filesize

          24KB

        • memory/3452-2-0x0000000000360000-0x0000000000366000-memory.dmp

          Filesize

          24KB

        • memory/3452-8-0x00007FFA0D860000-0x00007FFA0D861000-memory.dmp

          Filesize

          4KB

        • memory/3452-6-0x00007FFA0D6CD000-0x00007FFA0D6CE000-memory.dmp

          Filesize

          4KB

        • memory/3452-1-0x0000000000360000-0x0000000000366000-memory.dmp

          Filesize

          24KB

        • memory/4452-7-0x00000000004E0000-0x00000000004F2000-memory.dmp

          Filesize

          72KB

        • memory/4452-5-0x00000000777A2000-0x00000000777A3000-memory.dmp

          Filesize

          4KB

        • memory/4452-4-0x0000000002D40000-0x0000000002D46000-memory.dmp

          Filesize

          24KB

        • memory/4452-17-0x0000000002D40000-0x0000000002D46000-memory.dmp

          Filesize

          24KB