tinba | 670fde62e11661f47bdb16a32d9411eff60c3b64e8018d4d08297eb2e01c8464

Analysis

max time kernel
151s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12/04/2024, 03:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
eefe86d83a9336ffa3ba9723f1cc7126_JaffaCakes118.exe
Size 89KB
Sample240412-dpvrbagf2t
SHA256 670fde62e11661f47bdb16a32d9411eff60c3b64e8018d4d08297eb2e01c8464
MD5 eefe86d83a9336ffa3ba9723f1cc7126
SHA1 95c7519531f057fa43c5833ec1fb236ea33e1206
SHA512 4f258705f0ccae02aced3a81777ca04a4112fa11aa2f8e98e1953cd9ba67ed1857bc4141b53d3fc7241f7aaef6987d08508f74849a2908baf2d4710d1b72a74e
SSDEEP 1536:5L+mFM2HXKZgiwIksu+XM5/HtAQ9JB9p03:d+4MOIkLZJNAQ9JBjq
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

tinba banker persistence trojan upx

Malware Config

Signatures

Tinba / TinyBanker
Banking trojan which uses packet sniffing to steal data.
trojan banker tinba

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3784-0-0x0000000000400000-0x0000000000418000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CF4EB6DF = "C:\\Users\\Admin\\AppData\\Roaming\\CF4EB6DF\\bin.exe"	winver.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5032	winver.exe
5032	winver.exe
5032	winver.exe
5032	winver.exe
5032	winver.exe
5032	winver.exe
5032	winver.exe
5032	winver.exe
5032	winver.exe
5032	winver.exe
5032	winver.exe
5032	winver.exe
5032	winver.exe
5032	winver.exe
5032	winver.exe
5032	winver.exe
5032	winver.exe
5032	winver.exe
5032	winver.exe
5032	winver.exe
5032	winver.exe
5032	winver.exe
5032	winver.exe
5032	winver.exe
5032	winver.exe
5032	winver.exe
5032	winver.exe
5032	winver.exe
5032	winver.exe
5032	winver.exe
5032	winver.exe
5032	winver.exe
5032	winver.exe
5032	winver.exe
5032	winver.exe
5032	winver.exe
5032	winver.exe
5032	winver.exe
5032	winver.exe
5032	winver.exe
5032	winver.exe
5032	winver.exe
5032	winver.exe
5032	winver.exe
5032	winver.exe
5032	winver.exe
5032	winver.exe
5032	winver.exe
5032	winver.exe
5032	winver.exe
5032	winver.exe
5032	winver.exe
5032	winver.exe
5032	winver.exe
5032	winver.exe
5032	winver.exe
5032	winver.exe
5032	winver.exe
5032	winver.exe
5032	winver.exe
5032	winver.exe
5032	winver.exe
5032	winver.exe
5032	winver.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3240	Explorer.EXE
Token: SeCreatePagefilePrivilege	3240	Explorer.EXE
Token: SeShutdownPrivilege	4000	RuntimeBroker.exe
Token: SeShutdownPrivilege	4000	RuntimeBroker.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5032	winver.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3784 wrote to memory of 5032	3784	eefe86d83a9336ffa3ba9723f1cc7126_JaffaCakes118.exe	92
PID 3784 wrote to memory of 5032	3784	eefe86d83a9336ffa3ba9723f1cc7126_JaffaCakes118.exe	92
PID 3784 wrote to memory of 5032	3784	eefe86d83a9336ffa3ba9723f1cc7126_JaffaCakes118.exe	92
PID 3784 wrote to memory of 5032	3784	eefe86d83a9336ffa3ba9723f1cc7126_JaffaCakes118.exe	92
PID 5032 wrote to memory of 3240	5032	winver.exe	57
PID 5032 wrote to memory of 2432	5032	winver.exe	42
PID 5032 wrote to memory of 2508	5032	winver.exe	45
PID 5032 wrote to memory of 2668	5032	winver.exe	48
PID 5032 wrote to memory of 3240	5032	winver.exe	57
PID 5032 wrote to memory of 3584	5032	winver.exe	58
PID 5032 wrote to memory of 3776	5032	winver.exe	59
PID 5032 wrote to memory of 3932	5032	winver.exe	60
PID 5032 wrote to memory of 4000	5032	winver.exe	61
PID 5032 wrote to memory of 4088	5032	winver.exe	62
