pony | 6e0a9ce17c9c850712a70bc449a6b89e154abfe831bd535c8ee74d0d6ea1b23d

General

Target

745953afb831abb7adc6507e0230345b_JaffaCakes118.exe
Size

277KB
MD5

745953afb831abb7adc6507e0230345b
SHA1

e134cfb44ad6541e853d9adb0e66aae79ec2b59d
SHA256

6e0a9ce17c9c850712a70bc449a6b89e154abfe831bd535c8ee74d0d6ea1b23d
SHA512

bdf5e194355d169c72a3b5807d665e66bd58f638459aff21eab47807a78039a03e4cd99750c920da85937edffabd76162f3d25d97bd4f820efe69cf9237077f5
SSDEEP

6144:n9crGFFL4EyYlHuoy0zEyEm2h4qgofCD+mPV0:96GZHuoZ0OqgofCam

Score

10^/10

pony credential_access discovery persistence rat spyware stealer upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

745953afb831abb7adc6507e0230345b_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\96BAE\\D3ED3.exe"	745953afb831abb7adc6507e0230345b_JaffaCakes118.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003
Executes dropped EXE 1 IoCs

Processes:

5744.tmp

pid process

2856 5744.tmp
Loads dropped DLL 2 IoCs

Processes:

745953afb831abb7adc6507e0230345b_JaffaCakes118.exe

pid process

2480 745953afb831abb7adc6507e0230345b_JaffaCakes118.exe
2480 745953afb831abb7adc6507e0230345b_JaffaCakes118.exe
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
2856	5744.tmp

pid	process
2480	745953afb831abb7adc6507e0230345b_JaffaCakes118.exe
2480	745953afb831abb7adc6507e0230345b_JaffaCakes118.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2480-1-0x0000000000400000-0x00000000004A9000-memory.dmp	upx
behavioral1/memory/1848-13-0x0000000000400000-0x00000000004A9000-memory.dmp	upx
behavioral1/memory/1848-11-0x0000000000400000-0x00000000004A9000-memory.dmp	upx
behavioral1/memory/2480-66-0x0000000000400000-0x00000000004A9000-memory.dmp	upx
behavioral1/memory/2972-72-0x0000000000400000-0x00000000004A9000-memory.dmp	upx
behavioral1/memory/2480-74-0x0000000000400000-0x00000000004A9000-memory.dmp	upx
behavioral1/memory/2480-154-0x0000000000400000-0x00000000004A9000-memory.dmp	upx
behavioral1/memory/2480-192-0x0000000000400000-0x00000000004A9000-memory.dmp	upx
behavioral1/memory/2480-193-0x0000000000400000-0x00000000004A9000-memory.dmp	upx

Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 1 IoCs

Processes:

745953afb831abb7adc6507e0230345b_JaffaCakes118.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Internet Explorer\D3A9\5744.tmp	745953afb831abb7adc6507e0230345b_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

745953afb831abb7adc6507e0230345b_JaffaCakes118.exe745953afb831abb7adc6507e0230345b_JaffaCakes118.exe745953afb831abb7adc6507e0230345b_JaffaCakes118.exe5744.tmp

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	745953afb831abb7adc6507e0230345b_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	745953afb831abb7adc6507e0230345b_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	745953afb831abb7adc6507e0230345b_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5744.tmp

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

745953afb831abb7adc6507e0230345b_JaffaCakes118.exe

description	pid	process	target process
PID 2480 wrote to memory of 1848	2480	745953afb831abb7adc6507e0230345b_JaffaCakes118.exe	745953afb831abb7adc6507e0230345b_JaffaCakes118.exe
PID 2480 wrote to memory of 1848	2480	745953afb831abb7adc6507e0230345b_JaffaCakes118.exe	745953afb831abb7adc6507e0230345b_JaffaCakes118.exe
PID 2480 wrote to memory of 1848	2480	745953afb831abb7adc6507e0230345b_JaffaCakes118.exe	745953afb831abb7adc6507e0230345b_JaffaCakes118.exe
PID 2480 wrote to memory of 1848	2480	745953afb831abb7adc6507e0230345b_JaffaCakes118.exe	745953afb831abb7adc6507e0230345b_JaffaCakes118.exe
PID 2480 wrote to memory of 2972	2480	745953afb831abb7adc6507e0230345b_JaffaCakes118.exe	745953afb831abb7adc6507e0230345b_JaffaCakes118.exe
PID 2480 wrote to memory of 2972	2480	745953afb831abb7adc6507e0230345b_JaffaCakes118.exe	745953afb831abb7adc6507e0230345b_JaffaCakes118.exe
PID 2480 wrote to memory of 2972	2480	745953afb831abb7adc6507e0230345b_JaffaCakes118.exe	745953afb831abb7adc6507e0230345b_JaffaCakes118.exe
PID 2480 wrote to memory of 2972	2480	745953afb831abb7adc6507e0230345b_JaffaCakes118.exe	745953afb831abb7adc6507e0230345b_JaffaCakes118.exe
PID 2480 wrote to memory of 2856	2480	745953afb831abb7adc6507e0230345b_JaffaCakes118.exe	5744.tmp
PID 2480 wrote to memory of 2856	2480	745953afb831abb7adc6507e0230345b_JaffaCakes118.exe	5744.tmp
PID 2480 wrote to memory of 2856	2480	745953afb831abb7adc6507e0230345b_JaffaCakes118.exe	5744.tmp
PID 2480 wrote to memory of 2856	2480	745953afb831abb7adc6507e0230345b_JaffaCakes118.exe	5744.tmp

