Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    19s
  • max time network
    46s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    04/10/2022, 07:33

General

  • Target

    37469ba9c58812654f7f55177d0cdc41d5b85719e6a21cf93460f68afc5b7981.exe

  • Size

    114KB

  • MD5

    1cb878ef72cbabb088bd248eb1501dbf

  • SHA1

    68015afacdf8421bc2b477077ddafa24dd5f6c80

  • SHA256

    37469ba9c58812654f7f55177d0cdc41d5b85719e6a21cf93460f68afc5b7981

  • SHA512

    56a5e81f080bd9aac267ad7638c97a425f93857b3b3a60144d74c8dd49346573ce62b7433c97251a9dc40b4baa3d793b95596ab51f96543758ceb140da00c939

  • SSDEEP

    3072:/XAtWYKBlVdw1GBcMc0ToVAs6moAiXkj2Xa7UK9:fAoYKXVdwcjc0W04y

Malware Config

Extracted

Family

pony

C2

http://etsiunjour.fr:81/pony/gate.php

http://209.59.217.36/pony/gate.php

Attributes
  • payload_url

    http://alcaponecigarillos.com/RdKtpaU.exe

    http://artseo.abetka.kiev.ua/urS1R.exe

    http://hunterland.com.ua/MTgQrd.exe

Signatures

  • Cobaltstrike

    Detected malicious payload which is part of Cobaltstrike.

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\37469ba9c58812654f7f55177d0cdc41d5b85719e6a21cf93460f68afc5b7981.exe
    "C:\Users\Admin\AppData\Local\Temp\37469ba9c58812654f7f55177d0cdc41d5b85719e6a21cf93460f68afc5b7981.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:948
    • C:\Users\Admin\AppData\Local\Temp\37469ba9c58812654f7f55177d0cdc41d5b85719e6a21cf93460f68afc5b7981.exe
      "C:\Users\Admin\AppData\Local\Temp\37469ba9c58812654f7f55177d0cdc41d5b85719e6a21cf93460f68afc5b7981.exe"
      2⤵
        PID:1464

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/948-54-0x0000000000340000-0x000000000035F000-memory.dmp

      Filesize

      124KB

    • memory/948-55-0x0000000000340000-0x000000000035F000-memory.dmp

      Filesize

      124KB