Analysis
-
max time kernel
135s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
-
submitted
19/09/2022, 15:18
General
-
Target
7261fe803f52d69a22899fb8306a10c42bff2947b7af18afe839ad1ecbf77e63.exe
-
Size
144KB
-
MD5
5da0ddd279421c44cd26cb8575b9ba4a
-
SHA1
ce6472f0f4938d79cfcfa831b9526643eeb61c1c
-
SHA256
7261fe803f52d69a22899fb8306a10c42bff2947b7af18afe839ad1ecbf77e63
-
SHA512
58846e2c8b6d2de11525f533869b93752b8b6891783122b5c4edd982719537eb40df2d632e5b3e2ee546aa54e450ae8a15941136b09fa6588e1fecd39db967e7
-
SSDEEP
1536:Ie6HSGeDNFYBB93+22yxQCkDTGHVXojEW8LmJQxH8+sx007uRdEGt0nOrk50OBMf:IR9Br3+Ax4DiHVYjEXJB8+b0SAW7FOxS
Malware Config
Signatures
-
Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7261fe803f52d69a22899fb8306a10c42bff2947b7af18afe839ad1ecbf77e63.exe"C:\Users\Admin\AppData\Local\Temp\7261fe803f52d69a22899fb8306a10c42bff2947b7af18afe839ad1ecbf77e63.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
92KB
-
Filesize
156KB
-
Filesize
156KB
-
Filesize
156KB