Analysis
-
max time kernel
150s -
max time network
161s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
02-10-2022 13:08
Static task
static1
Behavioral task
behavioral1
Sample
77331b3a635d0c96f39b319be61a4d8e592824a9ba97d8649923537c1fe5113f.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
77331b3a635d0c96f39b319be61a4d8e592824a9ba97d8649923537c1fe5113f.exe
Resource
win10v2004-20220812-en
General
-
Target
77331b3a635d0c96f39b319be61a4d8e592824a9ba97d8649923537c1fe5113f.exe
-
Size
117KB
-
MD5
71e74c5e225913dd7e4cfe6677309c00
-
SHA1
dcc1c6ef129d7773293465ef6b1a2b2468d47d60
-
SHA256
77331b3a635d0c96f39b319be61a4d8e592824a9ba97d8649923537c1fe5113f
-
SHA512
8c7c8558c7f55591fc19324e990f588c67ba7b7e55ef0f8571f48e702946b8d1710f74aa1b9d3aaeac59168c39735346ddb46afe254adeecab95b3d69c2d7805
-
SSDEEP
3072:o5nzVcKPkfPelKp2ZAv3eZE5AP692Ff8BQ+EnDzr:o5nzVpGPpp/eZEaCc58oD
Malware Config
Extracted
pony
http://bestmedicalproducts.org/ponyz/gate.php
http://promedspecialties.com/ponyz/gate.php
http://agrimulch.com/ponyz/gate.php
http://biomulch.co.uk/ponyz/gate.php
-
payload_url
http://ftp.lithotipiki.gr/6i7Kec.exe
http://workingschool.dk/Ndq.exe
http://www.sprinterviaggi.com/mWRvj.exe
Signatures
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
77331b3a635d0c96f39b319be61a4d8e592824a9ba97d8649923537c1fe5113f.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts 77331b3a635d0c96f39b319be61a4d8e592824a9ba97d8649923537c1fe5113f.exe -
Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
Processes:
77331b3a635d0c96f39b319be61a4d8e592824a9ba97d8649923537c1fe5113f.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 77331b3a635d0c96f39b319be61a4d8e592824a9ba97d8649923537c1fe5113f.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
77331b3a635d0c96f39b319be61a4d8e592824a9ba97d8649923537c1fe5113f.exedescription pid process Token: SeImpersonatePrivilege 2032 77331b3a635d0c96f39b319be61a4d8e592824a9ba97d8649923537c1fe5113f.exe Token: SeTcbPrivilege 2032 77331b3a635d0c96f39b319be61a4d8e592824a9ba97d8649923537c1fe5113f.exe Token: SeChangeNotifyPrivilege 2032 77331b3a635d0c96f39b319be61a4d8e592824a9ba97d8649923537c1fe5113f.exe Token: SeCreateTokenPrivilege 2032 77331b3a635d0c96f39b319be61a4d8e592824a9ba97d8649923537c1fe5113f.exe Token: SeBackupPrivilege 2032 77331b3a635d0c96f39b319be61a4d8e592824a9ba97d8649923537c1fe5113f.exe Token: SeRestorePrivilege 2032 77331b3a635d0c96f39b319be61a4d8e592824a9ba97d8649923537c1fe5113f.exe Token: SeIncreaseQuotaPrivilege 2032 77331b3a635d0c96f39b319be61a4d8e592824a9ba97d8649923537c1fe5113f.exe Token: SeAssignPrimaryTokenPrivilege 2032 77331b3a635d0c96f39b319be61a4d8e592824a9ba97d8649923537c1fe5113f.exe -
outlook_win_path 1 IoCs
Processes:
77331b3a635d0c96f39b319be61a4d8e592824a9ba97d8649923537c1fe5113f.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 77331b3a635d0c96f39b319be61a4d8e592824a9ba97d8649923537c1fe5113f.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\77331b3a635d0c96f39b319be61a4d8e592824a9ba97d8649923537c1fe5113f.exe"C:\Users\Admin\AppData\Local\Temp\77331b3a635d0c96f39b319be61a4d8e592824a9ba97d8649923537c1fe5113f.exe"1⤵
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- outlook_win_path
PID:2032