Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
23/05/2024, 13:44
General
-
Target
6b21a2737d56f36a02964f983ef9c897_JaffaCakes118.exe
-
Size
208KB
-
MD5
6b21a2737d56f36a02964f983ef9c897
-
SHA1
0cbeb86877656c664626b5e29eb74c80fa7c9286
-
SHA256
9191043cb1f8a78861992ca40065c000960852b9e9c02a94f95747202405feb0
-
SHA512
1d3e652d89e4f409f7ee2c33cd4c6710d3da37ddb93d9c1a336c04a4087ffbbacb78e50f395f4f3c9c88709be2c544c95918518116367b087e5339670066a603
-
SSDEEP
3072:oV+14M3PnG8+OIhbqrWg3ISKbkokgjAtPg6L9:oV+v/UOIIq4IzOZ
Score
10/10
Malware Config
Signatures
-
Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
-
Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of AdjustPrivilegeToken 32 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6b21a2737d56f36a02964f983ef9c897_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6b21a2737d56f36a02964f983ef9c897_JaffaCakes118.exe"1⤵
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- outlook_win_path