tinba | a650934c45102e2b38a73b4acf213730ffd39c4792bc3cc7b49d3c030980994d

General

Target

f923e45694d3280e9663a4c8adc7602c_JaffaCakes118.exe
Size

160KB
MD5

f923e45694d3280e9663a4c8adc7602c
SHA1

08b4b1841d5351b9d26141a2c0e9b941b7e0f188
SHA256

a650934c45102e2b38a73b4acf213730ffd39c4792bc3cc7b49d3c030980994d
SHA512

b24f23e93fb27f27dd4f5ce18a8073adcd2ed34fc3ae09f7b4a1b0bb330d396f05c5e3edf7ad872281119c7bfa7e12f43a7cb40c34bb12748cb0a9bffe98225d
SSDEEP

1536:6EY+mFM2HXKZgi0Iksu+XM5/HtAQ9J6xph:xY+4MiIkLZJNAQ9J6v

Score

10^/10

tinba banker persistence trojan upx

Malware Config

Signatures

Tinba / TinyBanker
Banking trojan which uses packet sniffing to steal data.
trojan banker tinba

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2916-0-0x0000000000400000-0x0000000000428000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

winver.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\50E22FFD = "C:\\Users\\Admin\\AppData\\Roaming\\50E22FFD\\bin.exe"	winver.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

winver.exe

pid	process
2920	winver.exe
2920	winver.exe
2920	winver.exe
2920	winver.exe
2920	winver.exe
2920	winver.exe
2920	winver.exe
2920	winver.exe
2920	winver.exe
2920	winver.exe
2920	winver.exe
2920	winver.exe
2920	winver.exe
2920	winver.exe
2920	winver.exe
2920	winver.exe
2920	winver.exe
2920	winver.exe
2920	winver.exe
2920	winver.exe
2920	winver.exe
2920	winver.exe
2920	winver.exe
2920	winver.exe
2920	winver.exe
2920	winver.exe
2920	winver.exe
2920	winver.exe
2920	winver.exe
2920	winver.exe
2920	winver.exe
2920	winver.exe
2920	winver.exe
2920	winver.exe
2920	winver.exe
2920	winver.exe
2920	winver.exe
2920	winver.exe
2920	winver.exe
2920	winver.exe
2920	winver.exe
2920	winver.exe
2920	winver.exe
2920	winver.exe
2920	winver.exe
2920	winver.exe
2920	winver.exe
2920	winver.exe
2920	winver.exe
2920	winver.exe
2920	winver.exe
2920	winver.exe
2920	winver.exe
2920	winver.exe
2920	winver.exe
2920	winver.exe
2920	winver.exe
2920	winver.exe
2920	winver.exe
2920	winver.exe
2920	winver.exe
2920	winver.exe
2920	winver.exe
2920	winver.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

winver.exe

pid process

2920 winver.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

f923e45694d3280e9663a4c8adc7602c_JaffaCakes118.exewinver.exe

description	pid	process	target process
PID 2916 wrote to memory of 2920	2916	f923e45694d3280e9663a4c8adc7602c_JaffaCakes118.exe	winver.exe
PID 2916 wrote to memory of 2920	2916	f923e45694d3280e9663a4c8adc7602c_JaffaCakes118.exe	winver.exe
PID 2916 wrote to memory of 2920	2916	f923e45694d3280e9663a4c8adc7602c_JaffaCakes118.exe	winver.exe
PID 2916 wrote to memory of 2920	2916	f923e45694d3280e9663a4c8adc7602c_JaffaCakes118.exe	winver.exe
PID 2916 wrote to memory of 2920	2916	f923e45694d3280e9663a4c8adc7602c_JaffaCakes118.exe	winver.exe
PID 2920 wrote to memory of 1152	2920	winver.exe	Explorer.EXE
PID 2920 wrote to memory of 1072	2920	winver.exe	taskhost.exe
PID 2920 wrote to memory of 1128	2920	winver.exe	Dwm.exe
PID 2920 wrote to memory of 1152	2920	winver.exe	Explorer.EXE

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1072

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1128

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1152

C:\Users\Admin\AppData\Local\Temp\f923e45694d3280e9663a4c8adc7602c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f923e45694d3280e9663a4c8adc7602c_JaffaCakes118.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:2916

C:\Windows\SysWOW64\winver.exe
winver
3⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2920

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1072-25-0x0000000002010000-0x0000000002016000-memory.dmp

Filesize
24KB

Download
memory/1072-26-0x0000000077281000-0x0000000077282000-memory.dmp

Filesize
4KB

Download
memory/1128-22-0x0000000000130000-0x0000000000136000-memory.dmp

Filesize
24KB

Download
memory/1128-27-0x0000000000130000-0x0000000000136000-memory.dmp

Filesize
24KB

Download
memory/1152-11-0x0000000077281000-0x0000000077282000-memory.dmp

Filesize
4KB

Download
memory/1152-24-0x00000000025E0000-0x00000000025E6000-memory.dmp

Filesize
24KB

Download
memory/1152-28-0x00000000025E0000-0x00000000025E6000-memory.dmp

Filesize
24KB

Download
memory/1152-6-0x0000000002E80000-0x0000000002E86000-memory.dmp

Filesize
24KB

Download
memory/1152-2-0x0000000002E80000-0x0000000002E86000-memory.dmp

Filesize
24KB

Download
memory/2916-1-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/2916-3-0x0000000001D90000-0x0000000002790000-memory.dmp

Filesize
10.0MB

Download
memory/2916-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2916-12-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2916-13-0x0000000001D90000-0x0000000002790000-memory.dmp

Filesize
10.0MB

Download
memory/2920-7-0x0000000000850000-0x0000000000866000-memory.dmp

Filesize
88KB

Download
memory/2920-4-0x00000000001A0000-0x00000000001A6000-memory.dmp

Filesize
24KB

Download
memory/2920-16-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/2920-15-0x00000000001A0000-0x00000000001A6000-memory.dmp

Filesize
24KB

Download
memory/2920-8-0x000000007742F000-0x0000000077430000-memory.dmp

Filesize
4KB

Download
memory/2920-9-0x000000007742F000-0x0000000077431000-memory.dmp

Filesize
8KB

Download
memory/2920-10-0x0000000077430000-0x0000000077431000-memory.dmp

Filesize
4KB

Download
memory/2920-32-0x00000000001A0000-0x00000000001A6000-memory.dmp

Filesize
24KB

Download
memory/2920-33-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads