Analysis
-
max time kernel
57s -
max time network
62s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
14-05-2022 13:50
Static task
static1
Behavioral task
behavioral1
Sample
ac2362bfb043929f138f0ed947f81fa8444fd87b2301ecaa9a837e86f6eca690.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
ac2362bfb043929f138f0ed947f81fa8444fd87b2301ecaa9a837e86f6eca690.exe
Resource
win10v2004-20220414-en
General
-
Target
ac2362bfb043929f138f0ed947f81fa8444fd87b2301ecaa9a837e86f6eca690.exe
-
Size
324KB
-
MD5
08042d58bdf1d88cabd4466441359ab6
-
SHA1
ddedbdc510770f9b6ecf60fabdc924ae26ce679d
-
SHA256
ac2362bfb043929f138f0ed947f81fa8444fd87b2301ecaa9a837e86f6eca690
-
SHA512
65a287b3d2fe29cb226f397b93a1117a5185a0f4cfcd1360ff89e06adbaa516f1ad7a22eb62e9808bd4dc1603583cc5bddbbb3878224838cd407dfe9f20b1d7b
Malware Config
Extracted
pony
http://srae.co.in/js./gretings/gate.php
Signatures
-
suricata: ET MALWARE Fareit/Pony Downloader Checkin 3
suricata: ET MALWARE Fareit/Pony Downloader Checkin 3
-
suricata: ET MALWARE Pony Downloader HTTP Library MSIE 5 Win98
suricata: ET MALWARE Pony Downloader HTTP Library MSIE 5 Win98
-
Executes dropped EXE 2 IoCs
Processes:
M.exeM.exepid process 1508 M.exe 952 M.exe -
Processes:
resource yara_rule behavioral1/memory/952-67-0x0000000000400000-0x0000000000EF0000-memory.dmp upx behavioral1/memory/952-70-0x0000000000400000-0x0000000000EF0000-memory.dmp upx behavioral1/memory/952-71-0x0000000000400000-0x0000000000EF0000-memory.dmp upx behavioral1/memory/952-74-0x0000000000400000-0x0000000000EF0000-memory.dmp upx behavioral1/memory/952-75-0x0000000000400000-0x0000000000EF0000-memory.dmp upx behavioral1/memory/952-82-0x0000000000400000-0x0000000000EF0000-memory.dmp upx behavioral1/memory/952-85-0x0000000000400000-0x0000000000EF0000-memory.dmp upx behavioral1/memory/952-87-0x0000000000400000-0x0000000000EF0000-memory.dmp upx behavioral1/memory/952-89-0x0000000000400000-0x000000000041C000-memory.dmp upx -
Loads dropped DLL 5 IoCs
Processes:
ac2362bfb043929f138f0ed947f81fa8444fd87b2301ecaa9a837e86f6eca690.exeM.exeM.exepid process 1276 ac2362bfb043929f138f0ed947f81fa8444fd87b2301ecaa9a837e86f6eca690.exe 1276 ac2362bfb043929f138f0ed947f81fa8444fd87b2301ecaa9a837e86f6eca690.exe 1508 M.exe 1508 M.exe 952 M.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
M.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts M.exe -
Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
Processes:
M.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook M.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
ac2362bfb043929f138f0ed947f81fa8444fd87b2301ecaa9a837e86f6eca690.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce ac2362bfb043929f138f0ed947f81fa8444fd87b2301ecaa9a837e86f6eca690.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" ac2362bfb043929f138f0ed947f81fa8444fd87b2301ecaa9a837e86f6eca690.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
M.exedescription pid process target process PID 1508 set thread context of 952 1508 M.exe M.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
M.exepid process 1508 M.exe -
Suspicious use of AdjustPrivilegeToken 32 IoCs
Processes:
