Analysis
-
max time kernel
148s -
max time network
176s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
21-10-2022 04:11
General
-
Target
07b9eb901cea5bccc30c42fcae981bc87b97a3808e1869379b360e6defe9f941.exe
-
Size
92KB
-
MD5
4d11068c86c1adb1b3a2520689dcc0e0
-
SHA1
f1a64ae0337d455a7ba5310937a8d72a85262a67
-
SHA256
07b9eb901cea5bccc30c42fcae981bc87b97a3808e1869379b360e6defe9f941
-
SHA512
8bbd6776f648ca5dd4a03e76ec000fc08d6c9243331e730e37d6fcf7eee2222ed87c3fe1a1f7fee9b31c4b454e38dffd0caea1c1173bd46d33043b1b0655daa7
-
SSDEEP
1536:4SgLEGdqTWYcxHtQCxHyVZim8JdBmeyl5HsTvNEAmkZI7+:4dv9CRVZL8PL8YEAtI7+
Malware Config
Signatures
-
Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\07b9eb901cea5bccc30c42fcae981bc87b97a3808e1869379b360e6defe9f941.exe"C:\Users\Admin\AppData\Local\Temp\07b9eb901cea5bccc30c42fcae981bc87b97a3808e1869379b360e6defe9f941.exe"1⤵
- Suspicious use of AdjustPrivilegeToken