Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    11/11/2024, 13:13 UTC

General

  • Target

    8449018f15ad45b48d46f4184466284cf6521a5b471e04e5c895f3f036ade6c3N.exe

  • Size

    88KB

  • MD5

    10db7b723c7d9344e3b9c09b9222dc4b

  • SHA1

    339feb4b1c134a732ec6f5d3777f52180510e6a9

  • SHA256

    7e200ff586f0396ef01e9f527c1d32908fd56150e6886f5b7927c1cf382d643e

  • SHA512

    fafe71a75ee9b02b1d99fc204e0d893c05c75f90dce8b212a6c4f13548297b18dcde019503e3c0630f624c7a22c756df000afb869e9ab98131050d0ef4f41cb8

  • SSDEEP

    1536:Az44CpRkr9DXhHf3aOd/56RrkQqjh+rmKVsNz:AzvokZR/KM/ysjwqWsNz

Malware Config

Signatures

  • Tinba / TinyBanker

    Banking trojan which uses packet sniffing to steal data.

  • Tinba family
  • Adds Run key to start application 2 TTPs 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 57 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    1⤵
      PID:1116
    • C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      1⤵
        PID:1192
      • C:\Windows\Explorer.EXE
        C:\Windows\Explorer.EXE
        1⤵
          PID:1248
          • C:\Users\Admin\AppData\Local\Temp\8449018f15ad45b48d46f4184466284cf6521a5b471e04e5c895f3f036ade6c3N.exe
            "C:\Users\Admin\AppData\Local\Temp\8449018f15ad45b48d46f4184466284cf6521a5b471e04e5c895f3f036ade6c3N.exe"
            2⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2368
            • C:\Windows\SysWOW64\winver.exe
              winver
              3⤵
              • Adds Run key to start application
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of WriteProcessMemory
              PID:1476
        • C:\Windows\system32\DllHost.exe
          C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
          1⤵
            PID:1124

          Network

          • flag-us
            DNS
            spaines.pw
            winver.exe
            Remote address:
            8.8.8.8:53
            Request
            spaines.pw
            IN A
            Response
            spaines.pw
            IN A
            216.218.185.162
          • flag-us
            POST
            http://spaines.pw/EiDQjNbWEQ/
            winver.exe
            Remote address:
            216.218.185.162:80
            Request
            POST /EiDQjNbWEQ/ HTTP/1.0
            Host: spaines.pw
            Content-Length: 157
            Response
            HTTP/1.1 200 OK
            Server: nginx/1.21.6
            Date: Mon, 11 Nov 2024 13:13:57 GMT
            Content-Type: application/octet-stream
            Connection: close
          • 216.218.185.162:80
            http://spaines.pw/EiDQjNbWEQ/
            http
            winver.exe
            1.2kB
            1.0kB
            22
            22

            HTTP Request

            POST http://spaines.pw/EiDQjNbWEQ/

            HTTP Response

            200
          • 8.8.8.8:53
            spaines.pw
            dns
            winver.exe
            56 B
            72 B
            1
            1

            DNS Request

            spaines.pw

            DNS Response

            216.218.185.162

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/1116-24-0x00000000001C0000-0x00000000001C6000-memory.dmp

            Filesize

            24KB

          • memory/1116-25-0x0000000076F21000-0x0000000076F22000-memory.dmp

            Filesize

            4KB

          • memory/1124-28-0x0000000076F21000-0x0000000076F22000-memory.dmp

            Filesize

            4KB

          • memory/1124-23-0x0000000001F90000-0x0000000001F96000-memory.dmp

            Filesize

            24KB

          • memory/1124-27-0x0000000001F90000-0x0000000001F96000-memory.dmp

            Filesize

            24KB

          • memory/1192-18-0x00000000001B0000-0x00000000001B6000-memory.dmp

            Filesize

            24KB

          • memory/1192-29-0x00000000001B0000-0x00000000001B6000-memory.dmp

            Filesize

            24KB

          • memory/1248-1-0x0000000002B00000-0x0000000002B06000-memory.dmp

            Filesize

            24KB

          • memory/1248-20-0x00000000025B0000-0x00000000025B6000-memory.dmp

            Filesize

            24KB

          • memory/1248-9-0x0000000076F21000-0x0000000076F22000-memory.dmp

            Filesize

            4KB

          • memory/1248-2-0x0000000002B00000-0x0000000002B06000-memory.dmp

            Filesize

            24KB

          • memory/1248-30-0x00000000025B0000-0x00000000025B6000-memory.dmp

            Filesize

            24KB

          • memory/1248-3-0x0000000002B00000-0x0000000002B06000-memory.dmp

            Filesize

            24KB

          • memory/1476-8-0x00000000770CF000-0x00000000770D1000-memory.dmp

            Filesize

            8KB

          • memory/1476-26-0x0000000000120000-0x0000000000126000-memory.dmp

            Filesize

            24KB

          • memory/1476-5-0x0000000000120000-0x0000000000126000-memory.dmp

            Filesize

            24KB

          • memory/1476-6-0x00000000770D0000-0x00000000770D1000-memory.dmp

            Filesize

            4KB

          • memory/1476-7-0x00000000770CF000-0x00000000770D0000-memory.dmp

            Filesize

            4KB

          • memory/1476-10-0x0000000076ED0000-0x0000000077079000-memory.dmp

            Filesize

            1.7MB

          • memory/1476-35-0x0000000000180000-0x0000000000181000-memory.dmp

            Filesize

            4KB

          • memory/2368-12-0x0000000001CD0000-0x00000000026D0000-memory.dmp

            Filesize

            10.0MB

          • memory/2368-11-0x0000000000400000-0x0000000000417000-memory.dmp

            Filesize

            92KB

          • memory/2368-0-0x0000000000020000-0x0000000000021000-memory.dmp

            Filesize

            4KB

          • memory/2368-4-0x0000000001CD0000-0x00000000026D0000-memory.dmp

            Filesize

            10.0MB

          We care about your privacy.

          This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.