M.exedescription pid process Token: SeImpersonatePrivilege 952 M.exe Token: SeTcbPrivilege 952 M.exe Token: SeChangeNotifyPrivilege 952 M.exe Token: SeCreateTokenPrivilege 952 M.exe Token: SeBackupPrivilege 952 M.exe Token: SeRestorePrivilege 952 M.exe Token: SeIncreaseQuotaPrivilege 952 M.exe Token: SeAssignPrimaryTokenPrivilege 952 M.exe Token: SeImpersonatePrivilege 952 M.exe Token: SeTcbPrivilege 952 M.exe Token: SeChangeNotifyPrivilege 952 M.exe Token: SeCreateTokenPrivilege 952 M.exe Token: SeBackupPrivilege 952 M.exe Token: SeRestorePrivilege 952 M.exe Token: SeIncreaseQuotaPrivilege 952 M.exe Token: SeAssignPrimaryTokenPrivilege 952 M.exe Token: SeImpersonatePrivilege 952 M.exe Token: SeTcbPrivilege 952 M.exe Token: SeChangeNotifyPrivilege 952 M.exe Token: SeCreateTokenPrivilege 952 M.exe Token: SeBackupPrivilege 952 M.exe Token: SeRestorePrivilege 952 M.exe Token: SeIncreaseQuotaPrivilege 952 M.exe Token: SeAssignPrimaryTokenPrivilege 952 M.exe Token: SeImpersonatePrivilege 952 M.exe Token: SeTcbPrivilege 952 M.exe Token: SeChangeNotifyPrivilege 952 M.exe Token: SeCreateTokenPrivilege 952 M.exe Token: SeBackupPrivilege 952 M.exe Token: SeRestorePrivilege 952 M.exe Token: SeIncreaseQuotaPrivilege 952 M.exe Token: SeAssignPrimaryTokenPrivilege 952 M.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
M.exepid process 1508 M.exe 1508 M.exe -
Suspicious use of WriteProcessMemory 49 IoCs
Processes:
ac2362bfb043929f138f0ed947f81fa8444fd87b2301ecaa9a837e86f6eca690.exeM.execmd.exenet.exeM.exedescription pid process target process PID 1276 wrote to memory of 1508 1276 ac2362bfb043929f138f0ed947f81fa8444fd87b2301ecaa9a837e86f6eca690.exe M.exe PID 1276 wrote to memory of 1508 1276 ac2362bfb043929f138f0ed947f81fa8444fd87b2301ecaa9a837e86f6eca690.exe M.exe PID 1276 wrote to memory of 1508 1276 ac2362bfb043929f138f0ed947f81fa8444fd87b2301ecaa9a837e86f6eca690.exe M.exe PID 1276 wrote to memory of 1508 1276 ac2362bfb043929f138f0ed947f81fa8444fd87b2301ecaa9a837e86f6eca690.exe M.exe PID 1276 wrote to memory of 1508 1276 ac2362bfb043929f138f0ed947f81fa8444fd87b2301ecaa9a837e86f6eca690.exe M.exe PID 1276 wrote to memory of 1508 1276 ac2362bfb043929f138f0ed947f81fa8444fd87b2301ecaa9a837e86f6eca690.exe M.exe PID 1276 wrote to memory of 1508 1276 ac2362bfb043929f138f0ed947f81fa8444fd87b2301ecaa9a837e86f6eca690.exe M.exe PID 1508 wrote to memory of 1632 1508 M.exe cmd.exe PID 1508 wrote to memory of 1632 1508 M.exe cmd.exe PID 1508 wrote to memory of 1632 1508 M.exe cmd.exe PID 1508 wrote to memory of 1632 1508 M.exe cmd.exe PID 1508 wrote to memory of 1632 1508 M.exe cmd.exe PID 1508 wrote to memory of 1632 1508 M.exe cmd.exe PID 1508 wrote to memory of 1632 1508 M.exe cmd.exe PID 1508 wrote to memory of 952 1508 M.exe M.exe PID 1508 wrote to memory of 952 1508 M.exe M.exe PID 1508 wrote to memory of 952 1508 M.exe M.exe PID 1508 wrote to memory of 952 1508 M.exe M.exe PID 1508 wrote to memory of 952 1508 M.exe M.exe PID 1508 wrote to memory of 952 1508 M.exe M.exe PID 1508 wrote to memory of 952 1508 M.exe M.exe PID 1508 wrote to memory of 952 1508 M.exe M.exe PID 1508 wrote to memory of 952 1508 M.exe M.exe PID 1508 wrote to memory of 952 1508 M.exe M.exe PID 1508 wrote to memory of 952 1508 M.exe M.exe PID 1508 wrote to memory of 952 1508 M.exe M.exe PID 1508 wrote to memory of 952 1508 M.exe M.exe PID 1508 wrote to memory of 952 1508 M.exe M.exe PID 1632 wrote to memory of 908 1632 cmd.exe net.exe PID 1632 wrote to memory of 