Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    31/12/2024, 02:39

General

  • Target

    97ae880de1028c35663bb5e82d7d1a2f1094a0dd1ab555ecfbc9c3ade776e6c8.exe

  • Size

    237KB

  • MD5

    29bb78fa90102178222f44f3356a9a43

  • SHA1

    23dd6a29c1ba2c5f88a25cfdb977758d4c5bde84

  • SHA256

    97ae880de1028c35663bb5e82d7d1a2f1094a0dd1ab555ecfbc9c3ade776e6c8

  • SHA512

    3f48d25c2fe762e8b1648c454b6c97c8ef9010ecdd73e56d9fa8a4f3ee85b907abb2419dc539da6eed1218edf6d12ab1784ea796a17b888180475a6df3a008f7

  • SSDEEP

    6144:uA2P27yTAnKGw0hjFhSR/W1nyAJ9v0pMtRCpYw:uATuTAnKGwUAWVycQqgb

Malware Config

Signatures

  • Tinba / TinyBanker

    Banking trojan which uses packet sniffing to steal data.

  • Tinba family
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 42 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    1⤵
      PID:1204
    • C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      1⤵
        PID:1312
      • C:\Windows\Explorer.EXE
        C:\Windows\Explorer.EXE
        1⤵
          PID:1368
          • C:\Users\Admin\AppData\Local\Temp\97ae880de1028c35663bb5e82d7d1a2f1094a0dd1ab555ecfbc9c3ade776e6c8.exe
            "C:\Users\Admin\AppData\Local\Temp\97ae880de1028c35663bb5e82d7d1a2f1094a0dd1ab555ecfbc9c3ade776e6c8.exe"
            2⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2332
            • C:\Windows\SysWOW64\winver.exe
              winver
              3⤵
              • Adds Run key to start application
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of WriteProcessMemory
              PID:2756
        • C:\Windows\system32\DllHost.exe
          C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
          1⤵
            PID:620

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/620-20-0x0000000001E20000-0x0000000001E26000-memory.dmp

            Filesize

            24KB

          • memory/620-24-0x0000000001E20000-0x0000000001E26000-memory.dmp

            Filesize

            24KB

          • memory/1204-26-0x0000000001B40000-0x0000000001B46000-memory.dmp

            Filesize

            24KB

          • memory/1204-11-0x0000000001B40000-0x0000000001B46000-memory.dmp

            Filesize

            24KB

          • memory/1312-27-0x00000000001B0000-0x00000000001B6000-memory.dmp

            Filesize

            24KB

          • memory/1312-14-0x00000000001B0000-0x00000000001B6000-memory.dmp

            Filesize

            24KB

          • memory/1368-17-0x0000000002790000-0x0000000002796000-memory.dmp

            Filesize

            24KB

          • memory/1368-1-0x0000000002740000-0x0000000002746000-memory.dmp

            Filesize

            24KB

          • memory/1368-3-0x0000000002740000-0x0000000002746000-memory.dmp

            Filesize

            24KB

          • memory/1368-6-0x0000000002740000-0x0000000002746000-memory.dmp

            Filesize

            24KB

          • memory/1368-25-0x0000000002790000-0x0000000002796000-memory.dmp

            Filesize

            24KB

          • memory/2332-8-0x0000000000400000-0x000000000043F000-memory.dmp

            Filesize

            252KB

          • memory/2756-23-0x00000000001B0000-0x00000000001B6000-memory.dmp

            Filesize

            24KB

          • memory/2756-4-0x0000000000090000-0x0000000000096000-memory.dmp

            Filesize

            24KB

          • memory/2756-5-0x0000000000090000-0x0000000000096000-memory.dmp

            Filesize

            24KB

          • memory/2756-29-0x00000000001B0000-0x00000000001B6000-memory.dmp

            Filesize

            24KB