Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    145s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/01/2025, 16:23 UTC

General

  • Target

    5dbac8087e1a9a993293737054220a4df7936cf96b171bb23e90a223a33ccc00.exe

  • Size

    110KB

  • MD5

    018d064cd8e33d00ae107d077a380667

  • SHA1

    163c995f97f7c4a70500b0e5a9e792df0991d469

  • SHA256

    5dbac8087e1a9a993293737054220a4df7936cf96b171bb23e90a223a33ccc00

  • SHA512

    d3a7f4fc95a313cc83ee6c1450aba9d3797c6ccae4e039f6a88ff538fcd220ed2abca98a1ff94f54623b0ec3c683ee95396baa551cd4d7ea95692ba04132a1d8

  • SSDEEP

    1536:5iLOvRmmQegJfBbmAQ256/ZrwWnwqjhurmKFcxL8JQ2r0EQ:5iyvRmDLs/ZrwWJjAqGcRJ2hQ

Malware Config

Signatures

  • Tinba / TinyBanker

    Banking trojan which uses packet sniffing to steal data.

  • Tinba family
  • Adds Run key to start application 2 TTPs 1 IoCs
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
      PID:2572
    • C:\Windows\Explorer.EXE
      C:\Windows\Explorer.EXE
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3372
      • C:\Users\Admin\AppData\Local\Temp\5dbac8087e1a9a993293737054220a4df7936cf96b171bb23e90a223a33ccc00.exe
        "C:\Users\Admin\AppData\Local\Temp\5dbac8087e1a9a993293737054220a4df7936cf96b171bb23e90a223a33ccc00.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4616
        • C:\Windows\SysWOW64\winver.exe
          winver
          3⤵
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:1184
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 1184 -s 352
            4⤵
            • Program crash
            PID:4752
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 1184 -ip 1184
      1⤵
        PID:1152

      Network

      • flag-us
        DNS
        241.150.49.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        241.150.49.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        184.115.23.2.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        184.115.23.2.in-addr.arpa
        IN PTR
        Response
        184.115.23.2.in-addr.arpa
        IN PTR
        a2-23-115-184deploystaticakamaitechnologiescom
      • flag-us
        DNS
        68.159.190.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        68.159.190.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        196.249.167.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        196.249.167.52.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        149.220.183.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        149.220.183.52.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        53.210.109.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        53.210.109.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        198.187.3.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        198.187.3.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        75.117.19.2.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        75.117.19.2.in-addr.arpa
        IN PTR
        Response
        75.117.19.2.in-addr.arpa
        IN PTR
        a2-19-117-75deploystaticakamaitechnologiescom
      • flag-us
        DNS
        172.214.232.199.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        172.214.232.199.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        86.49.80.91.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        86.49.80.91.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        30.243.111.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        30.243.111.52.in-addr.arpa
        IN PTR
        Response
      No results found
      • 8.8.8.8:53
        241.150.49.20.in-addr.arpa
        dns
        72 B
        158 B
        1
        1

        DNS Request

        241.150.49.20.in-addr.arpa

      • 8.8.8.8:53
        184.115.23.2.in-addr.arpa
        dns
        71 B
        135 B
        1
        1

        DNS Request

        184.115.23.2.in-addr.arpa

      • 8.8.8.8:53
        68.159.190.20.in-addr.arpa
        dns
        72 B
        158 B
        1
        1

        DNS Request

        68.159.190.20.in-addr.arpa

      • 8.8.8.8:53
        196.249.167.52.in-addr.arpa
        dns
        73 B
        147 B
        1
        1

        DNS Request

        196.249.167.52.in-addr.arpa

      • 8.8.8.8:53
        149.220.183.52.in-addr.arpa
        dns
        73 B
        147 B
        1
        1

        DNS Request

        149.220.183.52.in-addr.arpa

      • 8.8.8.8:53
        53.210.109.20.in-addr.arpa
        dns
        72 B
        158 B
        1
        1

        DNS Request

        53.210.109.20.in-addr.arpa

      • 8.8.8.8:53
        198.187.3.20.in-addr.arpa
        dns
        71 B
        157 B
        1
        1

        DNS Request

        198.187.3.20.in-addr.arpa

      • 8.8.8.8:53
        75.117.19.2.in-addr.arpa
        dns
        70 B
        133 B
        1
        1

        DNS Request

        75.117.19.2.in-addr.arpa

      • 8.8.8.8:53
        172.214.232.199.in-addr.arpa
        dns
        74 B
        128 B
        1
        1

        DNS Request

        172.214.232.199.in-addr.arpa

      • 8.8.8.8:53
        86.49.80.91.in-addr.arpa
        dns
        70 B
        145 B
        1
        1

        DNS Request

        86.49.80.91.in-addr.arpa

      • 8.8.8.8:53
        30.243.111.52.in-addr.arpa
        dns
        72 B
        158 B
        1
        1

        DNS Request

        30.243.111.52.in-addr.arpa

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/1184-5-0x0000000077702000-0x0000000077703000-memory.dmp

        Filesize

        4KB

      • memory/1184-14-0x0000000000DB0000-0x0000000000DB6000-memory.dmp

        Filesize

        24KB

      • memory/1184-11-0x0000000000DB0000-0x0000000000DB6000-memory.dmp

        Filesize

        24KB

      • memory/1184-7-0x00007FF969ED0000-0x00007FF96A0C5000-memory.dmp

        Filesize

        2.0MB

      • memory/2572-13-0x0000000000A60000-0x0000000000A66000-memory.dmp

        Filesize

        24KB

      • memory/3372-2-0x00000000012D0000-0x00000000012D6000-memory.dmp

        Filesize

        24KB

      • memory/3372-6-0x00007FF969F6D000-0x00007FF969F6E000-memory.dmp

        Filesize

        4KB

      • memory/3372-3-0x00000000012D0000-0x00000000012D6000-memory.dmp

        Filesize

        24KB

      • memory/4616-4-0x0000000002210000-0x0000000002C10000-memory.dmp

        Filesize

        10.0MB

      • memory/4616-8-0x0000000000400000-0x000000000041E000-memory.dmp

        Filesize

        120KB

      • memory/4616-9-0x0000000002210000-0x0000000002C10000-memory.dmp

        Filesize

        10.0MB

      • memory/4616-0-0x0000000000400000-0x000000000041E000-memory.dmp

        Filesize

        120KB

      • memory/4616-1-0x00000000004F0000-0x00000000004F1000-memory.dmp

        Filesize

        4KB

      We care about your privacy.

      This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.