Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    b26f0200d7064d4420bd49b55f33750f_JaffaCakes118

  • Size

    2.2MB

  • Sample

    240616-jnzlrszank

  • MD5

    b26f0200d7064d4420bd49b55f33750f

  • SHA1

    24a4d62a870ab5d1382f19aaa76e2459d8483b28

  • SHA256

    ee7a3a5ea5b59d30bff397448a21b5592a9a006cad5610737e5209ef195c32c6

  • SHA512

    a7904aba8634368bf2558b2ded939a7441d705aa9d2595657f8d2d1973ea607aeb3251602fbfb8665dca9c926dc45edcc01cd491e2adb5c93849d1701e9e9100

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZw:0UzeyQMS4DqodCnoe+iitjWwws

Malware Config

Extracted

Family

pony

C2

http://don.service-master.eu/gate.php

Attributes
  • payload_url

    http://don.service-master.eu/shit.exe

Targets

    • Target

      b26f0200d7064d4420bd49b55f33750f_JaffaCakes118

    • Size

      2.2MB

    • MD5

      b26f0200d7064d4420bd49b55f33750f

    • SHA1

      24a4d62a870ab5d1382f19aaa76e2459d8483b28

    • SHA256

      ee7a3a5ea5b59d30bff397448a21b5592a9a006cad5610737e5209ef195c32c6

    • SHA512

      a7904aba8634368bf2558b2ded939a7441d705aa9d2595657f8d2d1973ea607aeb3251602fbfb8665dca9c926dc45edcc01cd491e2adb5c93849d1701e9e9100

    • SSDEEP

      24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZw:0UzeyQMS4DqodCnoe+iitjWwws

    • Modifies WinLogon for persistence

    • Modifies visiblity of hidden/system files in Explorer

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

    • Modifies Installed Components in the registry

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks