Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    11/11/2024, 19:43 UTC

General

  • Target

    1064d20fc54b536bb7315852177bd379b284e9ab5865ddb7f8305b9fe8f7f116.exe

  • Size

    52KB

  • MD5

    44b6794ab925a431331fdb70cef49a80

  • SHA1

    805766a8cf9fd315f192c6724e0b82dad2849524

  • SHA256

    1064d20fc54b536bb7315852177bd379b284e9ab5865ddb7f8305b9fe8f7f116

  • SHA512

    2907be1ec200c01550906046ff08ea1df439d1fd6e2f26632b7afe3f9401298476f7dfb2a43dd9e5113cbaa6b9a18f3f46f476f131112271f18e066cf1cc61b0

  • SSDEEP

    768:0vC6RMtZNZUXeb4fXDR2JVDDISp8m7DM3pIg4LqTTUUnGg7O1/l9Jqn:MmZNZUXeQXFhS6sM3prUSGg7O1d9Jq

Malware Config

Signatures

  • Tinba / TinyBanker

    Banking trojan which uses packet sniffing to steal data.

  • Tinba family
  • Adds Run key to start application 2 TTPs 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    1⤵
      PID:1096
    • C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      1⤵
        PID:1172
      • C:\Windows\Explorer.EXE
        C:\Windows\Explorer.EXE
        1⤵
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:1208
        • C:\Users\Admin\AppData\Local\Temp\1064d20fc54b536bb7315852177bd379b284e9ab5865ddb7f8305b9fe8f7f116.exe
          "C:\Users\Admin\AppData\Local\Temp\1064d20fc54b536bb7315852177bd379b284e9ab5865ddb7f8305b9fe8f7f116.exe"
          2⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2448
          • C:\Windows\SysWOW64\winver.exe
            winver
            3⤵
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of WriteProcessMemory
            PID:2320
      • C:\Windows\system32\DllHost.exe
        C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
        1⤵
          PID:1424

        Network

        • flag-us
          DNS
          spaines.pw
          winver.exe
          Remote address:
          8.8.8.8:53
          Request
          spaines.pw
          IN A
          Response
          spaines.pw
          IN A
          216.218.185.162
        • flag-us
          POST
          http://spaines.pw/EiDQjNbWEQ/
          winver.exe
          Remote address:
          216.218.185.162:80
          Request
          POST /EiDQjNbWEQ/ HTTP/1.0
          Host: spaines.pw
          Content-Length: 157
          Response
          HTTP/1.1 200 OK
          Server: nginx/1.21.6
          Date: Mon, 11 Nov 2024 19:43:56 GMT
          Content-Type: application/octet-stream
          Connection: close
        • 216.218.185.162:80
          http://spaines.pw/EiDQjNbWEQ/
          http
          winver.exe
          1.5kB
          1.2kB
          27
          27

          HTTP Request

          POST http://spaines.pw/EiDQjNbWEQ/

          HTTP Response

          200
        • 8.8.8.8:53
          spaines.pw
          dns
          winver.exe
          56 B
          72 B
          1
          1

          DNS Request

          spaines.pw

          DNS Response

          216.218.185.162

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/1096-29-0x0000000077271000-0x0000000077272000-memory.dmp

          Filesize

          4KB

        • memory/1096-23-0x0000000077271000-0x0000000077272000-memory.dmp

          Filesize

          4KB

        • memory/1096-25-0x0000000077271000-0x0000000077272000-memory.dmp

          Filesize

          4KB

        • memory/1096-26-0x0000000077271000-0x0000000077272000-memory.dmp

          Filesize

          4KB

        • memory/1096-33-0x0000000000350000-0x0000000000356000-memory.dmp

          Filesize

          24KB

        • memory/1172-20-0x0000000000130000-0x0000000000136000-memory.dmp

          Filesize

          24KB

        • memory/1172-28-0x0000000000130000-0x0000000000136000-memory.dmp

          Filesize

          24KB

        • memory/1172-27-0x0000000077271000-0x0000000077272000-memory.dmp

          Filesize

          4KB

        • memory/1208-1-0x0000000002560000-0x0000000002566000-memory.dmp

          Filesize

          24KB

        • memory/1208-9-0x0000000077271000-0x0000000077272000-memory.dmp

          Filesize

          4KB

        • memory/1208-37-0x0000000002510000-0x0000000002516000-memory.dmp

          Filesize

          24KB

        • memory/1208-3-0x0000000002560000-0x0000000002566000-memory.dmp

          Filesize

          24KB

        • memory/1208-2-0x0000000002560000-0x0000000002566000-memory.dmp

          Filesize

          24KB

        • memory/1208-22-0x0000000002510000-0x0000000002516000-memory.dmp

          Filesize

          24KB

        • memory/1424-35-0x0000000077271000-0x0000000077272000-memory.dmp

          Filesize

          4KB

        • memory/1424-40-0x0000000077271000-0x0000000077272000-memory.dmp

          Filesize

          4KB

        • memory/1424-39-0x0000000001ED0000-0x0000000001ED6000-memory.dmp

          Filesize

          24KB

        • memory/1424-34-0x0000000077271000-0x0000000077272000-memory.dmp

          Filesize

          4KB

        • memory/2320-8-0x000000007741F000-0x0000000077421000-memory.dmp

          Filesize

          8KB

        • memory/2320-6-0x0000000077420000-0x0000000077421000-memory.dmp

          Filesize

          4KB

        • memory/2320-24-0x00000000000B0000-0x00000000000B6000-memory.dmp

          Filesize

          24KB

        • memory/2320-5-0x00000000000B0000-0x00000000000B6000-memory.dmp

          Filesize

          24KB

        • memory/2320-7-0x000000007741F000-0x0000000077420000-memory.dmp

          Filesize

          4KB

        • memory/2320-10-0x0000000077220000-0x00000000773C9000-memory.dmp

          Filesize

          1.7MB

        • memory/2448-4-0x0000000001D40000-0x0000000002740000-memory.dmp

          Filesize

          10.0MB

        • memory/2448-0-0x0000000000020000-0x0000000000021000-memory.dmp

          Filesize

          4KB

        • memory/2448-12-0x0000000001D40000-0x0000000002740000-memory.dmp

          Filesize

          10.0MB

        • memory/2448-11-0x0000000000400000-0x0000000000412000-memory.dmp

          Filesize

          72KB

        We care about your privacy.

        This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.