tinba | 4dcd825ee4acb659b1aa32f46f7fc7e3268b22c903570a81dfa9691a6b08b297

General

Target

f71a7e2dc210ae9da8ba7178e78712df_JaffaCakes118.exe
Size

96KB
MD5

f71a7e2dc210ae9da8ba7178e78712df
SHA1

356f7b879a486c4edd53eab51cb74f9ebfe9eaa5
SHA256

4dcd825ee4acb659b1aa32f46f7fc7e3268b22c903570a81dfa9691a6b08b297
SHA512

5f4f47a4130a31b58ff486073e497acb18375786554e7b85a07de6662e2d67d9d0b8f9dddabd8f06852d00153502d835c0cdfdadb6f38ab91cccd196e67f63a9
SSDEEP

1536:hiLOvRmmQegJW3aOgBbmAQ256/ZrwWnwqjhurmKFct:hiyvRmQKTLs/ZrwWJjAqGct

Score

10^/10

tinba banker persistence trojan

Malware Config

Signatures

Tinba / TinyBanker
Banking trojan which uses packet sniffing to steal data.
trojan banker tinba

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

winver.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\4D594427 = "C:\\Users\\Admin\\AppData\\Roaming\\4D594427\\bin.exe"	winver.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

winver.exe

pid	process
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe
416	winver.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

Explorer.EXERuntimeBroker.exe

description	pid	process
Token: SeShutdownPrivilege	3512	Explorer.EXE
Token: SeCreatePagefilePrivilege	3512	Explorer.EXE
Token: SeShutdownPrivilege	4080	RuntimeBroker.exe
Token: SeShutdownPrivilege	4080	RuntimeBroker.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