PID 5032 wrote to memory of 4148	5032	winver.exe	63
PID 5032 wrote to memory of 4556	5032	winver.exe	65
PID 5032 wrote to memory of 5096	5032	winver.exe	75
PID 5032 wrote to memory of 1360	5032	winver.exe	77
PID 5032 wrote to memory of 4960	5032	winver.exe	78
PID 5032 wrote to memory of 2496	5032	winver.exe	79
PID 5032 wrote to memory of 1900	5032	winver.exe	80
PID 5032 wrote to memory of 1940	5032	winver.exe	81
PID 5032 wrote to memory of 816	5032	winver.exe	83
PID 5032 wrote to memory of 3904	5032	winver.exe	84
PID 5032 wrote to memory of 3560	5032	winver.exe	99
PID 1360 wrote to memory of 4404	1360	msedge.exe	104
PID 1360 wrote to memory of 4404	1360	msedge.exe	104
PID 1360 wrote to memory of 4404	1360	msedge.exe	104
PID 1360 wrote to memory of 4404	1360	msedge.exe	104
PID 1360 wrote to memory of 4404	1360	msedge.exe	104
PID 1360 wrote to memory of 4404	1360	msedge.exe	104
PID 1360 wrote to memory of 4404	1360	msedge.exe	104
PID 1360 wrote to memory of 4404	1360	msedge.exe	104
PID 1360 wrote to memory of 4404	1360	msedge.exe	104
PID 1360 wrote to memory of 4404	1360	msedge.exe	104
PID 1360 wrote to memory of 4404	1360	msedge.exe	104
PID 1360 wrote to memory of 4404	1360	msedge.exe	104
PID 1360 wrote to memory of 4404	1360	msedge.exe	104
PID 1360 wrote to memory of 4404	1360	msedge.exe	104
PID 1360 wrote to memory of 4404	1360	msedge.exe	104
PID 1360 wrote to memory of 4404	1360	msedge.exe	104
PID 1360 wrote to memory of 4404	1360	msedge.exe	104
PID 1360 wrote to memory of 4404	1360	msedge.exe	104
PID 1360 wrote to memory of 4404	1360	msedge.exe	104
PID 1360 wrote to memory of 4404	1360	msedge.exe	104
PID 1360 wrote to memory of 4404	1360	msedge.exe	104
PID 1360 wrote to memory of 4404	1360	msedge.exe	104
PID 1360 wrote to memory of 4404	1360	msedge.exe	104
PID 1360 wrote to memory of 4404	1360	msedge.exe	104
PID 1360 wrote to memory of 4404	1360	msedge.exe	104
PID 1360 wrote to memory of 4404	1360	msedge.exe	104
PID 1360 wrote to memory of 4404	1360	msedge.exe	104
PID 1360 wrote to memory of 4404	1360	msedge.exe	104
PID 1360 wrote to memory of 4404	1360	msedge.exe	104
PID 1360 wrote to memory of 4404	1360	msedge.exe	104
PID 1360 wrote to memory of 4404	1360	msedge.exe	104
PID 1360 wrote to memory of 4404	1360	msedge.exe	104
PID 1360 wrote to memory of 4404	1360	msedge.exe	104
PID 1360 wrote to memory of 4404	1360	msedge.exe	104
PID 1360 wrote to memory of 4404	1360	msedge.exe	104
PID 1360 wrote to memory of 4404	1360	msedge.exe	104
PID 1360 wrote to memory of 4404	1360	msedge.exe	104
PID 1360 wrote to memory of 4404	1360	msedge.exe	104
PID 1360 wrote to memory of 4404	1360	msedge.exe	104

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2432

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2508

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2668

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3240
- C:\Users\Admin\AppData\Local\Temp\eefe86d83a9336ffa3ba9723f1cc7126_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\eefe86d83a9336ffa3ba9723f1cc7126_JaffaCakes118.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3784
- - C:\Windows\SysWOW64\winver.exe
    winver
    3⤵
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5032

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3584

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3776
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3776 -s 940
  2⤵
  PID:3560

