Analysis

  • max time kernel
    69s
  • max time network
    53s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/04/2024, 00:38

Errors

Reason
Machine shutdown

General

  • Target

    0204e2465371377f2387d1f149616917_JaffaCakes118.exe

  • Size

    2.2MB

  • MD5

    0204e2465371377f2387d1f149616917

  • SHA1

    9d459b959107d2f55eb19ab160aee8e29404c2dd

  • SHA256

    cfcab6159d2a014d4aa30e82e3303fc1a885e5045dc71c5a1329abed821ff154

  • SHA512

    5a13c7e0bc654a61f95f5253f5976c5543fd03755e9c33c7dc938e107aa7b67e6837666266a597e8f3a8bba78c62447fd3e728ca82e79da2af466734331f0e98

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZp:0UzeyQMS4DqodCnoe+iitjWwwd

Malware Config

Extracted

Family

pony

C2

http://don.service-master.eu/gate.php

Attributes
  • payload_url

    http://don.service-master.eu/shit.exe

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

  • Modifies Installed Components in the registry 2 TTPs 2 IoCs
  • Drops startup file 2 IoCs
  • Executes dropped EXE 15 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 17 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 28 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 54 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0204e2465371377f2387d1f149616917_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\0204e2465371377f2387d1f149616917_JaffaCakes118.exe"
    1⤵
    • Drops startup file
    • Suspicious use of SetThreadContext
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:1096
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:3408
      • C:\Users\Admin\AppData\Local\Temp\0204e2465371377f2387d1f149616917_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\0204e2465371377f2387d1f149616917_JaffaCakes118.exe"
        2⤵
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1052
        • \??\c:\windows\system\explorer.exe
          c:\windows\system\explorer.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Drops file in Windows directory
          • Suspicious use of WriteProcessMemory
          PID:780
          • \??\c:\windows\system\explorer.exe
            "c:\windows\system\explorer.exe"
            4⤵
            • Modifies WinLogon for persistence
            • Modifies visiblity of hidden/system files in Explorer
            • Modifies Installed Components in the registry
            • Executes dropped EXE
            • Adds Run key to start application
            • Drops file in Windows directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:4628
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Drops file in Windows directory
              PID:4636
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Drops file in Windows directory
              PID:1176
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Drops file in Windows directory
              PID:4668
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Drops file in Windows directory
              PID:2556
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Drops file in Windows directory
              PID:4704
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Drops file in Windows directory
              PID:776
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Drops file in Windows directory
              PID:4300
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Drops file in Windows directory
              PID:1516
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Drops file in Windows directory
              PID:3900
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Drops file in Windows directory
              PID:3580
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Drops file in Windows directory
              PID:2128
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Drops file in Windows directory
              PID:3864
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              PID:4788
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
      1⤵
        PID:932

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Windows\Parameters.ini

              Filesize

              74B

              MD5

              6687785d6a31cdf9a5f80acb3abc459b

              SHA1

              1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9

              SHA256

              3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b

              SHA512

              5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962

            • C:\Windows\System\explorer.exe

              Filesize

              2.2MB

              MD5

              e0ab8dd44af5fcd814bfc2fdb1d43729

              SHA1

              f8505f0f88f09dc1671b661ba0ae3606a84ed3c1

              SHA256

              ab2635c382d39d4299429e09cef37ba5a583df64f7a16654e5ab55c6f311c96d

              SHA512

              db82f8882c150db7b4dae0e8690dfd088346a7380d844e0acadd33b4262a2b6ef927372f6217ed1df786108ae7836053dc8ddab0c780cee544789b2ef8af231e

            • C:\Windows\System\spoolsv.exe

              Filesize

              2.2MB

              MD5

              63677dffcf0466971e740ed46b411c61

              SHA1

              987f97e95c99cbdf5f38f910f0fbd719fa9869fd

              SHA256

              2a44ca50049605ad56e0048ea2e2b93326bfd3f0216f563e9d5f4c50950d77d1

              SHA512

              26bed6fc40470d95b39edff5a0900bf980ea212bbd4ae1da8505f2a695e4222445b213221edc0279b26f894898e53ce33f20b299ae49d1c8808bb517c93f5316

            • memory/780-82-0x0000000000400000-0x00000000005D3000-memory.dmp

              Filesize

              1.8MB

            • memory/780-76-0x0000000000400000-0x00000000005D3000-memory.dmp

              Filesize

              1.8MB

            • memory/1052-24-0x0000000000400000-0x000000000043E000-memory.dmp

              Filesize

              248KB

            • memory/1052-65-0x0000000000400000-0x000000000043E000-memory.dmp

              Filesize

              248KB

            • memory/1052-63-0x0000000000440000-0x0000000000509000-memory.dmp

              Filesize

              804KB

            • memory/1052-27-0x0000000000400000-0x000000000043E000-memory.dmp

              Filesize

              248KB

            • memory/1096-28-0x0000000000400000-0x00000000005D3000-memory.dmp

              Filesize

              1.8MB

            • memory/1096-0-0x00000000006C0000-0x00000000006C1000-memory.dmp

              Filesize

              4KB

            • memory/1096-23-0x00000000006C0000-0x00000000006C1000-memory.dmp

              Filesize

              4KB

            • memory/1096-21-0x0000000000400000-0x00000000005D3000-memory.dmp

              Filesize

              1.8MB

            • memory/4628-81-0x0000000000400000-0x000000000043E000-memory.dmp

              Filesize

              248KB

            • memory/4628-852-0x0000000000400000-0x000000000043E000-memory.dmp

              Filesize

              248KB

            • memory/4636-853-0x0000000000400000-0x00000000005D3000-memory.dmp

              Filesize

              1.8MB