tinba | db22ed4059ac26c750bd0894b92cf9a30ca2c0ecf4ab572dd7c8f59d973188d8

Analysis

max time kernel
149s
max time network
146s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26/04/2024, 07:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

004102493fba2aae71e3bf9ef44c4bf4_JaffaCakes118.exe
Size

136KB
MD5

004102493fba2aae71e3bf9ef44c4bf4
SHA1

9a27834eb538ea041fc170ed4e1179b9d3ad94f1
SHA256

db22ed4059ac26c750bd0894b92cf9a30ca2c0ecf4ab572dd7c8f59d973188d8
SHA512

18015ca7327e8f919338960016ee33927eb5e5b1a156a7449e6709898d2268ae8abc00f0c3511501a4224777789ca519752a6631cf79190fc42ef99c466460fa
SSDEEP

3072:NJmGKw0BiaynVRDwFwaSNDe1Fclgr+0StmnJza3yD/C8:+1w0Bfjwve1FbRWmYiZ

Score

10^/10

tinba banker persistence trojan

Malware Config

Signatures

Tinba / TinyBanker
Banking trojan which uses packet sniffing to steal data.
trojan banker tinba

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\DDDB56F1 = "C:\\Users\\Admin\\AppData\\Roaming\\DDDB56F1\\bin.exe"	winver.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2100 set thread context of 1744	2100	004102493fba2aae71e3bf9ef44c4bf4_JaffaCakes118.exe	28

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2100	004102493fba2aae71e3bf9ef44c4bf4_JaffaCakes118.exe
2480	winver.exe
2480	winver.exe
2480	winver.exe
2480	winver.exe
2480	winver.exe
2480	winver.exe
2480	winver.exe
2480	winver.exe
2480	winver.exe
2480	winver.exe
2480	winver.exe
2480	winver.exe
2480	winver.exe
2480	winver.exe
2480	winver.exe
2480	winver.exe
2480	winver.exe
2480	winver.exe
2480	winver.exe
2480	winver.exe
2480	winver.exe
2480	winver.exe
2480	winver.exe
2480	winver.exe
2480	winver.exe
2480	winver.exe
2480	winver.exe
2480	winver.exe
2480	winver.exe
2480	winver.exe
2480	winver.exe
2480	winver.exe
2480	winver.exe
2480	winver.exe
2480	winver.exe
2480	winver.exe
2480	winver.exe
2480	winver.exe
2480	winver.exe
2480	winver.exe
2480	winver.exe
2480	winver.exe
2480	winver.exe
2480	winver.exe
2480	winver.exe
2480	winver.exe
2480	winver.exe
2480	winver.exe
2480	winver.exe
2480	winver.exe
2480	winver.exe
2480	winver.exe
2480	winver.exe
2480	winver.exe
2480	winver.exe
2480	winver.exe
2480	winver.exe
2480	winver.exe
2480	winver.exe
2480	winver.exe
2480	winver.exe
2480	winver.exe
2480	winver.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2480	winver.exe
1152	Explorer.EXE
1152	Explorer.EXE

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1152	Explorer.EXE
1152	Explorer.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2100	004102493fba2aae71e3bf9ef44c4bf4_JaffaCakes118.exe
2100	004102493fba2aae71e3bf9ef44c4bf4_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 1744	2100	004102493fba2aae71e3bf9ef44c4bf4_JaffaCakes118.exe	28
PID 2100 wrote to memory of 1744	2100	004102493fba2aae71e3bf9ef44c4bf4_JaffaCakes118.exe	28
PID 2100 wrote to memory of 1744	2100	004102493fba2aae71e3bf9ef44c4bf4_JaffaCakes118.exe	28
PID 2100 wrote to memory of 1744	2100	004102493fba2aae71e3bf9ef44c4bf4_JaffaCakes118.exe	28
PID 2100 wrote to memory of 1744	2100	004102493fba2aae71e3bf9ef44c4bf4_JaffaCakes118.exe	28
PID 2100 wrote to memory of 1744	2100	004102493fba2aae71e3bf9ef44c4bf4_JaffaCakes118.exe	28
PID 2100 wrote to memory of 1744	2100	004102493fba2aae71e3bf9ef44c4bf4_JaffaCakes118.exe	28
PID 2100 wrote to memory of 1744	2100	004102493fba2aae71e3bf9ef44c4bf4_JaffaCakes118.exe	28
PID 1744 wrote to memory of 2480	1744	004102493fba2aae71e3bf9ef44c4bf4_JaffaCakes118.exe	29
PID 1744 wrote to memory of 2480	1744	004102493fba2aae71e3bf9ef44c4bf4_JaffaCakes118.exe	29
PID 1744 wrote to memory of 2480	1744	004102493fba2aae71e3bf9ef44c4bf4_JaffaCakes118.exe	29
PID 1744 wrote to memory of 2480	1744	004102493fba2aae71e3bf9ef44c4bf4_JaffaCakes118.exe	29
PID 1744 wrote to memory of 2480	1744	004102493fba2aae71e3bf9ef44c4bf4_JaffaCakes118.exe	29
PID 2480 wrote to memory of 1152	2480	winver.exe	20
PID 2480 wrote to memory of 1060	2480	winver.exe	17
PID 2480 wrote to memory of 1080	2480	winver.exe	18
PID 2480 wrote to memory of 1152	2480	winver.exe	20
PID 2480 wrote to memory of 1856	2480	winver.exe	23

