Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    10-01-2025 01:43

General

  • Target

    JaffaCakes118_d7a158528d8f5bcb1d162756abe5a930.exe

  • Size

    34KB

  • MD5

    d7a158528d8f5bcb1d162756abe5a930

  • SHA1

    3e933cc7507b007e13ac8dc06af6437aa3eead9b

  • SHA256

    8064eebb7e87256c9356e47495b031a9180c5579bd56d12c8ecf3ecb53f6e983

  • SHA512

    c5f1a0f3fea0749431e477d128f27890be286a277644ec70c3185db1d81a97cd73630432bf2ad02907679dbb15b6ce81800f64ebfacdaac1cb68556d767e7810

  • SSDEEP

    768:jp22qWFcy5XQ7lO41uirwA98p3MpkNBxd0cJWV6dy/x9J2:jpYoX58z1uirL98xMWnT0OQ9J2

Malware Config

Signatures

  • Tinba / TinyBanker

    Banking trojan which uses packet sniffing to steal data.

  • Tinba family
  • Adds Run key to start application 2 TTPs 1 IoCs
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    1⤵
      PID:1108
    • C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      1⤵
        PID:1168
      • C:\Windows\Explorer.EXE
        C:\Windows\Explorer.EXE
        1⤵
          PID:1192
          • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d7a158528d8f5bcb1d162756abe5a930.exe
            "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d7a158528d8f5bcb1d162756abe5a930.exe"
            2⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2172
            • C:\Windows\SysWOW64\winver.exe
              winver
              3⤵
              • Adds Run key to start application
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of WriteProcessMemory
              PID:2276
        • C:\Windows\system32\DllHost.exe
          C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
          1⤵
            PID:1592

          Network

          • flag-us
            DNS
            spaines.pw
            winver.exe
            Remote address:
            8.8.8.8:53
            Request
            spaines.pw
            IN A
            Response
            spaines.pw
            IN A
            216.218.185.162
          • flag-us
            POST
            http://spaines.pw/EiDQjNbWEQ/
            winver.exe
            Remote address:
            216.218.185.162:80
            Request
            POST /EiDQjNbWEQ/ HTTP/1.0
            Host: spaines.pw
            Content-Length: 157
            Response
            HTTP/1.1 200 OK
            Server: nginx/1.21.6
            Date: Fri, 10 Jan 2025 01:43:51 GMT
            Content-Type: application/octet-stream
            Connection: close
          • 216.218.185.162:80
            http://spaines.pw/EiDQjNbWEQ/
            http
            winver.exe
            1.5kB
            1.2kB
            27
            27

            HTTP Request

            POST http://spaines.pw/EiDQjNbWEQ/

            HTTP Response

            200
          • 8.8.8.8:53
            spaines.pw
            dns
            winver.exe
            56 B
            72 B
            1
            1

            DNS Request

            spaines.pw

            DNS Response

            216.218.185.162

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/1108-24-0x0000000077361000-0x0000000077362000-memory.dmp

            Filesize

            4KB

          • memory/1108-23-0x0000000001B00000-0x0000000001B06000-memory.dmp

            Filesize

            24KB

          • memory/1168-27-0x0000000001C30000-0x0000000001C36000-memory.dmp

            Filesize

            24KB

          • memory/1168-20-0x0000000001C30000-0x0000000001C36000-memory.dmp

            Filesize

            24KB

          • memory/1192-10-0x0000000077361000-0x0000000077362000-memory.dmp

            Filesize

            4KB

          • memory/1192-22-0x00000000021D0000-0x00000000021D6000-memory.dmp

            Filesize

            24KB

          • memory/1192-2-0x0000000002A20000-0x0000000002A26000-memory.dmp

            Filesize

            24KB

          • memory/1192-3-0x0000000002A20000-0x0000000002A26000-memory.dmp

            Filesize

            24KB

          • memory/1192-4-0x0000000002A20000-0x0000000002A26000-memory.dmp

            Filesize

            24KB

          • memory/1192-25-0x00000000021D0000-0x00000000021D6000-memory.dmp

            Filesize

            24KB

          • memory/1592-31-0x0000000001D60000-0x0000000001D66000-memory.dmp

            Filesize

            24KB

          • memory/1592-32-0x0000000077361000-0x0000000077362000-memory.dmp

            Filesize

            4KB

          • memory/2172-5-0x0000000001B40000-0x0000000002540000-memory.dmp

            Filesize

            10.0MB

          • memory/2172-0-0x0000000000400000-0x0000000000417000-memory.dmp

            Filesize

            92KB

          • memory/2172-12-0x0000000000400000-0x0000000000417000-memory.dmp

            Filesize

            92KB

          • memory/2172-13-0x0000000001B40000-0x0000000002540000-memory.dmp

            Filesize

            10.0MB

          • memory/2172-1-0x0000000000020000-0x0000000000021000-memory.dmp

            Filesize

            4KB

          • memory/2276-8-0x000000007750F000-0x0000000077510000-memory.dmp

            Filesize

            4KB

          • memory/2276-26-0x0000000000140000-0x0000000000146000-memory.dmp

            Filesize

            24KB

          • memory/2276-7-0x0000000077510000-0x0000000077511000-memory.dmp

            Filesize

            4KB

          • memory/2276-9-0x000000007750F000-0x0000000077511000-memory.dmp

            Filesize

            8KB

          • memory/2276-11-0x0000000077310000-0x00000000774B9000-memory.dmp

            Filesize

            1.7MB

          • memory/2276-6-0x0000000000140000-0x0000000000146000-memory.dmp

            Filesize

            24KB

          We care about your privacy.

          This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.