Analysis
-
max time kernel
133s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
-
submitted
04-12-2022 07:02
General
-
Target
aceb88a55e60b1b79ed5e93b55b0aa4ee6bc5b29a18d8af62aa1674a76e8ff12.exe
-
Size
94KB
-
MD5
6ecaee4601bcaf46f5545011a262ef0c
-
SHA1
eebede47b3548a9813da2a1bec04cc6b1b79d12a
-
SHA256
aceb88a55e60b1b79ed5e93b55b0aa4ee6bc5b29a18d8af62aa1674a76e8ff12
-
SHA512
b6453cdb44cce0de0b0df14dba4c4bb4082332483bb3cdc61f814a50dcf28d6ae7c4bca064aa90ce4697130e10f27f1915b875a7eccfe5d4fb45715f3183de4b
-
SSDEEP
1536:Zlf7T748URvaL1eSyQaygqTnA+ylbCD2M7DuY1qV1FqBwFpT83pB/oXrRSq:PP3URvaLkSyQayNTA+czKuY1a1QBupTz
Malware Config
Signatures
-
Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\aceb88a55e60b1b79ed5e93b55b0aa4ee6bc5b29a18d8af62aa1674a76e8ff12.exe"C:\Users\Admin\AppData\Local\Temp\aceb88a55e60b1b79ed5e93b55b0aa4ee6bc5b29a18d8af62aa1674a76e8ff12.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
92KB
-
Filesize
104KB
-
Filesize
104KB
-
Filesize
104KB