tinba | 4dcd825ee4acb659b1aa32f46f7fc7e3268b22c903570a81dfa9691a6b08b297

Analysis

max time kernel
152s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
18/04/2024, 02:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f71a7e2dc210ae9da8ba7178e78712df_JaffaCakes118.exe
Size 96KB
Sample240418-da5b7sha67
SHA256 4dcd825ee4acb659b1aa32f46f7fc7e3268b22c903570a81dfa9691a6b08b297
MD5 f71a7e2dc210ae9da8ba7178e78712df
SHA1 356f7b879a486c4edd53eab51cb74f9ebfe9eaa5
SHA512 5f4f47a4130a31b58ff486073e497acb18375786554e7b85a07de6662e2d67d9d0b8f9dddabd8f06852d00153502d835c0cdfdadb6f38ab91cccd196e67f63a9
SSDEEP 1536:hiLOvRmmQegJW3aOgBbmAQ256/ZrwWnwqjhurmKFct:hiyvRmQKTLs/ZrwWJjAqGct
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

tinba banker persistence trojan

Malware Config

Signatures

Tinba / TinyBanker
Banking trojan which uses packet sniffing to steal data.
trojan banker tinba

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\4D594427 = "C:\\Users\\Admin\\AppData\\Roaming\\4D594427\\bin.exe"	winver.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3512	Explorer.EXE
Token: SeCreatePagefilePrivilege	3512	Explorer.EXE
Token: SeShutdownPrivilege	4080	RuntimeBroker.exe
Token: SeShutdownPrivilege	4080	RuntimeBroker.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
416	winver.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4108 wrote to memory of 416	4108	f71a7e2dc210ae9da8ba7178e78712df_JaffaCakes118.exe	91
PID 4108 wrote to memory of 416	4108	f71a7e2dc210ae9da8ba7178e78712df_JaffaCakes118.exe	91
PID 4108 wrote to memory of 416	4108	f71a7e2dc210ae9da8ba7178e78712df_JaffaCakes118.exe	91
PID 4108 wrote to memory of 416	4108	f71a7e2dc210ae9da8ba7178e78712df_JaffaCakes118.exe	91
PID 416 wrote to memory of 3512	416	winver.exe	57
PID 416 wrote to memory of 2420	416	winver.exe	42
PID 416 wrote to memory of 2428	416	winver.exe	43
PID 416 wrote to memory of 2524	416	winver.exe	44
PID 416 wrote to memory of 3512	416	winver.exe	57
PID 416 wrote to memory of 3640	416	winver.exe	58
PID 416 wrote to memory of 3856	416	winver.exe	59
PID 416 wrote to memory of 4000	416	winver.exe	60
PID 416 wrote to memory of 4080	416	winver.exe	61
PID 416 wrote to memory of 3132	416	winver.exe	62
PID 416 wrote to memory of 4220	416	winver.exe	63
PID 416 wrote to memory of 392	416	winver.exe	65
PID 416 wrote to memory of 4516	416	winver.exe	75
PID 416 wrote to memory of 3916	416	winver.exe	77
PID 416 wrote to memory of 2936	416	winver.exe	78
PID 416 wrote to memory of 3624	416	winver.exe	79
PID 416 wrote to memory of 2480	416	winver.exe	80
PID 416 wrote to memory of 4464	416	winver.exe	81
PID 416 wrote to memory of 1056	416	winver.exe	83
PID 416 wrote to memory of 2340	416	winver.exe	84
PID 3916 wrote to memory of 4856	3916	msedge.exe	103
PID 3916 wrote to memory of 4856	3916	msedge.exe	103
PID 3916 wrote to memory of 4856	3916	msedge.exe	103
PID 3916 wrote to memory of 4856	3916	msedge.exe	103
PID 3916 wrote to memory of 4856	3916	msedge.exe	103
PID 3916 wrote to memory of 4856	3916	msedge.exe	103
PID 3916 wrote to memory of 4856	3916	msedge.exe	103
PID 3916 wrote to memory of 4856	3916	msedge.exe	103
PID 3916 wrote to memory of 4856	3916	msedge.exe	103
PID 3916 wrote to memory of 4856	3916	msedge.exe	103
PID 3916 wrote to memory of 4856	3916	msedge.exe	103
PID 3916 wrote to memory of 4856	3916	msedge.exe	103
PID 3916 wrote to memory of 4856	3916	msedge.exe	103
PID 3916 wrote to memory of 4856	3916	msedge.exe	103
PID 3916 wrote to memory of 4856	3916	msedge.exe	103
PID 3916 wrote to memory of 4856	3916	msedge.exe	103
PID 3916 wrote to memory of 4856	3916	msedge.exe	103
PID 3916 wrote to memory of 4856	3916	msedge.exe	103
PID 3916 wrote to memory of 4856	3916	msedge.exe	103
PID 3916 wrote to memory of 4856	3916	msedge.exe	103
PID 3916 wrote to memory of 4856	3916	msedge.exe	103
PID 3916 wrote to memory of 4856	3916	msedge.exe	103
PID 3916 wrote to memory of 4856	3916	msedge.exe	103
PID 3916 wrote to memory of 4856	3916	msedge.exe	103
PID 3916 wrote to memory of 4856	3916	msedge.exe	103
PID 3916 wrote to memory of 4856	3916	msedge.exe	103
PID 3916 wrote to memory of 4856	3916	msedge.exe	103
PID 3916 wrote to memory of 4856	3916	msedge.exe	103
PID 3916 wrote to memory of 4856	3916	msedge.exe	103
PID 3916 wrote to memory of 4856	3916	msedge.exe	103
PID 3916 wrote to memory of 4856	3916	msedge.exe	103
PID 3916 wrote to memory of 4856	3916	msedge.exe	103
PID 3916 wrote to memory of 4856	3916	msedge.exe	103
PID 3916 wrote to memory of 4856	3916	msedge.exe	103
PID 3916 wrote to memory of 4856	3916	msedge.exe	103
PID 3916 wrote to memory of 4856	3916	msedge.exe	103
PID 3916 wrote to memory of 4856	3916	msedge.exe	103
PID 3916 wrote to memory of 4856	3916	msedge.exe	103
PID 3916 wrote to memory of 4856	3916	msedge.exe	103
PID 3916 wrote to memory of 4856	3916	msedge.exe	103