winver.exe

pid process

416 winver.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

f71a7e2dc210ae9da8ba7178e78712df_JaffaCakes118.exewinver.exemsedge.exe

description	pid	process	target process
PID 4108 wrote to memory of 416	4108	f71a7e2dc210ae9da8ba7178e78712df_JaffaCakes118.exe	winver.exe
PID 4108 wrote to memory of 416	4108	f71a7e2dc210ae9da8ba7178e78712df_JaffaCakes118.exe	winver.exe
PID 4108 wrote to memory of 416	4108	f71a7e2dc210ae9da8ba7178e78712df_JaffaCakes118.exe	winver.exe
PID 4108 wrote to memory of 416	4108	f71a7e2dc210ae9da8ba7178e78712df_JaffaCakes118.exe	winver.exe
PID 416 wrote to memory of 3512	416	winver.exe	Explorer.EXE
PID 416 wrote to memory of 2420	416	winver.exe	sihost.exe
PID 416 wrote to memory of 2428	416	winver.exe	svchost.exe
PID 416 wrote to memory of 2524	416	winver.exe	taskhostw.exe
PID 416 wrote to memory of 3512	416	winver.exe	Explorer.EXE
PID 416 wrote to memory of 3640	416	winver.exe	svchost.exe
PID 416 wrote to memory of 3856	416	winver.exe	DllHost.exe
PID 416 wrote to memory of 4000	416	winver.exe	StartMenuExperienceHost.exe
PID 416 wrote to memory of 4080	416	winver.exe	RuntimeBroker.exe
PID 416 wrote to memory of 3132	416	winver.exe	SearchApp.exe
PID 416 wrote to memory of 4220	416	winver.exe	RuntimeBroker.exe
PID 416 wrote to memory of 392	416	winver.exe	RuntimeBroker.exe
PID 416 wrote to memory of 4516	416	winver.exe	TextInputHost.exe
PID 416 wrote to memory of 3916	416	winver.exe	msedge.exe
PID 416 wrote to memory of 2936	416	winver.exe	msedge.exe
PID 416 wrote to memory of 3624	416	winver.exe	msedge.exe
PID 416 wrote to memory of 2480	416	winver.exe	msedge.exe
PID 416 wrote to memory of 4464	416	winver.exe	msedge.exe
PID 416 wrote to memory of 1056	416	winver.exe	msedge.exe
PID 416 wrote to memory of 2340	416	winver.exe	msedge.exe
PID 3916 wrote to memory of 4856	3916	msedge.exe	msedge.exe
PID 3916 wrote to memory of 4856	3916	msedge.exe	msedge.exe
PID 3916 wrote to memory of 4856	3916	msedge.exe	msedge.exe
PID 3916 wrote to memory of 4856	3916	msedge.exe	msedge.exe
PID 3916 wrote to memory of 4856	3916	msedge.exe	msedge.exe
PID 3916 wrote to memory of 4856	3916	msedge.exe	msedge.exe
PID 3916 wrote to memory of 4856	3916	msedge.exe	msedge.exe
PID 3916 wrote to memory of 4856	3916	msedge.exe	msedge.exe
PID 3916 wrote to memory of 4856	3916	msedge.exe	msedge.exe
PID 3916 wrote to memory of 4856	3916	msedge.exe	msedge.exe
PID 3916 wrote to memory of 4856	3916	msedge.exe	msedge.exe
PID 3916 wrote to memory of 4856	3916	msedge.exe	msedge.exe
PID 3916 wrote to memory of 4856	3916	msedge.exe	msedge.exe
PID 3916 wrote to memory of 4856	3916	msedge.exe	msedge.exe
PID 3916 wrote to memory of 4856	3916	msedge.exe	msedge.exe
PID 3916 wrote to memory of 4856	3916	msedge.exe	msedge.exe
PID 3916 wrote to memory of 4856	3916	msedge.exe	msedge.exe
PID 3916 wrote to memory of 4856	3916	msedge.exe	msedge.exe
PID 3916 wrote to memory of 4856	3916	msedge.exe	msedge.exe
PID 3916 wrote to memory of 4856	3916	msedge.exe	msedge.exe
PID 3916 wrote to memory of 4856	3916	msedge.exe	msedge.exe
PID 3916 wrote to memory of 4856	3916	msedge.exe	msedge.exe
PID 3916 wrote to memory of 4856	3916	msedge.exe	msedge.exe
PID 3916 wrote to memory of 4856	3916	msedge.exe	msedge.exe
PID 3916 wrote to memory of 4856	3916	msedge.exe	msedge.exe
PID 3916 wrote to memory of 4856	3916	msedge.exe	msedge.exe
PID 3916 wrote to memory of 4856	3916	msedge.exe	msedge.exe
PID 3916 wrote to memory of 4856	3916	msedge.exe	msedge.exe
PID 3916 wrote to memory of 4856	3916	msedge.exe	msedge.exe
PID 3916 wrote to memory of 4856	3916	msedge.exe	msedge.exe
PID 3916 wrote to memory of 4856	3916	msedge.exe	msedge.exe
PID 3916 wrote to memory of 4856	3916	msedge.exe	msedge.exe
PID 3916 wrote to memory of 4856	3916	msedge.exe	msedge.exe
PID 3916 wrote to memory of 4856	3916	msedge.exe	msedge.exe
PID 3916 wrote to memory of 4856	3916	msedge.exe	msedge.exe
PID 3916 wrote to memory of 4856	3916	msedge.exe	msedge.exe
PID 3916 wrote to memory of 4856	3916	msedge.exe	msedge.exe
PID 3916 wrote to memory of 4856	3916	msedge.exe	msedge.exe
PID 3916 wrote to memory of 4856	3916	msedge.exe	msedge.exe
PID 3916 wrote to memory of 4856	3916	msedge.exe	msedge.exe

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2420

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2428

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2524

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3512

C:\Users\Admin\AppData\Local\Temp\f71a7e2dc210ae9da8ba7178e78712df_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f71a7e2dc210ae9da8ba7178e78712df_JaffaCakes118.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:4108

C:\Windows\SysWOW64\winver.exe
winver
3⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:416

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3640

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3856

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:4000

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4080

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3132

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4220

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:392

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
1⤵
PID:4516

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
1⤵
- Suspicious use of WriteProcessMemory
PID:3916

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=122.0.2365.52 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b4,0x7ff96bf82e98,0x7ff96bf82ea4,0x7ff96bf82eb0
2⤵
PID:2936

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2272 --field-trial-handle=2276,i,5697607538120380977,9987005253899555344,262144 --variations-seed-version /prefetch:2
2⤵
PID:3624

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=2312 --field-trial-handle=2276,i,5697607538120380977,9987005253899555344,262144 --variations-seed-version /prefetch:3
2⤵
PID:2480

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=1952 --field-trial-handle=2276,i,5697607538120380977,9987005253899555344,262144 --variations-seed-version /prefetch:8
2⤵
PID:4464