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1060

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1080

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1152
- C:\Users\Admin\AppData\Local\Temp\004102493fba2aae71e3bf9ef44c4bf4_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\004102493fba2aae71e3bf9ef44c4bf4_JaffaCakes118.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2100
- - C:\Users\Admin\AppData\Local\Temp\004102493fba2aae71e3bf9ef44c4bf4_JaffaCakes118.exe
    C:\Users\Admin\AppData\Local\Temp\004102493fba2aae71e3bf9ef44c4bf4_JaffaCakes118.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1744
  - - C:\Windows\SysWOW64\winver.exe
      winver
      4⤵
      Adds Run key to start application
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:2480

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:1856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1060-39-0x00000000001B0000-0x00000000001B6000-memory.dmp

Filesize
24KB

Download
memory/1060-26-0x00000000001B0000-0x00000000001B6000-memory.dmp

Filesize
24KB

Download
memory/1060-40-0x0000000077851000-0x0000000077852000-memory.dmp

Filesize
4KB

Download
memory/1080-29-0x0000000001F10000-0x0000000001F16000-memory.dmp

Filesize
24KB

Download
memory/1080-42-0x0000000001F10000-0x0000000001F16000-memory.dmp

Filesize
24KB

Download
memory/1152-18-0x0000000077851000-0x0000000077852000-memory.dmp

Filesize
4KB

Download
memory/1152-10-0x0000000002570000-0x0000000002576000-memory.dmp

Filesize
24KB

Download
memory/1152-43-0x0000000002580000-0x0000000002586000-memory.dmp

Filesize
24KB

Download
memory/1152-15-0x0000000002570000-0x0000000002576000-memory.dmp

Filesize
24KB

Download
memory/1152-32-0x0000000002580000-0x0000000002586000-memory.dmp

Filesize
24KB

Download
memory/1744-11-0x0000000001520000-0x0000000001F20000-memory.dmp

Filesize
10.0MB

Download
memory/1744-9-0x0000000000400000-0x000000000149A000-memory.dmp

Filesize
16.6MB

Download
memory/1744-7-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1744-5-0x0000000000400000-0x000000000149A000-memory.dmp

Filesize
16.6MB

Download
memory/1744-23-0x0000000000400000-0x0000000000404400-memory.dmp

Filesize
17KB

Download
memory/1744-3-0x0000000000400000-0x000000000149A000-memory.dmp

Filesize
16.6MB

Download
memory/1744-1-0x00000000001B0000-0x00000000002AA000-memory.dmp

Filesize
1000KB

Download
memory/1856-44-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/1856-35-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/1856-45-0x0000000077851000-0x0000000077852000-memory.dmp

Filesize
4KB

Download
memory/2100-0-0x00000000002A0000-0x00000000002A4000-memory.dmp

Filesize
16KB

Download
memory/2480-16-0x0000000000120000-0x0000000000126000-memory.dmp

Filesize
24KB

Download
memory/2480-17-0x0000000000310000-0x0000000000326000-memory.dmp

Filesize
88KB

Download
memory/2480-14-0x0000000000120000-0x0000000000126000-memory.dmp

Filesize
24KB

Download
memory/2480-38-0x0000000000250000-0x0000000000256000-memory.dmp

Filesize
24KB

Download
memory/2480-19-0x00000000779FF000-0x0000000077A00000-memory.dmp

Filesize
4KB

Download
memory/2480-20-0x00000000779FF000-0x0000000077A01000-memory.dmp

Filesize
8KB

Download
memory/2480-41-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2480-21-0x0000000077A00000-0x0000000077A01000-memory.dmp

Filesize
4KB

Download
memory/2480-12-0x0000000000120000-0x0000000000126000-memory.dmp

Filesize
24KB

Download
memory/2480-46-0x0000000000250000-0x0000000000256000-memory.dmp

Filesize
24KB

Download
memory/2480-47-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download