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2420

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2428

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2524

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3512
- C:\Users\Admin\AppData\Local\Temp\f71a7e2dc210ae9da8ba7178e78712df_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\f71a7e2dc210ae9da8ba7178e78712df_JaffaCakes118.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4108
- - C:\Windows\SysWOW64\winver.exe
    winver
    3⤵
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:416

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3640

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3856

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:4000

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4080

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3132

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4220

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:392

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
1⤵
PID:4516

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
1⤵
- Suspicious use of WriteProcessMemory
PID:3916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=122.0.2365.52 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b4,0x7ff96bf82e98,0x7ff96bf82ea4,0x7ff96bf82eb0
  2⤵
  PID:2936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2272 --field-trial-handle=2276,i,5697607538120380977,9987005253899555344,262144 --variations-seed-version /prefetch:2
  2⤵
  PID:3624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=2312 --field-trial-handle=2276,i,5697607538120380977,9987005253899555344,262144 --variations-seed-version /prefetch:3
  2⤵
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=1952 --field-trial-handle=2276,i,5697607538120380977,9987005253899555344,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --mojo-platform-channel-handle=5452 --field-trial-handle=2276,i,5697607538120380977,9987005253899555344,262144 --variations-seed-version /prefetch:1
  2⤵
  PID:1056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --mojo-platform-channel-handle=5596 --field-trial-handle=2276,i,5697607538120380977,9987005253899555344,262144 --variations-seed-version /prefetch:1
  2⤵
  PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1408 --field-trial-handle=2276,i,5697607538120380977,9987005253899555344,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:4856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/392-32-0x0000000000650000-0x0000000000656000-memory.dmp

Download

memory/392-28-0x0000000000650000-0x0000000000656000-memory.dmp

Download

memory/416-11-0x0000000000880000-0x0000000000886000-memory.dmp

Download

memory/416-5-0x0000000000880000-0x0000000000886000-memory.dmp

Download

memory/416-7-0x0000000077AF2000-0x0000000077AF3000-memory.dmp

Download

memory/416-3-0x0000000000460000-0x0000000000472000-memory.dmp

Download

memory/416-35-0x0000000000880000-0x0000000000886000-memory.dmp

Download

memory/2420-15-0x0000000000190000-0x0000000000196000-memory.dmp

Download

memory/2428-17-0x0000000000220000-0x0000000000226000-memory.dmp

Download

memory/2428-13-0x0000000000220000-0x0000000000226000-memory.dmp

Download

memory/2524-14-0x0000000000150000-0x0000000000156000-memory.dmp

Download

memory/2524-19-0x0000000000150000-0x0000000000156000-memory.dmp

Download

memory/3132-26-0x0000000000A70000-0x0000000000A76000-memory.dmp

Download

memory/3512-16-0x0000000000EE0000-0x0000000000EE6000-memory.dmp

Download

memory/3512-4-0x0000000000EA0000-0x0000000000EA6000-memory.dmp

Download

memory/3512-21-0x0000000000EE0000-0x0000000000EE6000-memory.dmp

Download

memory/3512-2-0x0000000000EA0000-0x0000000000EA6000-memory.dmp

Download

memory/3512-6-0x00007FF98FF6D000-0x00007FF98FF6E000-memory.dmp

Download

memory/3640-18-0x0000000000480000-0x0000000000486000-memory.dmp

Download

memory/3640-23-0x0000000000480000-0x0000000000486000-memory.dmp

Download

memory/3856-20-0x0000000000E30000-0x0000000000E36000-memory.dmp

Download

memory/4000-22-0x0000000000D00000-0x0000000000D06000-memory.dmp

Download

memory/4000-25-0x0000000000D00000-0x0000000000D06000-memory.dmp

Download

memory/4080-24-0x0000000000CA0000-0x0000000000CA6000-memory.dmp

Download

memory/4080-30-0x0000000000CA0000-0x0000000000CA6000-memory.dmp

Download

memory/4108-0-0x0000000002160000-0x0000000002161000-memory.dmp

Download

memory/4108-9-0x00000000021F0000-0x0000000002BF0000-memory.dmp

Download

memory/4108-8-0x0000000000400000-0x000000000041A000-memory.dmp

Download

memory/4108-1-0x00000000021F0000-0x0000000002BF0000-memory.dmp

Download

memory/4220-27-0x0000000000440000-0x0000000000446000-memory.dmp

Download

memory/4220-31-0x0000000000440000-0x0000000000446000-memory.dmp

Download

memory/4516-29-0x0000000000F20000-0x0000000000F26000-memory.dmp

Download

memory/4516-33-0x0000000000F20000-0x0000000000F26000-memory.dmp

Download