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --mojo-platform-channel-handle=5452 --field-trial-handle=2276,i,5697607538120380977,9987005253899555344,262144 --variations-seed-version /prefetch:1
2⤵
PID:1056

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --mojo-platform-channel-handle=5596 --field-trial-handle=2276,i,5697607538120380977,9987005253899555344,262144 --variations-seed-version /prefetch:1
2⤵
PID:2340

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1408 --field-trial-handle=2276,i,5697607538120380977,9987005253899555344,262144 --variations-seed-version /prefetch:8
2⤵
PID:4856

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/392-32-0x0000000000650000-0x0000000000656000-memory.dmp

Filesize
24KB

Download
memory/392-28-0x0000000000650000-0x0000000000656000-memory.dmp

Filesize
24KB

Download
memory/416-11-0x0000000000880000-0x0000000000886000-memory.dmp

Filesize
24KB

Download
memory/416-5-0x0000000000880000-0x0000000000886000-memory.dmp

Filesize
24KB

Download
memory/416-7-0x0000000077AF2000-0x0000000077AF3000-memory.dmp

Filesize
4KB

Download
memory/416-3-0x0000000000460000-0x0000000000472000-memory.dmp

Filesize
72KB

Download
memory/416-35-0x0000000000880000-0x0000000000886000-memory.dmp

Filesize
24KB

Download
memory/2420-15-0x0000000000190000-0x0000000000196000-memory.dmp

Filesize
24KB

Download
memory/2428-17-0x0000000000220000-0x0000000000226000-memory.dmp

Filesize
24KB

Download
memory/2428-13-0x0000000000220000-0x0000000000226000-memory.dmp

Filesize
24KB

Download
memory/2524-14-0x0000000000150000-0x0000000000156000-memory.dmp

Filesize
24KB

Download
memory/2524-19-0x0000000000150000-0x0000000000156000-memory.dmp

Filesize
24KB

Download
memory/3132-26-0x0000000000A70000-0x0000000000A76000-memory.dmp

Filesize
24KB

Download
memory/3512-16-0x0000000000EE0000-0x0000000000EE6000-memory.dmp

Filesize
24KB

Download
memory/3512-4-0x0000000000EA0000-0x0000000000EA6000-memory.dmp

Filesize
24KB

Download
memory/3512-21-0x0000000000EE0000-0x0000000000EE6000-memory.dmp

Filesize
24KB

Download
memory/3512-2-0x0000000000EA0000-0x0000000000EA6000-memory.dmp

Filesize
24KB

Download
memory/3512-6-0x00007FF98FF6D000-0x00007FF98FF6E000-memory.dmp

Filesize
4KB

Download
memory/3640-18-0x0000000000480000-0x0000000000486000-memory.dmp

Filesize
24KB

Download
memory/3640-23-0x0000000000480000-0x0000000000486000-memory.dmp

Filesize
24KB

Download
memory/3856-20-0x0000000000E30000-0x0000000000E36000-memory.dmp

Filesize
24KB

Download
memory/4000-22-0x0000000000D00000-0x0000000000D06000-memory.dmp

Filesize
24KB

Download
memory/4000-25-0x0000000000D00000-0x0000000000D06000-memory.dmp

Filesize
24KB

Download
memory/4080-24-0x0000000000CA0000-0x0000000000CA6000-memory.dmp

Filesize
24KB

Download
memory/4080-30-0x0000000000CA0000-0x0000000000CA6000-memory.dmp

Filesize
24KB

Download
memory/4108-0-0x0000000002160000-0x0000000002161000-memory.dmp

Filesize
4KB

Download
memory/4108-9-0x00000000021F0000-0x0000000002BF0000-memory.dmp

Filesize
10.0MB

Download
memory/4108-8-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/4108-1-0x00000000021F0000-0x0000000002BF0000-memory.dmp

Filesize
10.0MB

Download
memory/4220-27-0x0000000000440000-0x0000000000446000-memory.dmp

Filesize
24KB

Download
memory/4220-31-0x0000000000440000-0x0000000000446000-memory.dmp

Filesize
24KB

Download
memory/4516-29-0x0000000000F20000-0x0000000000F26000-memory.dmp

Filesize
24KB

Download
memory/4516-33-0x0000000000F20000-0x0000000000F26000-memory.dmp

Filesize
24KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads