Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
04-01-2025 20:18
General
-
Target
JaffaCakes118_7b9227f98eea65ad3cab1e755cc825a0.exe
-
Size
171KB
-
MD5
7b9227f98eea65ad3cab1e755cc825a0
-
SHA1
afb49223eafa9a12edc77f490c7270d6ae290da1
-
SHA256
0482ac285c4e941a82de2425c3572ef2b951f90423d85627a282147fb3b95d14
-
SHA512
df0810cadccbac745a828d08b8d8b9630fd0f24f3c7fa4eabccbc019f30b2aba67b1acc4be61e4b8cdf7192d4a86a602aadefa988d2a7c3dc7430bacb04f432f
-
SSDEEP
3072:aNa3V0rxgN+E+bjKFmEHKjbMpZszZHqiD:oal0aUELIEm6ZstKM
Score
10/10
Malware Config
Signatures
-
Tinba / TinyBanker
Banking trojan which uses packet sniffing to steal data.
-
Tinba family
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7b9227f98eea65ad3cab1e755cc825a0.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7b9227f98eea65ad3cab1e755cc825a0.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7b9227f98eea65ad3cab1e755cc825a0.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7b9227f98eea65ad3cab1e755cc825a0.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\EXPLORER.exeEXPLORER4⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
28KB
-
Filesize
4KB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
4KB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
4KB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
4KB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
1.7MB
-
Filesize
28KB
-
Filesize
20KB
-
Filesize
4KB
-
Filesize
1.7MB
-
Filesize
20KB
-
Filesize
10.0MB
-
Filesize
28KB
-
Filesize
20KB
-
Filesize
28KB
-
Filesize
10.0MB
-
Filesize
20KB