Analysis
-
max time kernel
139s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
06-09-2024 17:24
General
-
Target
d010f7753728d50ed9db5f7d0157cfcc_JaffaCakes118.exe
-
Size
188KB
-
MD5
d010f7753728d50ed9db5f7d0157cfcc
-
SHA1
3718a04bc30a1adb0f207f43f581dd10b57c02da
-
SHA256
d486cb18af98ca2939fc054dc4f9b24bdd657918f59b4087a7b7f00d18bd8cd9
-
SHA512
c66f8fc60d16073206aee8131ac744e2d49ce9e42f6d19d8e48117ebd71969c12bf60c3e4e84d06553410645ea4a3eaa667bce5b2f8cb4f4627d3c3b17ab4673
-
SSDEEP
3072:NRO2tlzADOxKcTHwGTCVVPbSMVoCHnroH308Z:N8wlzTzTwGmTzNoAroB
Malware Config
Extracted
pony
http://classicmodels.at:8080/forum/viewtopic.php
http://diva-code.at:8080/forum/viewtopic.php
-
payload_url
http://workingfamilies.ca/6LP.exe
http://autopasjonat.pl/9KZPo.exe
http://63.127.194.183/HY3.exe
Signatures
-
Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
-
Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 8 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d010f7753728d50ed9db5f7d0157cfcc_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d010f7753728d50ed9db5f7d0157cfcc_JaffaCakes118.exe"1⤵
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- outlook_win_path
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
204KB
-
Filesize
100KB
-
Filesize
100KB
-
Filesize
204KB
-
Filesize
100KB