tinba | 685dab2ff06839a9585ce8b0aede037364a4ac1c284d4aa1bbc3b462d69343cc

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
15-04-2024 20:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f1e64d25c6a87b83b62fe6513100b24c_JaffaCakes118.exe
Size

160KB
MD5

f1e64d25c6a87b83b62fe6513100b24c
SHA1

b908f972ea5a81e9976b65c14b134c700cb1f4fb
SHA256

685dab2ff06839a9585ce8b0aede037364a4ac1c284d4aa1bbc3b462d69343cc
SHA512

8915978e9b09326cbe2a3145cc9662c06c360c5f46714e46c47784009a0c8488ac8104880fc8353929a3c39412c4a434e560ef308075e119f19b74870470bd06
SSDEEP

1536:yEY+mFM2HXKZgi0Iksu+XM5/HtAQ9J6xph:5Y+4MiIkLZJNAQ9J6v

Score

10^/10

tinba banker persistence trojan upx

Malware Config

Signatures

Tinba / TinyBanker
Banking trojan which uses packet sniffing to steal data.
trojan banker tinba

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/640-0-0x0000000000400000-0x0000000000428000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

winver.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\D49FFAB7 = "C:\\Users\\Admin\\AppData\\Roaming\\D49FFAB7\\bin.exe"	winver.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

5092 4484 WerFault.exe winver.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

winver.exe

pid process

4484 winver.exe
4484 winver.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Explorer.EXE

description pid process

Token: SeShutdownPrivilege 3408 Explorer.EXE
Token: SeCreatePagefilePrivilege 3408 Explorer.EXE
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

winver.exe

pid process

4484 winver.exe
Suspicious use of UnmapMainImage 1 IoCs

Processes:

Explorer.EXE

pid process

3408 Explorer.EXE

pid	pid_target	process	target process
5092	4484	WerFault.exe	winver.exe

pid	process
4484	winver.exe
4484	winver.exe

description	pid	process
Token: SeShutdownPrivilege	3408	Explorer.EXE
Token: SeCreatePagefilePrivilege	3408	Explorer.EXE

pid	process
4484	winver.exe

pid	process
3408	Explorer.EXE

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

f1e64d25c6a87b83b62fe6513100b24c_JaffaCakes118.exewinver.exe

description	pid	process	target process
PID 640 wrote to memory of 4484	640	f1e64d25c6a87b83b62fe6513100b24c_JaffaCakes118.exe	winver.exe
PID 640 wrote to memory of 4484	640	f1e64d25c6a87b83b62fe6513100b24c_JaffaCakes118.exe	winver.exe
PID 640 wrote to memory of 4484	640	f1e64d25c6a87b83b62fe6513100b24c_JaffaCakes118.exe	winver.exe
PID 640 wrote to memory of 4484	640	f1e64d25c6a87b83b62fe6513100b24c_JaffaCakes118.exe	winver.exe
PID 4484 wrote to memory of 3408	4484	winver.exe	Explorer.EXE
PID 4484 wrote to memory of 3028	4484	winver.exe	sihost.exe

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:3028

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
PID:3408

C:\Users\Admin\AppData\Local\Temp\f1e64d25c6a87b83b62fe6513100b24c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f1e64d25c6a87b83b62fe6513100b24c_JaffaCakes118.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:640

C:\Windows\SysWOW64\winver.exe
winver
3⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4484 -s 352
4⤵
- Program crash
PID:5092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4484 -ip 4484
1⤵
PID:4528

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/640-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/640-1-0x00000000004C0000-0x00000000004C1000-memory.dmp

Filesize
4KB

Download
memory/640-4-0x00000000020E0000-0x0000000002AE0000-memory.dmp

Filesize
10.0MB

Download
memory/640-10-0x00000000020E0000-0x0000000002AE0000-memory.dmp

Filesize
10.0MB

Download
memory/640-9-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3028-14-0x0000000000880000-0x0000000000886000-memory.dmp

Filesize
24KB

Download
memory/3408-3-0x0000000000E80000-0x0000000000E86000-memory.dmp

Filesize
24KB

Download
memory/3408-2-0x0000000000E80000-0x0000000000E86000-memory.dmp

Filesize
24KB

Download
memory/3408-8-0x00007FFE69C40000-0x00007FFE69C41000-memory.dmp

Filesize
4KB

Download
memory/3408-6-0x00007FFE69AAD000-0x00007FFE69AAE000-memory.dmp

Filesize
4KB

Download
memory/4484-5-0x00000000779F2000-0x00000000779F3000-memory.dmp

Filesize
4KB

Download
memory/4484-7-0x00000000029C0000-0x00000000029C6000-memory.dmp

Filesize
24KB

Download
memory/4484-15-0x00000000029C0000-0x00000000029C6000-memory.dmp

Filesize
24KB

Download