Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    146s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/10/2024, 07:44

General

  • Target

    7680fc92e7ecf99fc3b5b699f6195dd85c22293af233e6f6bf8972895409fc03N.exe

  • Size

    98KB

  • MD5

    03a87b535043242fe982f95a8d7aa040

  • SHA1

    c29119163c409182a45029422acdb0d1c2389400

  • SHA256

    7680fc92e7ecf99fc3b5b699f6195dd85c22293af233e6f6bf8972895409fc03

  • SHA512

    6139a1b66f140fb5643f41b4c4761fa76fe561906e5cd961161b9c5e9dc3c3e391c3b065859ab56224c0f84794d48c2a558f1da7e2d2e25c83f844c2817cfdac

  • SSDEEP

    768:Q+6p+OMlgGMCWhfDzU7f7JDgi9I57+sByZ+XsfXpwtG9ipelU9JF:Q+mFM2HXKZgi9Iksu+XM57ipeq9JF

Malware Config

Signatures

  • Tinba / TinyBanker

    Banking trojan which uses packet sniffing to steal data.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
      PID:2660
    • C:\Windows\Explorer.EXE
      C:\Windows\Explorer.EXE
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of UnmapMainImage
      PID:3560
      • C:\Users\Admin\AppData\Local\Temp\7680fc92e7ecf99fc3b5b699f6195dd85c22293af233e6f6bf8972895409fc03N.exe
        "C:\Users\Admin\AppData\Local\Temp\7680fc92e7ecf99fc3b5b699f6195dd85c22293af233e6f6bf8972895409fc03N.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3532
        • C:\Windows\SysWOW64\winver.exe
          winver
          3⤵
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:4224
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 4224 -s 352
            4⤵
            • Program crash
            PID:824
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4224 -ip 4224
      1⤵
        PID:2352

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/2660-13-0x0000000000580000-0x0000000000586000-memory.dmp

        Filesize

        24KB

      • memory/3532-9-0x0000000002110000-0x0000000002B10000-memory.dmp

        Filesize

        10.0MB

      • memory/3532-3-0x0000000002110000-0x0000000002B10000-memory.dmp

        Filesize

        10.0MB

      • memory/3532-8-0x0000000000400000-0x000000000041A000-memory.dmp

        Filesize

        104KB

      • memory/3532-0-0x0000000002020000-0x0000000002021000-memory.dmp

        Filesize

        4KB

      • memory/3560-2-0x0000000000B40000-0x0000000000B46000-memory.dmp

        Filesize

        24KB

      • memory/3560-5-0x00007FFC718ED000-0x00007FFC718EE000-memory.dmp

        Filesize

        4KB

      • memory/3560-7-0x00007FFC71A80000-0x00007FFC71A81000-memory.dmp

        Filesize

        4KB

      • memory/3560-1-0x0000000000B40000-0x0000000000B46000-memory.dmp

        Filesize

        24KB

      • memory/4224-4-0x0000000077BB2000-0x0000000077BB3000-memory.dmp

        Filesize

        4KB

      • memory/4224-6-0x00007FFC71850000-0x00007FFC71A45000-memory.dmp

        Filesize

        2.0MB

      • memory/4224-11-0x0000000000860000-0x0000000000866000-memory.dmp

        Filesize

        24KB

      • memory/4224-14-0x0000000000860000-0x0000000000866000-memory.dmp

        Filesize

        24KB