Analysis
-
max time kernel
157s -
max time network
182s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
19/09/2022, 15:11
General
-
Target
91a216f9a5729656edf38b8b2242db0fc1c619bd8779e7661f126705251fe4b3.exe
-
Size
178KB
-
MD5
022071261308398bd7f1b0f736862694
-
SHA1
be445d8129f8baeb2ce0e93f7c476671320761ac
-
SHA256
91a216f9a5729656edf38b8b2242db0fc1c619bd8779e7661f126705251fe4b3
-
SHA512
32ec6a68b58c04cddffc7f4615ab8f0952b534202d05db95012ad889a22974f82858ced8a3d30b9645ee8c83f6f0b62c2272782c672bc6794c6029d354c70594
-
SSDEEP
3072:xO1eji5yoSfDGPPfRWtbBoj40dZuUAE1br+Fh:YAji5yoSfDGPQtbij1fH+z
Malware Config
Signatures
-
Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\91a216f9a5729656edf38b8b2242db0fc1c619bd8779e7661f126705251fe4b3.exe"C:\Users\Admin\AppData\Local\Temp\91a216f9a5729656edf38b8b2242db0fc1c619bd8779e7661f126705251fe4b3.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
192KB
-
Filesize
92KB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
192KB