Analysis

  • max time kernel
    67s
  • max time network
    53s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/04/2024, 17:07

General

  • Target

    013f51adbdfc57805523576f0864be2d_JaffaCakes118.exe

  • Size

    386KB

  • MD5

    013f51adbdfc57805523576f0864be2d

  • SHA1

    2b1a2b04e027c5b238fe8aef247da0873ea7cc3e

  • SHA256

    e57c9320ec6ae7d2fcb1bdc7d59033411b50fc5d4d28c88137d19fc1edaa279b

  • SHA512

    579970a03258981a9ae879cd351ed8db06d4469dc726a82216886eb883087f7293afbeb2e54d3b2d7e185420517f55fd48740098a8e38291a6adc1f38cd1cbd0

  • SSDEEP

    6144:TjbeifBxa5tFRRpYUcds1xuLhcmhqFecw51q99swY1JGfYIcg/9QmKX7:TuEAPFxZce1xuccq9w51q/sB1JfloOzr

Malware Config

Extracted

Family

pony

C2

http://gregorian.club/ifamandiebyaccident/gate.php

Attributes
  • payload_url

    http://myp0nysite.ru/shit.exe

Signatures

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
  • Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 48 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\013f51adbdfc57805523576f0864be2d_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\013f51adbdfc57805523576f0864be2d_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4140
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z.cmd
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z.cmd
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1544
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z.cmd",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
        3⤵
        • Drops startup file
        PID:3120
      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z.cmd
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z.cmd
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Accesses Microsoft Outlook accounts
        • Accesses Microsoft Outlook profiles
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        • outlook_win_path
        PID:720
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\240619203.bat" "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z.cmd" "
          4⤵
            PID:848

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\240619203.bat

            Filesize

            94B

            MD5

            3880eeb1c736d853eb13b44898b718ab

            SHA1

            4eec9d50360cd815211e3c4e6bdd08271b6ec8e6

            SHA256

            936d9411d5226b7c5a150ecaf422987590a8870c8e095e1caa072273041a86e7

            SHA512

            3eaa3dddd7a11942e75acd44208fbe3d3ff8f4006951cd970fb9ab748c160739409803450d28037e577443504707fc310c634e9dc54d0c25e8cfe6094f017c6b

          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z.cm_

            Filesize

            134KB

            MD5

            6647faa08e188db28e4e53390ffc6d2b

            SHA1

            d59f3f143dd58c02eb1b058ecdd6d4658fc34629

            SHA256

            cf43adb1a0dbda08bebf3ab308a27a37367dd80c560b60ff06bf9d4352edb5f5

            SHA512

            8e19290df23bd148bc55363903f725ecf2e048c0323e4b9419d661aab6add59b3cf6aff3f8d4ed1bc88cb1d396929b39cfb761925ef3f6fa3876a0174171c0e4

          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z.cmd

            Filesize

            556KB

            MD5

            83bc4854b7eafa9c4b600bfa1dabde33

            SHA1

            da2cb1f8e307b42b576d868230f4bef64cb6e7af

            SHA256

            f6c682000e1bdbde52416d3d6e716cca330d531c5374e32c426a13aebfb3252b

            SHA512

            71407994762ca973d7d56b832b1972858f4b7680e78c3f6b745c68455b402b379042b5667b0e8758b5aa4a464572f47293c6fc425ed9ee7f5d80cb0adac7e005

          • memory/720-24-0x0000000000400000-0x0000000000DC4000-memory.dmp

            Filesize

            9.8MB

          • memory/720-17-0x0000000000400000-0x0000000000DC4000-memory.dmp

            Filesize

            9.8MB

          • memory/720-20-0x0000000000400000-0x0000000000DC4000-memory.dmp

            Filesize

            9.8MB

          • memory/720-26-0x0000000000400000-0x0000000000DC4000-memory.dmp

            Filesize

            9.8MB

          • memory/720-25-0x0000000000400000-0x0000000000DC4000-memory.dmp

            Filesize

            9.8MB

          • memory/720-27-0x0000000000400000-0x0000000000DC4000-memory.dmp

            Filesize

            9.8MB

          • memory/720-22-0x0000000000400000-0x0000000000DC4000-memory.dmp

            Filesize

            9.8MB

          • memory/720-23-0x0000000000400000-0x0000000000DC4000-memory.dmp

            Filesize

            9.8MB

          • memory/720-31-0x0000000000400000-0x0000000000DC4000-memory.dmp

            Filesize

            9.8MB

          • memory/1544-14-0x0000000000C50000-0x0000000000C54000-memory.dmp

            Filesize

            16KB

          • memory/1544-15-0x0000000000D30000-0x0000000000D35000-memory.dmp

            Filesize

            20KB