Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    31/12/2024, 02:39 UTC

General

  • Target

    97ae880de1028c35663bb5e82d7d1a2f1094a0dd1ab555ecfbc9c3ade776e6c8.exe

  • Size

    237KB

  • MD5

    29bb78fa90102178222f44f3356a9a43

  • SHA1

    23dd6a29c1ba2c5f88a25cfdb977758d4c5bde84

  • SHA256

    97ae880de1028c35663bb5e82d7d1a2f1094a0dd1ab555ecfbc9c3ade776e6c8

  • SHA512

    3f48d25c2fe762e8b1648c454b6c97c8ef9010ecdd73e56d9fa8a4f3ee85b907abb2419dc539da6eed1218edf6d12ab1784ea796a17b888180475a6df3a008f7

  • SSDEEP

    6144:uA2P27yTAnKGw0hjFhSR/W1nyAJ9v0pMtRCpYw:uATuTAnKGwUAWVycQqgb

Malware Config

Signatures

  • Tinba / TinyBanker

    Banking trojan which uses packet sniffing to steal data.

  • Tinba family
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 42 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    1⤵
      PID:1204
    • C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      1⤵
        PID:1312
      • C:\Windows\Explorer.EXE
        C:\Windows\Explorer.EXE
        1⤵
          PID:1368
          • C:\Users\Admin\AppData\Local\Temp\97ae880de1028c35663bb5e82d7d1a2f1094a0dd1ab555ecfbc9c3ade776e6c8.exe
            "C:\Users\Admin\AppData\Local\Temp\97ae880de1028c35663bb5e82d7d1a2f1094a0dd1ab555ecfbc9c3ade776e6c8.exe"
            2⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2332
            • C:\Windows\SysWOW64\winver.exe
              winver
              3⤵
              • Adds Run key to start application
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of WriteProcessMemory
              PID:2756
        • C:\Windows\system32\DllHost.exe
          C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
          1⤵
            PID:620

          Network

          • flag-us
            DNS
            elitiorecfreetoo.cc
            winver.exe
            Remote address:
            8.8.8.8:53
            Request
            elitiorecfreetoo.cc
            IN A
            Response
            elitiorecfreetoo.cc
            IN A
            216.218.185.162
          • flag-us
            POST
            http://elitiorecfreetoo.cc/el0hjkd76ghs65dhj0it/
            winver.exe
            Remote address:
            216.218.185.162:80
            Request
            POST /el0hjkd76ghs65dhj0it/ HTTP/1.0
            Host: elitiorecfreetoo.cc
            Content-Length: 157
            Response
            HTTP/1.1 200 OK
            Server: nginx/1.21.6
            Date: Tue, 31 Dec 2024 02:40:38 GMT
            Content-Type: application/octet-stream
            Connection: close
          • 216.218.185.162:80
            http://elitiorecfreetoo.cc/el0hjkd76ghs65dhj0it/
            http
            winver.exe
            1.1kB
            920 B
            18
            19

            HTTP Request

            POST http://elitiorecfreetoo.cc/el0hjkd76ghs65dhj0it/

            HTTP Response

            200
          • 8.8.8.8:53
            elitiorecfreetoo.cc
            dns
            winver.exe
            65 B
            81 B
            1
            1

            DNS Request

            elitiorecfreetoo.cc

            DNS Response

            216.218.185.162

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/620-20-0x0000000001E20000-0x0000000001E26000-memory.dmp

            Filesize

            24KB

          • memory/620-24-0x0000000001E20000-0x0000000001E26000-memory.dmp

            Filesize

            24KB

          • memory/1204-26-0x0000000001B40000-0x0000000001B46000-memory.dmp

            Filesize

            24KB

          • memory/1204-11-0x0000000001B40000-0x0000000001B46000-memory.dmp

            Filesize

            24KB

          • memory/1312-27-0x00000000001B0000-0x00000000001B6000-memory.dmp

            Filesize

            24KB

          • memory/1312-14-0x00000000001B0000-0x00000000001B6000-memory.dmp

            Filesize

            24KB

          • memory/1368-17-0x0000000002790000-0x0000000002796000-memory.dmp

            Filesize

            24KB

          • memory/1368-1-0x0000000002740000-0x0000000002746000-memory.dmp

            Filesize

            24KB

          • memory/1368-3-0x0000000002740000-0x0000000002746000-memory.dmp

            Filesize

            24KB

          • memory/1368-6-0x0000000002740000-0x0000000002746000-memory.dmp

            Filesize

            24KB

          • memory/1368-25-0x0000000002790000-0x0000000002796000-memory.dmp

            Filesize

            24KB

          • memory/2332-8-0x0000000000400000-0x000000000043F000-memory.dmp

            Filesize

            252KB

          • memory/2756-23-0x00000000001B0000-0x00000000001B6000-memory.dmp

            Filesize

            24KB

          • memory/2756-4-0x0000000000090000-0x0000000000096000-memory.dmp

            Filesize

            24KB

          • memory/2756-5-0x0000000000090000-0x0000000000096000-memory.dmp

            Filesize

            24KB

          • memory/2756-29-0x00000000001B0000-0x00000000001B6000-memory.dmp

            Filesize

            24KB

          We care about your privacy.

          This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.