Analysis
-
max time kernel
142s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
21-03-2024 12:13
General
-
Target
db98b05e2c1ef05c32c654c40612334d.exe
-
Size
279KB
-
MD5
db98b05e2c1ef05c32c654c40612334d
-
SHA1
1594dba6fa8cf76450ab5b5abbeced3fa70453de
-
SHA256
655e54ce6249faacacd7d980425424bf24f55b47b6774ce7172d06c3986af614
-
SHA512
eaa4d8521a4fd46493a52c9a8e227a8620fcb1f5bd19ddb13998a729e3579a3e68c4ee117043e992ffe5013349bb0e6965f7b42d3b432e450890e5e0de6866dc
-
SSDEEP
6144:JRuNxmk4Hgg6EEVl6YFZ3PCGsSzC+Ui/tW1/u:JMNxb+VEXtf/MPi/tWx
Malware Config
Signatures
-
Modifies security service 2 TTPs 1 IoCs
-
Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
-
Disables taskbar notifications via registry modification
-
Modifies Installed Components in the registry 2 TTPs 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
UPX packed file 8 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 3 IoCs
-
Modifies registry class 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 14 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 15 IoCs
-
Suspicious use of FindShellTrayWindow 28 IoCs
-
Suspicious use of SendNotifyMessage 18 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
System policy modification 1 TTPs 2 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\db98b05e2c1ef05c32c654c40612334d.exe"C:\Users\Admin\AppData\Local\Temp\db98b05e2c1ef05c32c654c40612334d.exe"1⤵
- Modifies security service
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\db98b05e2c1ef05c32c654c40612334d.exeC:\Users\Admin\AppData\Local\Temp\db98b05e2c1ef05c32c654c40612334d.exe startC:\Users\Admin\AppData\Roaming\2E593\9F65B.exe%C:\Users\Admin\AppData\Roaming\2E5932⤵
-
C:\Users\Admin\AppData\Local\Temp\db98b05e2c1ef05c32c654c40612334d.exeC:\Users\Admin\AppData\Local\Temp\db98b05e2c1ef05c32c654c40612334d.exe startC:\Program Files (x86)\931B1\lvvm.exe%C:\Program Files (x86)\931B12⤵
-
C:\Program Files (x86)\LP\5B02\9AD9.tmp"C:\Program Files (x86)\LP\5B02\9AD9.tmp"2⤵
- Executes dropped EXE
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\2E593\31B1.E59Filesize
600B
MD59fba8578b64032778310c4f0d33bc931
SHA192dc1c7a87896c765182b9a47c8166315b20e9eb
SHA256fedd76a398ea7147781c5dd66d217e7e043709b79d20469d3862e1973086f409
SHA5122f9537d86355d713cd0babd4d6fa89e9af5a0ab06dd13c7fc87798b7468ec60dfca21c6df490e7b5059be70be89b36af7e593bba2824b1ee2ba0e09484e1ada4
-
C:\Users\Admin\AppData\Roaming\2E593\31B1.E59Filesize
996B
MD5c62877a28564f547db6d4ff37a69a8bd
SHA1f1e984b5f9c95c70d4e8c3516f373feb1d7ca090
SHA2564464e1bc6eda75d7c47e1b478987e260368cd92f9fb80674cd889f92899065ee
SHA5129b86531234df0f0cf1db0a7179c5a3b7c5e42e0fb569cc72bb334035236de03bcd38f9a90013afc16818e0e904ff586f59c57fe44da8abd863300a79107fcf7c
-
\Program Files (x86)\LP\5B02\9AD9.tmpFilesize
100KB
MD5c4e24788d32ebb00263cb427bfea8169
SHA1593fb420be4cc83ef5a4f33c6458b656a40aac99
SHA2568b7bb24edebd07960302514efd101ba7b7e467436bf84d48c0b877d54c220833
SHA51204e82e212860eee3718b33ca493961180bf1871ea50e36cab97caa395176df91102c2e64d6a6338e89557bc3066cc237e4927f2857e89591f1a08eab83e7248a
-
memory/556-188-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/556-185-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/556-186-0x0000000000500000-0x0000000000600000-memory.dmpFilesize
1024KB
-
memory/776-190-0x0000000004330000-0x0000000004331000-memory.dmpFilesize
4KB
-
memory/776-167-0x0000000004330000-0x0000000004331000-memory.dmpFilesize
4KB
-
memory/1928-169-0x0000000000570000-0x0000000000670000-memory.dmpFilesize
1024KB
-
memory/1928-14-0x0000000000570000-0x0000000000670000-memory.dmpFilesize
1024KB
-
memory/1928-13-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/2380-76-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/2380-192-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/2380-11-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/2380-187-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/2380-1-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/2380-80-0x0000000000250000-0x0000000000350000-memory.dmpFilesize
1024KB
-
memory/2380-2-0x0000000000250000-0x0000000000350000-memory.dmpFilesize
1024KB
-
memory/2828-79-0x00000000005E7000-0x000000000062C000-memory.dmpFilesize
276KB
-
memory/2828-78-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB