Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    112s
  • max time network
    97s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/12/2024, 20:23 UTC

General

  • Target

    d9eaa104fad8662b9cd9b3da5efbf4ec7e37a747fc5ac469ab6f108cff0a8f4bN.exe

  • Size

    45KB

  • MD5

    67d0f6321fb0166c7af5dc0165fd4ac0

  • SHA1

    8ff05c2aa955f33377196b9f8cc480c88d806d9e

  • SHA256

    d9eaa104fad8662b9cd9b3da5efbf4ec7e37a747fc5ac469ab6f108cff0a8f4b

  • SHA512

    6bcb368b70caece375ce36f3acfa04a2e5d89a330fdcd839a8de27a3b9469a9a46f4205316747a444776bc7191be2190ad3e02047b6f5254f7e5cd011991eb28

  • SSDEEP

    768:qhP0kDE9N5dCA8J7VHXdrIniQaBTT+QQ+r1n4K8+C9TtIuCjaqUODvJVQ2n:GsWE9N5dFu53dsniQaB/xZ14n7zIF+qz

Malware Config

Signatures

  • Tinba / TinyBanker

    Banking trojan which uses packet sniffing to steal data.

  • Tinba family
  • Adds Run key to start application 2 TTPs 1 IoCs
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
    1⤵
      PID:2656
    • C:\Windows\Explorer.EXE
      C:\Windows\Explorer.EXE
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3556
      • C:\Users\Admin\AppData\Local\Temp\d9eaa104fad8662b9cd9b3da5efbf4ec7e37a747fc5ac469ab6f108cff0a8f4bN.exe
        "C:\Users\Admin\AppData\Local\Temp\d9eaa104fad8662b9cd9b3da5efbf4ec7e37a747fc5ac469ab6f108cff0a8f4bN.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2992
        • C:\Windows\SysWOW64\winver.exe
          winver
          3⤵
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:2212
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2212 -s 352
            4⤵
            • Program crash
            PID:1156
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2212 -ip 2212
      1⤵
        PID:4628

      Network

      • flag-us
        DNS
        4.159.190.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        4.159.190.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        13.86.106.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        13.86.106.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        95.221.229.192.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        95.221.229.192.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        228.249.119.40.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        228.249.119.40.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        58.55.71.13.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        58.55.71.13.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        200.163.202.172.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        200.163.202.172.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        241.42.69.40.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        241.42.69.40.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        180.129.81.91.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        180.129.81.91.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        83.210.23.2.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        83.210.23.2.in-addr.arpa
        IN PTR
        Response
        83.210.23.2.in-addr.arpa
        IN PTR
        a2-23-210-83deploystaticakamaitechnologiescom
      • flag-us
        DNS
        29.243.111.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        29.243.111.52.in-addr.arpa
        IN PTR
        Response
      No results found
      • 8.8.8.8:53
        4.159.190.20.in-addr.arpa
        dns
        71 B
        157 B
        1
        1

        DNS Request

        4.159.190.20.in-addr.arpa

      • 8.8.8.8:53
        13.86.106.20.in-addr.arpa
        dns
        71 B
        157 B
        1
        1

        DNS Request

        13.86.106.20.in-addr.arpa

      • 8.8.8.8:53
        95.221.229.192.in-addr.arpa
        dns
        73 B
        144 B
        1
        1

        DNS Request

        95.221.229.192.in-addr.arpa

      • 8.8.8.8:53
        228.249.119.40.in-addr.arpa
        dns
        73 B
        159 B
        1
        1

        DNS Request

        228.249.119.40.in-addr.arpa

      • 8.8.8.8:53
        58.55.71.13.in-addr.arpa
        dns
        70 B
        144 B
        1
        1

        DNS Request

        58.55.71.13.in-addr.arpa

      • 8.8.8.8:53
        200.163.202.172.in-addr.arpa
        dns
        74 B
        160 B
        1
        1

        DNS Request

        200.163.202.172.in-addr.arpa

      • 8.8.8.8:53
        241.42.69.40.in-addr.arpa
        dns
        71 B
        145 B
        1
        1

        DNS Request

        241.42.69.40.in-addr.arpa

      • 8.8.8.8:53
        180.129.81.91.in-addr.arpa
        dns
        72 B
        147 B
        1
        1

        DNS Request

        180.129.81.91.in-addr.arpa

      • 8.8.8.8:53
        83.210.23.2.in-addr.arpa
        dns
        70 B
        133 B
        1
        1

        DNS Request

        83.210.23.2.in-addr.arpa

      • 8.8.8.8:53
        29.243.111.52.in-addr.arpa
        dns
        72 B
        158 B
        1
        1

        DNS Request

        29.243.111.52.in-addr.arpa

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/2212-6-0x0000000077032000-0x0000000077033000-memory.dmp

        Filesize

        4KB

      • memory/2212-15-0x0000000000FA0000-0x0000000000FA6000-memory.dmp

        Filesize

        24KB

      • memory/2212-8-0x00007FF9F7B50000-0x00007FF9F7D45000-memory.dmp

        Filesize

        2.0MB

      • memory/2212-5-0x0000000000FA0000-0x0000000000FA6000-memory.dmp

        Filesize

        24KB

      • memory/2656-14-0x0000000000F20000-0x0000000000F26000-memory.dmp

        Filesize

        24KB

      • memory/2992-9-0x0000000000400000-0x000000000041D000-memory.dmp

        Filesize

        116KB

      • memory/2992-4-0x0000000002260000-0x0000000002C60000-memory.dmp

        Filesize

        10.0MB

      • memory/2992-0-0x0000000000400000-0x000000000041D000-memory.dmp

        Filesize

        116KB

      • memory/2992-10-0x0000000002260000-0x0000000002C60000-memory.dmp

        Filesize

        10.0MB

      • memory/2992-1-0x0000000002160000-0x0000000002161000-memory.dmp

        Filesize

        4KB

      • memory/3556-7-0x00007FF9F7BED000-0x00007FF9F7BEE000-memory.dmp

        Filesize

        4KB

      • memory/3556-2-0x0000000001430000-0x0000000001436000-memory.dmp

        Filesize

        24KB

      • memory/3556-3-0x0000000001430000-0x0000000001436000-memory.dmp

        Filesize

        24KB

      We care about your privacy.

      This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.