C:\Users\Admin\AppData\Local\Temp\745953afb831abb7adc6507e0230345b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\745953afb831abb7adc6507e0230345b_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2480

C:\Users\Admin\AppData\Local\Temp\745953afb831abb7adc6507e0230345b_JaffaCakes118.exe
C:\Users\Admin\AppData\Local\Temp\745953afb831abb7adc6507e0230345b_JaffaCakes118.exe startC:\Program Files (x86)\Internet Explorer\D3A9\4D6.exe%C:\Program Files (x86)\Internet Explorer\D3A9
2⤵
- System Location Discovery: System Language Discovery
PID:1848

C:\Users\Admin\AppData\Local\Temp\745953afb831abb7adc6507e0230345b_JaffaCakes118.exe
C:\Users\Admin\AppData\Local\Temp\745953afb831abb7adc6507e0230345b_JaffaCakes118.exe startC:\Program Files (x86)\AE872\lvvm.exe%C:\Program Files (x86)\AE872
2⤵
- System Location Discovery: System Language Discovery
PID:2972

C:\Program Files (x86)\Internet Explorer\D3A9\5744.tmp
"C:\Program Files (x86)\Internet Explorer\D3A9\5744.tmp"
2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

3

T1552

Credentials In Files

3

T1552.001

Discovery

Query Registry

1

T1012

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\96BAE\E872.6BA

Filesize
1KB

MD5
a0f86568aeb9328610a1c8b573de9100

SHA1
f4fdb65762c7d5b0a3411f1f0e6288f312149cfb

SHA256
35cb950273f26013fd62dc16fe9eda9522197a8108a0117420e238ec98aa01dd

SHA512
59bc3f02ea2801e5734d369649b23a139883352cdce9ae527c7d1fce929aaf57134bd70f8177c247a9695e48ea2e2fd57db88726c5915121bc2b64d5e401ca71

Download Submit
C:\Users\Admin\AppData\Roaming\96BAE\E872.6BA

Filesize
600B

MD5
d19945fa1ae5f85ac75e04a7a5fe6845

SHA1
03e3ae0d94a1823575ab25cbb944ade8269d8829

SHA256
5cf007e4255a8ab171af8e4333113ee89f4609a0a305df07ddbd35772b5010c6

SHA512
5c28079d5c87fce00c3a12c8ce699eac9f81201f3912a0f0506b9305a78ca93d8935a2d7a5ddfd576ba729b8cf73170cb197f595d01c091b3852c969c7e57948

Download Submit
C:\Users\Admin\AppData\Roaming\96BAE\E872.6BA

Filesize
996B

MD5
38a1339fece9079c7284e7875b370d18

SHA1
153d2caf53e636be7e9fb60093c5fea2bd967d3e

SHA256
a6ecdd003eb241ffd06922879aa5581721a46f6c2ed145ddc4f22e5011e61c10

SHA512
45834276665adfb1a6057b1cc3d80575c8c5c748305dd10d37a25a9b94a7e5b187958e3cf101266153c7867c26193804194133e7d3c9538c72999b54c1a36a0e

Download Submit
\Program Files (x86)\Internet Explorer\D3A9\5744.tmp

Filesize
103KB

MD5
90f14957af4798c13dcdd9f26c0873f6

SHA1
04fbe889eed77913e58c409582840e8bee606df0

SHA256
15ffe721016d1490299956f82a93ec872e7d41526177401a9267f29f331c4647

SHA512
8708283efb9e3349a7a13d72d58c1aa3041b8a03928fb94b66db4290d229c1fa637ecc301a0519aac2729257a5c993d34249973e2f7443f04a7202cddb586284

Download Submit
memory/1848-76-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/1848-12-0x00000000006B6000-0x00000000006DB000-memory.dmp

Filesize
148KB

Download
memory/1848-13-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/1848-11-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/2480-74-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/2480-1-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/2480-154-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/2480-66-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/2480-192-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/2480-193-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/2856-155-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2856-156-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2972-73-0x0000000000656000-0x000000000067B000-memory.dmp

Filesize
148KB

Download
memory/2972-72-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads