tinba | db22ed4059ac26c750bd0894b92cf9a30ca2c0ecf4ab572dd7c8f59d973188d8

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
26/04/2024, 07:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

004102493fba2aae71e3bf9ef44c4bf4_JaffaCakes118.exe
Size

136KB
MD5

004102493fba2aae71e3bf9ef44c4bf4
SHA1

9a27834eb538ea041fc170ed4e1179b9d3ad94f1
SHA256

db22ed4059ac26c750bd0894b92cf9a30ca2c0ecf4ab572dd7c8f59d973188d8
SHA512

18015ca7327e8f919338960016ee33927eb5e5b1a156a7449e6709898d2268ae8abc00f0c3511501a4224777789ca519752a6631cf79190fc42ef99c466460fa
SSDEEP

3072:NJmGKw0BiaynVRDwFwaSNDe1Fclgr+0StmnJza3yD/C8:+1w0Bfjwve1FbRWmYiZ

Score

10^/10

tinba banker persistence trojan

Malware Config

Signatures

Tinba / TinyBanker
Banking trojan which uses packet sniffing to steal data.
trojan banker tinba

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C7827022 = "C:\\Users\\Admin\\AppData\\Roaming\\C7827022\\bin.exe"	winver.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3364 set thread context of 228	3364	004102493fba2aae71e3bf9ef44c4bf4_JaffaCakes118.exe	89

