Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    08/11/2024, 01:17

General

  • Target

    f6b61576fdaafb74827d76ef8a82d990b6b4c27bbb3c2a51d6a6506f39daf673N.exe

  • Size

    89KB

  • MD5

    762e6a229c846620bbbb11fbb6f36290

  • SHA1

    d7c1ec24f3cd7d04076efd2cd9c6feb1450ed6eb

  • SHA256

    f6b61576fdaafb74827d76ef8a82d990b6b4c27bbb3c2a51d6a6506f39daf673

  • SHA512

    1c9b3d44e32b01e58c6805f8fa0f0b13c2a9a8c8e073dd223c3a83a0f731966268a884977e4c139d89e4a81a9edec0b8677e2d9186e2b8de9388e58defbe9264

  • SSDEEP

    1536:k9o65gQK3Zm+Mt9RV5O8oQ9cXFunGm6ManhFLnBqHan6owwosTk8vxA:k9o6fK2XqXQwhnHlqQo8Lvy

Malware Config

Signatures

  • Tinba / TinyBanker

    Banking trojan which uses packet sniffing to steal data.

  • Tinba family
  • Adds Run key to start application 2 TTPs 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 60 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    1⤵
      PID:1128
    • C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      1⤵
        PID:1204
      • C:\Windows\Explorer.EXE
        C:\Windows\Explorer.EXE
        1⤵
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:1256
        • C:\Users\Admin\AppData\Local\Temp\f6b61576fdaafb74827d76ef8a82d990b6b4c27bbb3c2a51d6a6506f39daf673N.exe
          "C:\Users\Admin\AppData\Local\Temp\f6b61576fdaafb74827d76ef8a82d990b6b4c27bbb3c2a51d6a6506f39daf673N.exe"
          2⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2552
          • C:\Windows\SysWOW64\winver.exe
            winver
            3⤵
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of WriteProcessMemory
            PID:3048
      • C:\Windows\system32\DllHost.exe
        C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
        1⤵
          PID:1092

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/1092-28-0x0000000001D80000-0x0000000001D86000-memory.dmp

          Filesize

          24KB

        • memory/1092-29-0x0000000076EB1000-0x0000000076EB2000-memory.dmp

          Filesize

          4KB

        • memory/1092-23-0x0000000001D80000-0x0000000001D86000-memory.dmp

          Filesize

          24KB

        • memory/1128-16-0x0000000000250000-0x0000000000256000-memory.dmp

          Filesize

          24KB

        • memory/1128-30-0x0000000000250000-0x0000000000256000-memory.dmp

          Filesize

          24KB

        • memory/1204-18-0x00000000001A0000-0x00000000001A6000-memory.dmp

          Filesize

          24KB

        • memory/1204-26-0x00000000001A0000-0x00000000001A6000-memory.dmp

          Filesize

          24KB

        • memory/1204-27-0x0000000076EB1000-0x0000000076EB2000-memory.dmp

          Filesize

          4KB

        • memory/1256-12-0x0000000076EB1000-0x0000000076EB2000-memory.dmp

          Filesize

          4KB

        • memory/1256-31-0x0000000002A80000-0x0000000002A86000-memory.dmp

          Filesize

          24KB

        • memory/1256-21-0x0000000002A80000-0x0000000002A86000-memory.dmp

          Filesize

          24KB

        • memory/1256-2-0x0000000002A70000-0x0000000002A76000-memory.dmp

          Filesize

          24KB

        • memory/1256-1-0x0000000002A70000-0x0000000002A76000-memory.dmp

          Filesize

          24KB

        • memory/1256-5-0x0000000002A70000-0x0000000002A76000-memory.dmp

          Filesize

          24KB

        • memory/2552-6-0x0000000002120000-0x0000000002B20000-memory.dmp

          Filesize

          10.0MB

        • memory/2552-0-0x0000000000240000-0x0000000000242000-memory.dmp

          Filesize

          8KB

        • memory/2552-14-0x0000000000400000-0x000000000041D000-memory.dmp

          Filesize

          116KB

        • memory/2552-32-0x0000000002120000-0x0000000002B20000-memory.dmp

          Filesize

          10.0MB

        • memory/3048-13-0x0000000076E60000-0x0000000077009000-memory.dmp

          Filesize

          1.7MB

        • memory/3048-10-0x000000007705F000-0x0000000077061000-memory.dmp

          Filesize

          8KB

        • memory/3048-11-0x0000000000150000-0x0000000000151000-memory.dmp

          Filesize

          4KB

        • memory/3048-7-0x0000000000100000-0x0000000000106000-memory.dmp

          Filesize

          24KB

        • memory/3048-8-0x0000000077060000-0x0000000077061000-memory.dmp

          Filesize

          4KB

        • memory/3048-9-0x000000007705F000-0x0000000077060000-memory.dmp

          Filesize

          4KB

        • memory/3048-3-0x0000000000100000-0x0000000000106000-memory.dmp

          Filesize

          24KB

        • memory/3048-38-0x0000000000100000-0x0000000000106000-memory.dmp

          Filesize

          24KB