Analysis
-
max time kernel
136s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
-
submitted
15/07/2024, 11:25
General
-
Target
4992b4720075b16f403027fa60b0e85e_JaffaCakes118.exe
-
Size
172KB
-
MD5
4992b4720075b16f403027fa60b0e85e
-
SHA1
b157f293a931beb6962ebcead431125bd1209da8
-
SHA256
ac7c253e7a17feb53af11356c91dd03469ac1d27d3b4c059d7974f8ee3c32208
-
SHA512
1e4942bdb8173e8eb72fb00b720bf0e018ecdfbcccf12efcd8fbb8f0e6ddfc950053639d03e8e3fda2a516968e343252479e17a8848bb17b4172c73c9868aa9a
-
SSDEEP
3072:1pXwc2bG7/Tg2DmffDrbYHHf3xaW3ShYtNYK8eG:ctSTTLmfbHe/haMSNKY
Malware Config
Extracted
pony
http://108.166.65.182:8080/pony/gate.php
http://66.150.188.33/pony/gate.php
-
payload_url
http://bgdt.co.uk/2A3.exe
http://madeiras10.com.br/ZNg8uR.exe
http://aencuentro.com.ar/xc25nXp.exe
Signatures
-
Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of AdjustPrivilegeToken 8 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4992b4720075b16f403027fa60b0e85e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4992b4720075b16f403027fa60b0e85e_JaffaCakes118.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
196KB
-
Filesize
92KB
-
Filesize
92KB
-
Filesize
92KB