pony | cee3b627af34bf85e8a9aef6e9acec4dce49a9a6b8a9d78e9de3b0de65033257

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
16/05/2024, 17:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4c550efd2571f37402b3f64273e03253_JaffaCakes118.exe
Size

1.2MB
MD5

4c550efd2571f37402b3f64273e03253
SHA1

8de01966b27a30eb73bbaaee09f3109c258d6e6b
SHA256

cee3b627af34bf85e8a9aef6e9acec4dce49a9a6b8a9d78e9de3b0de65033257
SHA512

7c7eeb236e1673a67c095700b1a7402884e31fd083fdfc6a3098f6236ab575e43f9ca809d610e2689d919fa8cfe7b12368ac936dec7a1d85a79f1bba661e50e1
SSDEEP

24576:w/04bvRp3TxpOTtuk19o/AqNSOB5Vl8xrRe4Wi3ohwL:+04gErsxq4

Score

10^/10

pony collection rat spyware stealer

Malware Config

Extracted

Family

pony

http://jp.nurtureassociates.com/gate.php

Signatures

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	vbc.exe

Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	vbc.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2232 set thread context of 2896	2232	4c550efd2571f37402b3f64273e03253_JaffaCakes118.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2232	4c550efd2571f37402b3f64273e03253_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 32 IoCs

description	pid	Process
Token: SeImpersonatePrivilege	2896	vbc.exe
Token: SeTcbPrivilege	2896	vbc.exe
Token: SeChangeNotifyPrivilege	2896	vbc.exe
Token: SeCreateTokenPrivilege	2896	vbc.exe
Token: SeBackupPrivilege	2896	vbc.exe
Token: SeRestorePrivilege	2896	vbc.exe
Token: SeIncreaseQuotaPrivilege	2896	vbc.exe
Token: SeAssignPrimaryTokenPrivilege	2896	vbc.exe
Token: SeImpersonatePrivilege	2896	vbc.exe
Token: SeTcbPrivilege	2896	vbc.exe
Token: SeChangeNotifyPrivilege	2896	vbc.exe
Token: SeCreateTokenPrivilege	2896	vbc.exe
Token: SeBackupPrivilege	2896	vbc.exe
Token: SeRestorePrivilege	2896	vbc.exe
Token: SeIncreaseQuotaPrivilege	2896	vbc.exe
Token: SeAssignPrimaryTokenPrivilege	2896	vbc.exe
Token: SeImpersonatePrivilege	2896	vbc.exe
Token: SeTcbPrivilege	2896	vbc.exe
Token: SeChangeNotifyPrivilege	2896	vbc.exe
Token: SeCreateTokenPrivilege	2896	vbc.exe
Token: SeBackupPrivilege	2896	vbc.exe
Token: SeRestorePrivilege	2896	vbc.exe
Token: SeIncreaseQuotaPrivilege	2896	vbc.exe
Token: SeAssignPrimaryTokenPrivilege	2896	vbc.exe
Token: SeImpersonatePrivilege	2896	vbc.exe
Token: SeTcbPrivilege	2896	vbc.exe
Token: SeChangeNotifyPrivilege	2896	vbc.exe
Token: SeCreateTokenPrivilege	2896	vbc.exe
Token: SeBackupPrivilege	2896	vbc.exe
Token: SeRestorePrivilege	2896	vbc.exe
Token: SeIncreaseQuotaPrivilege	2896	vbc.exe
Token: SeAssignPrimaryTokenPrivilege	2896	vbc.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 2896	2232	4c550efd2571f37402b3f64273e03253_JaffaCakes118.exe	28
PID 2232 wrote to memory of 2896	2232	4c550efd2571f37402b3f64273e03253_JaffaCakes118.exe	28
PID 2232 wrote to memory of 2896	2232	4c550efd2571f37402b3f64273e03253_JaffaCakes118.exe	28
PID 2232 wrote to memory of 2896	2232	4c550efd2571f37402b3f64273e03253_JaffaCakes118.exe	28
PID 2232 wrote to memory of 2896	2232	4c550efd2571f37402b3f64273e03253_JaffaCakes118.exe	28
PID 2232 wrote to memory of 2896	2232	4c550efd2571f37402b3f64273e03253_JaffaCakes118.exe	28

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	vbc.exe

C:\Users\Admin\AppData\Local\Temp\4c550efd2571f37402b3f64273e03253_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4c550efd2571f37402b3f64273e03253_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
  2⤵
  - Accesses Microsoft Outlook accounts
  - Accesses Microsoft Outlook profiles
  - Suspicious use of AdjustPrivilegeToken
  - outlook_win_path
  PID:2896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

T1064

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2232-0-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/2232-2-0x0000000000400000-0x000000000052F000-memory.dmp

Filesize
1.2MB

Download
memory/2896-1-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/2896-7-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/2896-8-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/2896-10-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download