Analysis
- max time kernel
7s - max time network
14s - platform
windows10-2004_x64 - resource
win10v2004-20240319-en - resource tags
- submitted
11/04/2024, 04:45
General
- Target ecb1d71154d2cb456405bf2cd4e2fdf3_JaffaCakes118.exe
- Size 160KB
- Sample240411-fdj7jscf82
- SHA256 3e9c84a3c6313b7c8bf14b148b5cfe8888588065052c36196b289a61df0dc020
Malware Config
Signatures
- Tinba / TinyBanker
Banking trojan which uses packet sniffing to steal data.
- UPX packed file 1 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\ecb1d71154d2cb456405bf2cd4e2fdf3_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ecb1d71154d2cb456405bf2cd4e2fdf3_JaffaCakes118.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\winver.exewinver3⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2540-17-0x0000000000110000-0x0000000000116000-memory.dmp
memory/2596-14-0x00000000009F0000-0x00000000009F6000-memory.dmp
memory/2596-19-0x00000000009F0000-0x00000000009F6000-memory.dmp
memory/2812-15-0x0000000000350000-0x0000000000356000-memory.dmp
memory/2900-5-0x0000000077872000-0x0000000077873000-memory.dmp
memory/2900-7-0x0000000000F60000-0x0000000000F66000-memory.dmp
memory/3440-2-0x0000000001000000-0x0000000001006000-memory.dmp
memory/3440-3-0x0000000001000000-0x0000000001006000-memory.dmp
memory/3440-6-0x00007FFA7FA0D000-0x00007FFA7FA0E000-memory.dmp
memory/3440-10-0x00007FFA7FBA0000-0x00007FFA7FBA1000-memory.dmp
memory/3668-18-0x0000000000AE0000-0x0000000000AE6000-memory.dmp
memory/4472-4-0x0000000002200000-0x0000000002C00000-memory.dmp
memory/4472-9-0x0000000002200000-0x0000000002C00000-memory.dmp
memory/4472-8-0x0000000000400000-0x0000000000428000-memory.dmp
memory/4472-0-0x0000000000400000-0x0000000000428000-memory.dmp
memory/4472-1-0x0000000000470000-0x0000000000471000-memory.dmp