Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    25/12/2024, 17:53 UTC

General

  • Target

    5702a4204515ed95b456b5f6bdbe24d9d529d2a4715da2833d1343b28d3a96fa.exe

  • Size

    225KB

  • MD5

    d9ddf1f75efd934536e757ef82219b03

  • SHA1

    827cd3492b2b09dbd5bbe91b32797be413d06b4c

  • SHA256

    5702a4204515ed95b456b5f6bdbe24d9d529d2a4715da2833d1343b28d3a96fa

  • SHA512

    0d0edaf56cc7782b5df930c4bdf3271fbba387b56c45794a3cfb446cb57ff15a385226954d5b3559a64453612d832ae1d9e818befd3f42a2386dd4d8eed9f47a

  • SSDEEP

    6144:dA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpY0:dATuTAnKGwUAW3ycQqgd

Malware Config

Signatures

  • Tinba / TinyBanker

    Banking trojan which uses packet sniffing to steal data.

  • Tinba family
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 46 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    1⤵
      PID:1072
    • C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      1⤵
        PID:1140
      • C:\Windows\Explorer.EXE
        C:\Windows\Explorer.EXE
        1⤵
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:1168
        • C:\Users\Admin\AppData\Local\Temp\5702a4204515ed95b456b5f6bdbe24d9d529d2a4715da2833d1343b28d3a96fa.exe
          "C:\Users\Admin\AppData\Local\Temp\5702a4204515ed95b456b5f6bdbe24d9d529d2a4715da2833d1343b28d3a96fa.exe"
          2⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2052
          • C:\Windows\SysWOW64\winver.exe
            winver
            3⤵
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of WriteProcessMemory
            PID:2684
      • C:\Windows\system32\DllHost.exe
        C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
        1⤵
          PID:1756

        Network

        • flag-us
          DNS
          elitiorecfreetoo.cc
          winver.exe
          Remote address:
          8.8.8.8:53
          Request
          elitiorecfreetoo.cc
          IN A
          Response
          elitiorecfreetoo.cc
          IN A
          216.218.185.162
        • flag-us
          POST
          http://elitiorecfreetoo.cc/el0hjkd76ghs65dhj0it/
          winver.exe
          Remote address:
          216.218.185.162:80
          Request
          POST /el0hjkd76ghs65dhj0it/ HTTP/1.0
          Host: elitiorecfreetoo.cc
          Content-Length: 157
          Response
          HTTP/1.1 200 OK
          Server: nginx/1.21.6
          Date: Wed, 25 Dec 2024 17:53:41 GMT
          Content-Type: application/octet-stream
          Connection: close
        • 216.218.185.162:80
          http://elitiorecfreetoo.cc/el0hjkd76ghs65dhj0it/
          http
          winver.exe
          1.2kB
          957 B
          20
          20

          HTTP Request

          POST http://elitiorecfreetoo.cc/el0hjkd76ghs65dhj0it/

          HTTP Response

          200
        • 8.8.8.8:53
          elitiorecfreetoo.cc
          dns
          winver.exe
          65 B
          81 B
          1
          1

          DNS Request

          elitiorecfreetoo.cc

          DNS Response

          216.218.185.162

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/1072-11-0x0000000000490000-0x0000000000496000-memory.dmp

          Filesize

          24KB

        • memory/1072-29-0x0000000000490000-0x0000000000496000-memory.dmp

          Filesize

          24KB

        • memory/1140-26-0x0000000000130000-0x0000000000136000-memory.dmp

          Filesize

          24KB

        • memory/1140-14-0x0000000000130000-0x0000000000136000-memory.dmp

          Filesize

          24KB

        • memory/1168-3-0x0000000002020000-0x0000000002026000-memory.dmp

          Filesize

          24KB

        • memory/1168-1-0x0000000002020000-0x0000000002026000-memory.dmp

          Filesize

          24KB

        • memory/1168-17-0x00000000029D0000-0x00000000029D6000-memory.dmp

          Filesize

          24KB

        • memory/1168-6-0x0000000002020000-0x0000000002026000-memory.dmp

          Filesize

          24KB

        • memory/1168-27-0x00000000029D0000-0x00000000029D6000-memory.dmp

          Filesize

          24KB

        • memory/1756-20-0x0000000001E20000-0x0000000001E26000-memory.dmp

          Filesize

          24KB

        • memory/1756-28-0x0000000001E20000-0x0000000001E26000-memory.dmp

          Filesize

          24KB

        • memory/2052-8-0x0000000000400000-0x000000000043C000-memory.dmp

          Filesize

          240KB

        • memory/2684-4-0x0000000000120000-0x0000000000126000-memory.dmp

          Filesize

          24KB

        • memory/2684-25-0x0000000000260000-0x0000000000266000-memory.dmp

          Filesize

          24KB

        • memory/2684-5-0x0000000000120000-0x0000000000126000-memory.dmp

          Filesize

          24KB

        • memory/2684-31-0x0000000000260000-0x0000000000266000-memory.dmp

          Filesize

          24KB

        We care about your privacy.

        This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.