908 1632 cmd.exe net.exe PID 1632 wrote to memory of 908 1632 cmd.exe net.exe PID 1632 wrote to memory of 908 1632 cmd.exe net.exe PID 1632 wrote to memory of 908 1632 cmd.exe net.exe PID 1632 wrote to memory of 908 1632 cmd.exe net.exe PID 1632 wrote to memory of 908 1632 cmd.exe net.exe PID 908 wrote to memory of 1688 908 net.exe net1.exe PID 908 wrote to memory of 1688 908 net.exe net1.exe PID 908 wrote to memory of 1688 908 net.exe net1.exe PID 908 wrote to memory of 1688 908 net.exe net1.exe PID 908 wrote to memory of 1688 908 net.exe net1.exe PID 908 wrote to memory of 1688 908 net.exe net1.exe PID 908 wrote to memory of 1688 908 net.exe net1.exe PID 952 wrote to memory of 1772 952 M.exe cmd.exe PID 952 wrote to memory of 1772 952 M.exe cmd.exe PID 952 wrote to memory of 1772 952 M.exe cmd.exe PID 952 wrote to memory of 1772 952 M.exe cmd.exe PID 952 wrote to memory of 1772 952 M.exe cmd.exe PID 952 wrote to memory of 1772 952 M.exe cmd.exe PID 952 wrote to memory of 1772 952 M.exe cmd.exe -
outlook_win_path 1 IoCs
Processes:
M.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook M.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ac2362bfb043929f138f0ed947f81fa8444fd87b2301ecaa9a837e86f6eca690.exe"C:\Users\Admin\AppData\Local\Temp\ac2362bfb043929f138f0ed947f81fa8444fd87b2301ecaa9a837e86f6eca690.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c net stop MpsSvc3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet stop MpsSvc4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MpsSvc5⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_win_path
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\7143706.bat" "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe" "4⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7143706.batFilesize
94B
MD53880eeb1c736d853eb13b44898b718ab
SHA14eec9d50360cd815211e3c4e6bdd08271b6ec8e6
SHA256936d9411d5226b7c5a150ecaf422987590a8870c8e095e1caa072273041a86e7
SHA5123eaa3dddd7a11942e75acd44208fbe3d3ff8f4006951cd970fb9ab748c160739409803450d28037e577443504707fc310c634e9dc54d0c25e8cfe6094f017c6b
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.ex_Filesize
118KB
MD52d5d8ed8f5a84c1d3abd0ac7111dd2e5
SHA1ceb9ebaf6d0f951de00e369928d4265ccb1b0cf6
SHA256e78fe9da8eba4b40022fd2313548bcb69cc77fc72b0f9cf3564b292d75f2d452
SHA51219b7580ec916a5cb87d56c9f9769abddd838335b88cafbf82f4d1111bad94e642e731fe3cf8e95474e546f5e1b01cbdb9b9ffd0f036b62238d96b192b9490a2d
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exeFilesize
312KB
MD5eb4ff1edb2833c1e164b2522546587a4
SHA1b81c37033c1139dbd53c72d928a9f7b21163404a
SHA2563cbd268e38b13d6b0293926bc12b203d02ffd1ae3473dd499a90282791c52646
SHA512c70fef76d0cd4c7ba6f4ea7ee40de7c7f1e876fb9968bea0080cd6bf292529487bcf5fce53ed0ed77fb3252e92710ee494b58146624df5141af9ce4722263408
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exeFilesize
312KB
MD5eb4ff1edb2833c1e164b2522546587a4
SHA1b81c37033c1139dbd53c72d928a9f7b21163404a
SHA2563cbd268e38b13d6b0293926bc12b203d02ffd1ae3473dd499a90282791c52646
SHA512c70fef76d0cd4c7ba6f4ea7ee40de7c7f1e876fb9968bea0080cd6bf292529487bcf5fce53ed0ed77fb3252e92710ee494b58146624df5141af9ce4722263408
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exeFilesize
312KB
MD5eb4ff1edb2833c1e164b2522546587a4
SHA1b81c37033c1139dbd53c72d928a9f7b21163404a