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3364	004102493fba2aae71e3bf9ef44c4bf4_JaffaCakes118.exe
3364	004102493fba2aae71e3bf9ef44c4bf4_JaffaCakes118.exe
4268	winver.exe
4268	winver.exe
4268	winver.exe
4268	winver.exe
4268	winver.exe
4268	winver.exe
4268	winver.exe
4268	winver.exe
4268	winver.exe
4268	winver.exe
4268	winver.exe
4268	winver.exe
4268	winver.exe
4268	winver.exe
4268	winver.exe
4268	winver.exe
4268	winver.exe
4268	winver.exe
4268	winver.exe
4268	winver.exe
4268	winver.exe
4268	winver.exe
4268	winver.exe
4268	winver.exe
4268	winver.exe
4268	winver.exe
4268	winver.exe
4268	winver.exe
4268	winver.exe
4268	winver.exe
4268	winver.exe
4268	winver.exe
4268	winver.exe
4268	winver.exe
4268	winver.exe
4268	winver.exe
4268	winver.exe
4268	winver.exe
4268	winver.exe
4268	winver.exe
4268	winver.exe
4268	winver.exe
4268	winver.exe
4268	winver.exe
4268	winver.exe
4268	winver.exe
4268	winver.exe
4268	winver.exe
4268	winver.exe
4268	winver.exe
4268	winver.exe
4268	winver.exe
4268	winver.exe
4268	winver.exe
4268	winver.exe
4268	winver.exe
4268	winver.exe
4268	winver.exe
4268	winver.exe
4268	winver.exe
4268	winver.exe
4268	winver.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3332	Explorer.EXE
Token: SeCreatePagefilePrivilege	3332	Explorer.EXE
Token: SeShutdownPrivilege	3936	RuntimeBroker.exe
Token: SeShutdownPrivilege	3936	RuntimeBroker.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4268	winver.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3364	004102493fba2aae71e3bf9ef44c4bf4_JaffaCakes118.exe
3364	004102493fba2aae71e3bf9ef44c4bf4_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3364 wrote to memory of 228	3364	004102493fba2aae71e3bf9ef44c4bf4_JaffaCakes118.exe	89
PID 3364 wrote to memory of 228	3364	004102493fba2aae71e3bf9ef44c4bf4_JaffaCakes118.exe	89
PID 3364 wrote to memory of 228	3364	004102493fba2aae71e3bf9ef44c4bf4_JaffaCakes118.exe	89
PID 3364 wrote to memory of 228	3364	004102493fba2aae71e3bf9ef44c4bf4_JaffaCakes118.exe	89
PID 3364 wrote to memory of 228	3364	004102493fba2aae71e3bf9ef44c4bf4_JaffaCakes118.exe	89
PID 3364 wrote to memory of 228	3364	004102493fba2aae71e3bf9ef44c4bf4_JaffaCakes118.exe	89
PID 3364 wrote to memory of 228	3364	004102493fba2aae71e3bf9ef44c4bf4_JaffaCakes118.exe	89
PID 228 wrote to memory of 4268	228	004102493fba2aae71e3bf9ef44c4bf4_JaffaCakes118.exe	90
PID 228 wrote to memory of 4268	228	004102493fba2aae71e3bf9ef44c4bf4_JaffaCakes118.exe	90
PID 228 wrote to memory of 4268	228	004102493fba2aae71e3bf9ef44c4bf4_JaffaCakes118.exe	90
PID 228 wrote to memory of 4268	228	004102493fba2aae71e3bf9ef44c4bf4_JaffaCakes118.exe	90
PID 4268 wrote to memory of 3332	4268	winver.exe	56
PID 4268 wrote to memory of 2416	4268	winver.exe	41
PID 4268 wrote to memory of 2448	4268	winver.exe	42
PID 4268 wrote to memory of 2584	4268	winver.exe	47
PID 4268 wrote to memory of 3332	4268	winver.exe	56
PID 4268 wrote to memory of 3548	4268	winver.exe	57
PID 4268 wrote to memory of 3744	4268	winver.exe	58
PID 4268 wrote to memory of 3868	4268	winver.exe	59
PID 4268 wrote to memory of 3936	4268	winver.exe	60
PID 4268 wrote to memory of 4028	4268	winver.exe	61
PID 4268 wrote to memory of 4188	4268	winver.exe	62
PID 4268 wrote to memory of 3652	4268	winver.exe	64
PID 4268 wrote to memory of 4576	4268	winver.exe	74
PID 4268 wrote to memory of 3476	4268	winver.exe	76
PID 4268 wrote to memory of 4916	4268	winver.exe	77
PID 4268 wrote to memory of 4452	4268	winver.exe	78
PID 4268 wrote to memory of 4260	4268	winver.exe	79
PID 4268 wrote to memory of 2012	4268	winver.exe	80
PID 4268 wrote to memory of 5016	4268	winver.exe	82
PID 4268 wrote to memory of 4492	4268	winver.exe	83
PID 4268 wrote to memory of 2440	4268	winver.exe	93
PID 3476 wrote to memory of 1900	3476	msedge.exe	102
PID 3476 wrote to memory of 1900	3476	msedge.exe	102
PID 3476 wrote to memory of 1900	3476	msedge.exe	102
PID 3476 wrote to memory of 1900	3476	msedge.exe	102
PID 3476 wrote to memory of 1900	3476	msedge.exe	102
PID 3476 wrote to memory of 1900	3476	msedge.exe	102
PID 3476 wrote to memory of 1900	3476	msedge.exe	102
PID 3476 wrote to memory of 1900	3476	msedge.exe	102
PID 3476 wrote to memory of 1900	3476	msedge.exe	102
PID 3476 wrote to memory of 1900	3476	msedge.exe	102
PID 3476 wrote to memory of 1900	3476	msedge.exe	102
PID 3476 wrote to memory of 1900	3476	msedge.exe	102
PID 3476 wrote to memory of 1900	3476	msedge.exe	102
PID 3476 wrote to memory of 1900	3476	msedge.exe	102
PID 3476 wrote to memory of 1900	3476	msedge.exe	102
PID 3476 wrote to memory of 1900	3476	msedge.exe	102
PID 3476 wrote to memory of 1900	3476	msedge.exe	102
PID 3476 wrote to memory of 1900	3476	msedge.exe	102
PID 3476 wrote to memory of 1900	3476	msedge.exe	102
PID 3476 wrote to memory of 1900	3476	msedge.exe	102
PID 3476 wrote to memory of 1900	3476	msedge.exe	102
PID 3476 wrote to memory of 1900	3476	msedge.exe	102
PID 3476 wrote to memory of 1900	3476	msedge.exe	102
PID 3476 wrote to memory of 1900	3476	msedge.exe	102
PID 3476 wrote to memory of 1900	3476	msedge.exe	102
PID 3476 wrote to memory of 1900	3476	msedge.exe	102
PID 3476 wrote to memory of 1900	3476	msedge.exe	102
PID 3476 wrote to memory of 1900	3476	msedge.exe	102
PID 3476 wrote to memory of 1900	3476	msedge.exe	102
PID 3476 wrote to memory of 1900	3476	msedge.exe	102
PID 3476 wrote to memory of 1900	3476	msedge.exe	102
PID 3476 wrote to memory of 1900	3476	msedge.exe	102

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2416

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2448

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2584

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3332
- C:\Users\Admin\AppData\Local\Temp\004102493fba2aae71e3bf9ef44c4bf4_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\004102493fba2aae71e3bf9ef44c4bf4_JaffaCakes118.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3364
- - C:\Users\Admin\AppData\Local\Temp\004102493fba2aae71e3bf9ef44c4bf4_JaffaCakes118.exe
    C:\Users\Admin\AppData\Local\Temp\004102493fba2aae71e3bf9ef44c4bf4_JaffaCakes118.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:228
  - - C:\Windows\SysWOW64\winver.exe
      winver
      4⤵
      Adds Run key to start application
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:4268

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3548

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3744
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3744 -s 908
  2⤵
  PID:2440

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3868

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3936

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:4028

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4188

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3652

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
1⤵
PID:4576

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
1⤵
- Suspicious use of WriteProcessMemory
PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=122.0.2365.52 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ff89b692e98,0x7ff89b692ea4,0x7ff89b692eb0
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2688 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:2
  2⤵
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=2984 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:3
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=2852 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --mojo-platform-channel-handle=5400 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:1
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --mojo-platform-channel-handle=5416 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:1
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4136 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:1900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
2b3524396644e2c23bdfa401da31f5c3