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3932

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4000

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:4088

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4148

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4556

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
1⤵
PID:5096

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
1⤵
- Suspicious use of WriteProcessMemory
PID:1360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=122.0.2365.52 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b4,0x7fff9f0a2e98,0x7fff9f0a2ea4,0x7fff9f0a2eb0
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2352 --field-trial-handle=2356,i,13261194862334667799,7441241219475888176,262144 --variations-seed-version /prefetch:2
  2⤵
  PID:2496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=2388 --field-trial-handle=2356,i,13261194862334667799,7441241219475888176,262144 --variations-seed-version /prefetch:3
  2⤵
  PID:1900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=2344 --field-trial-handle=2356,i,13261194862334667799,7441241219475888176,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:1940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --mojo-platform-channel-handle=5340 --field-trial-handle=2356,i,13261194862334667799,7441241219475888176,262144 --variations-seed-version /prefetch:1
  2⤵
  PID:816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --mojo-platform-channel-handle=5468 --field-trial-handle=2356,i,13261194862334667799,7441241219475888176,262144 --variations-seed-version /prefetch:1
  2⤵
  PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4056 --field-trial-handle=2356,i,13261194862334667799,7441241219475888176,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:4404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 a96fa03a7da2a585127477483cca9a17c42420d71c6aba1e958b9617dd606606
MD5 7eced896f52e92771c022d6cec8843d6
SHA1 e7564ca2110104eec0caf08b75c9dc1619982fb5
SHA512 136cfaaf92c9c425c140da89aace9d2f7c995b918a67ea33db0245a5b2049b3ea05f179cd009d0b7e32dd027aa5296cb5aaa44eed6830d070990e22fdef013ad
MD5 SHA1 SHA512

Submit Download

memory/2432-15-0x0000000000F00000-0x0000000000F06000-memory.dmp

Download

memory/2508-13-0x0000000000D70000-0x0000000000D76000-memory.dmp

Download

memory/2508-17-0x0000000000D70000-0x0000000000D76000-memory.dmp

Download

memory/2668-14-0x00000000008B0000-0x00000000008B6000-memory.dmp

Download

memory/2668-20-0x00000000008B0000-0x00000000008B6000-memory.dmp

Download

memory/3240-16-0x0000000000D40000-0x0000000000D46000-memory.dmp

Download

memory/3240-6-0x0000000000D20000-0x0000000000D26000-memory.dmp

Download

memory/3240-7-0x00007FFFC4D0D000-0x00007FFFC4D0E000-memory.dmp

Download

memory/3240-21-0x0000000000D40000-0x0000000000D46000-memory.dmp

Download

memory/3584-23-0x0000000000B20000-0x0000000000B26000-memory.dmp

Download

memory/3584-18-0x0000000000B20000-0x0000000000B26000-memory.dmp

Download

memory/3776-19-0x0000000000E80000-0x0000000000E86000-memory.dmp

Download

memory/3784-9-0x0000000002340000-0x0000000002D40000-memory.dmp

Download

memory/3784-2-0x0000000002340000-0x0000000002D40000-memory.dmp

Download

memory/3784-0-0x0000000000400000-0x0000000000418000-memory.dmp

Download

memory/3784-8-0x0000000000400000-0x0000000000418000-memory.dmp

Download

memory/3784-1-0x0000000002160000-0x0000000002161000-memory.dmp

Download

memory/3932-22-0x0000000000DD0000-0x0000000000DD6000-memory.dmp

Download

memory/3932-25-0x00007FFFC4D0D000-0x00007FFFC4D0E000-memory.dmp

Download

memory/3932-27-0x0000000000DD0000-0x0000000000DD6000-memory.dmp

Download

memory/4000-24-0x0000000000C00000-0x0000000000C06000-memory.dmp

Download

memory/4000-26-0x0000000000C00000-0x0000000000C06000-memory.dmp

Download

memory/4088-28-0x00000000002F0000-0x00000000002F6000-memory.dmp

Download

memory/4148-29-0x0000000000B30000-0x0000000000B36000-memory.dmp

Download

memory/4148-32-0x0000000000B30000-0x0000000000B36000-memory.dmp

Download

memory/4556-30-0x0000000000310000-0x0000000000316000-memory.dmp

Download

memory/4556-33-0x0000000000310000-0x0000000000316000-memory.dmp

Download

memory/5032-3-0x00000000003B0000-0x00000000003B6000-memory.dmp

Download

memory/5032-5-0x0000000077DE2000-0x0000000077DE3000-memory.dmp

Download

memory/5032-34-0x00000000003B0000-0x00000000003B6000-memory.dmp

Download

memory/5032-11-0x00000000003B0000-0x00000000003B6000-memory.dmp

Download

memory/5096-31-0x0000000000EA0000-0x0000000000EA6000-memory.dmp

Download

memory/5096-35-0x0000000000EA0000-0x0000000000EA6000-memory.dmp

Download