SHA2563cbd268e38b13d6b0293926bc12b203d02ffd1ae3473dd499a90282791c52646
SHA512c70fef76d0cd4c7ba6f4ea7ee40de7c7f1e876fb9968bea0080cd6bf292529487bcf5fce53ed0ed77fb3252e92710ee494b58146624df5141af9ce4722263408
-
\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exeFilesize
312KB
MD5eb4ff1edb2833c1e164b2522546587a4
SHA1b81c37033c1139dbd53c72d928a9f7b21163404a
SHA2563cbd268e38b13d6b0293926bc12b203d02ffd1ae3473dd499a90282791c52646
SHA512c70fef76d0cd4c7ba6f4ea7ee40de7c7f1e876fb9968bea0080cd6bf292529487bcf5fce53ed0ed77fb3252e92710ee494b58146624df5141af9ce4722263408
-
\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exeFilesize
312KB
MD5eb4ff1edb2833c1e164b2522546587a4
SHA1b81c37033c1139dbd53c72d928a9f7b21163404a
SHA2563cbd268e38b13d6b0293926bc12b203d02ffd1ae3473dd499a90282791c52646
SHA512c70fef76d0cd4c7ba6f4ea7ee40de7c7f1e876fb9968bea0080cd6bf292529487bcf5fce53ed0ed77fb3252e92710ee494b58146624df5141af9ce4722263408
-
\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exeFilesize
312KB
MD5eb4ff1edb2833c1e164b2522546587a4
SHA1b81c37033c1139dbd53c72d928a9f7b21163404a
SHA2563cbd268e38b13d6b0293926bc12b203d02ffd1ae3473dd499a90282791c52646
SHA512c70fef76d0cd4c7ba6f4ea7ee40de7c7f1e876fb9968bea0080cd6bf292529487bcf5fce53ed0ed77fb3252e92710ee494b58146624df5141af9ce4722263408
-
\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exeFilesize
312KB
MD5eb4ff1edb2833c1e164b2522546587a4
SHA1b81c37033c1139dbd53c72d928a9f7b21163404a
SHA2563cbd268e38b13d6b0293926bc12b203d02ffd1ae3473dd499a90282791c52646
SHA512c70fef76d0cd4c7ba6f4ea7ee40de7c7f1e876fb9968bea0080cd6bf292529487bcf5fce53ed0ed77fb3252e92710ee494b58146624df5141af9ce4722263408
-
\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exeFilesize
312KB
MD5eb4ff1edb2833c1e164b2522546587a4
SHA1b81c37033c1139dbd53c72d928a9f7b21163404a
SHA2563cbd268e38b13d6b0293926bc12b203d02ffd1ae3473dd499a90282791c52646
SHA512c70fef76d0cd4c7ba6f4ea7ee40de7c7f1e876fb9968bea0080cd6bf292529487bcf5fce53ed0ed77fb3252e92710ee494b58146624df5141af9ce4722263408
-
memory/908-77-0x0000000000000000-mapping.dmp
-
memory/952-71-0x0000000000400000-0x0000000000EF0000-memory.dmpFilesize
10.9MB
-
memory/952-65-0x0000000000300000-0x0000000000400000-memory.dmpFilesize
1024KB
-
memory/952-70-0x0000000000400000-0x0000000000EF0000-memory.dmpFilesize
10.9MB
-
memory/952-89-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/952-87-0x0000000000400000-0x0000000000EF0000-memory.dmpFilesize
10.9MB
-
memory/952-74-0x0000000000400000-0x0000000000EF0000-memory.dmpFilesize
10.9MB
-
memory/952-75-0x0000000000400000-0x0000000000EF0000-memory.dmpFilesize
10.9MB
-
memory/952-76-0x000000000041A110-mapping.dmp
-
memory/952-66-0x0000000000400000-0x0000000000EF0000-memory.dmpFilesize
10.9MB
-
memory/952-67-0x0000000000400000-0x0000000000EF0000-memory.dmpFilesize
10.9MB
-
memory/952-82-0x0000000000400000-0x0000000000EF0000-memory.dmpFilesize
10.9MB
-
memory/952-85-0x0000000000400000-0x0000000000EF0000-memory.dmpFilesize
10.9MB
-
memory/1276-54-0x0000000075E41000-0x0000000075E43000-memory.dmpFilesize
8KB
-
memory/1508-72-0x00000000002D0000-0x00000000002D5000-memory.dmpFilesize
20KB
-
memory/1508-57-0x0000000000000000-mapping.dmp
-
memory/1632-63-0x0000000000000000-mapping.dmp
-
memory/1688-86-0x0000000000000000-mapping.dmp
-
memory/1772-90-0x0000000000000000-mapping.dmp