SHA1
3310b1dc5410ae731d8577971bafe12e43707392

SHA256
dbf3b427541cd7faa320445bdc7aa1e05fb36f397b86a0005543c33c439d2ffe

SHA512
98ecbdcb3e18b88f6941aa19ecf12a820a8381001d74a123679c9cd925ea72ae1a36277985fcc092ab9a9e06a1df315ffebec77747f7798f7ec928f4e95ff2bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
a795ed6797ceb92e55fde619c1087aba

SHA1
3ed32d1e058c523c8f64b1e0eca5450a90d5c28c

SHA256
67018bb36f32199c01bf2b2c4f4fe99191fe77dfc73f30394c095f2e0875720f

SHA512
83f94936e2b070280b26e27321cafebcd1caac9d43198fb1ff42035dc873b8a91fc23ef76d96027a9e8d22670ea8c666a4c76a6cf1ad8870eb5fc43026f9d4c1

Download Submit
memory/228-1-0x0000000000400000-0x000000000149A000-memory.dmp

Filesize
16.6MB

Download
memory/228-6-0x0000000001770000-0x0000000002170000-memory.dmp

Filesize
10.0MB

Download
memory/228-12-0x0000000000400000-0x0000000000404400-memory.dmp

Filesize
17KB

Download
memory/2416-13-0x00000000000B0000-0x00000000000B6000-memory.dmp

Filesize
24KB

Download
memory/2416-16-0x00000000000B0000-0x00000000000B6000-memory.dmp

Filesize
24KB

Download
memory/2440-38-0x0000000000910000-0x0000000000916000-memory.dmp

Filesize
24KB

Download
memory/2448-17-0x0000000000450000-0x0000000000456000-memory.dmp

Filesize
24KB

Download
memory/2448-14-0x0000000000450000-0x0000000000456000-memory.dmp

Filesize
24KB

Download
memory/2584-22-0x0000000000680000-0x0000000000686000-memory.dmp

Filesize
24KB

Download
memory/2584-15-0x0000000000680000-0x0000000000686000-memory.dmp

Filesize
24KB

Download
memory/3332-20-0x0000000000610000-0x0000000000616000-memory.dmp

Filesize
24KB

Download
memory/3332-7-0x00007FF8C1AAD000-0x00007FF8C1AAE000-memory.dmp

Filesize
4KB

Download
memory/3332-18-0x0000000000610000-0x0000000000616000-memory.dmp

Filesize
24KB

Download
memory/3332-2-0x0000000000600000-0x0000000000606000-memory.dmp

Filesize
24KB

Download
memory/3332-4-0x0000000000600000-0x0000000000606000-memory.dmp

Filesize
24KB

Download
memory/3364-0-0x0000000002290000-0x0000000002294000-memory.dmp

Filesize
16KB

Download
memory/3548-24-0x0000000000900000-0x0000000000906000-memory.dmp

Filesize
24KB

Download
memory/3548-19-0x0000000000900000-0x0000000000906000-memory.dmp

Filesize
24KB

Download
memory/3652-30-0x00000000004A0000-0x00000000004A6000-memory.dmp

Filesize
24KB

Download
memory/3652-33-0x00000000004A0000-0x00000000004A6000-memory.dmp

Filesize
24KB

Download
memory/3744-21-0x0000000000EF0000-0x0000000000EF6000-memory.dmp

Filesize
24KB

Download
memory/3868-23-0x0000000000B50000-0x0000000000B56000-memory.dmp

Filesize
24KB

Download
memory/3868-26-0x0000000000B50000-0x0000000000B56000-memory.dmp

Filesize
24KB

Download
memory/3936-25-0x0000000000F20000-0x0000000000F26000-memory.dmp

Filesize
24KB

Download
memory/3936-27-0x0000000000F20000-0x0000000000F26000-memory.dmp

Filesize
24KB

Download
memory/4028-28-0x0000000000BC0000-0x0000000000BC6000-memory.dmp

Filesize
24KB

Download
memory/4188-32-0x0000000000380000-0x0000000000386000-memory.dmp

Filesize
24KB

Download
memory/4188-29-0x0000000000380000-0x0000000000386000-memory.dmp

Filesize
24KB

Download
memory/4268-34-0x0000000003230000-0x0000000003236000-memory.dmp

Filesize
24KB

Download
memory/4268-8-0x00000000779E2000-0x00000000779E3000-memory.dmp

Filesize
4KB

Download
memory/4268-9-0x0000000000AF0000-0x0000000000B02000-memory.dmp

Filesize
72KB

Download
memory/4268-10-0x0000000002D70000-0x0000000002D76000-memory.dmp

Filesize
24KB

Download
memory/4268-3-0x0000000002D70000-0x0000000002D76000-memory.dmp

Filesize
24KB

Download
memory/4268-36-0x0000000003230000-0x0000000003236000-memory.dmp

Filesize
24KB

Download
memory/4576-31-0x0000000000E50000-0x0000000000E56000-memory.dmp

Filesize
24KB

Download
memory/4576-35-0x0000000000E50000-0x0000000000E56000-memory.dmp

Filesize
24KB

Download