Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05-04-2024 05:43

General

  • Target

    cc65ec42f08ba47ae4c564f7134ff6f5_JaffaCakes118.exe

  • Size

    46KB

  • MD5

    cc65ec42f08ba47ae4c564f7134ff6f5

  • SHA1

    f72eb49f1f083ac4968e1229a958cb3852cdfcb0

  • SHA256

    6d67a1c261a3a45f669828fece9bb9e271b7a667be9ae623dc6d870e056a0179

  • SHA512

    2a83d7fc26015e6e57e5f4cb0d368757c57162bfa3d56f19576db0ccafeb8d2be8fdf2b4a1236e1961bc0d6444c97131cdb63a4f1c3bd8f1b575590a9fcb04d9

  • SSDEEP

    768:qtwyMe0Jy8xwd117mrlI9m/xGuv4V7RMEnqt9jn2ACH3hLZ2HwCLlH:qtwyedxwr1qUMv4VV6j2A83hVY

Malware Config

Signatures

  • Tinba / TinyBanker

    Banking trojan which uses packet sniffing to steal data.

  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
      PID:2512
    • C:\Windows\Explorer.EXE
      C:\Windows\Explorer.EXE
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of UnmapMainImage
      PID:3508
      • C:\Users\Admin\AppData\Local\Temp\cc65ec42f08ba47ae4c564f7134ff6f5_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\cc65ec42f08ba47ae4c564f7134ff6f5_JaffaCakes118.exe"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1684
        • C:\Windows\SysWOW64\winver.exe
          winver
          3⤵
          • Adds Run key to start application
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:1244
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 1244 -s 352
            4⤵
            • Program crash
            PID:2636
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1244 -ip 1244
      1⤵
        PID:4552

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/1244-8-0x0000000001220000-0x0000000001226000-memory.dmp

        Filesize

        24KB

      • memory/1244-5-0x00000000776D2000-0x00000000776D3000-memory.dmp

        Filesize

        4KB

      • memory/1244-15-0x0000000001220000-0x0000000001226000-memory.dmp

        Filesize

        24KB

      • memory/1684-1-0x00000000005A0000-0x00000000005A1000-memory.dmp

        Filesize

        4KB

      • memory/1684-10-0x0000000000400000-0x000000000041A000-memory.dmp

        Filesize

        104KB

      • memory/1684-0-0x0000000000400000-0x000000000041A000-memory.dmp

        Filesize

        104KB

      • memory/1684-3-0x0000000002760000-0x0000000003160000-memory.dmp

        Filesize

        10.0MB

      • memory/2512-14-0x0000000000880000-0x0000000000886000-memory.dmp

        Filesize

        24KB

      • memory/3508-6-0x00007FFD1034D000-0x00007FFD1034E000-memory.dmp

        Filesize

        4KB

      • memory/3508-9-0x00007FFD104E0000-0x00007FFD104E1000-memory.dmp

        Filesize

        4KB

      • memory/3508-7-0x00007FFD1034C000-0x00007FFD1034D000-memory.dmp

        Filesize

        4KB

      • memory/3508-2-0x0000000000B50000-0x0000000000B56000-memory.dmp

        Filesize

        24KB

      • memory/3508-4-0x0000000000B50000-0x0000000000B56000-memory.dmp

        Filesize

        24KB