Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

d1398fa4e2...18.exe

windows7-x64

d1398fa4e2...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    137s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/09/2024, 05:55 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    d1398fa4e293fd5ead237e4b79e63d90_JaffaCakes118.exe

  • Size

    124KB

  • MD5

    d1398fa4e293fd5ead237e4b79e63d90

  • SHA1

    25063a6fe442095a1b3d67b25cee82aa73f7b0bf

  • SHA256

    db4a505c297598a9e58aea0eed57898c1f4d51b17472c8c7df4c68a2a1a2a955

  • SHA512

    dec6f1fb10c58a6bcd1c9a4a46a9586111bb1144117d86f8ff7fc04429eda4a76afcae9c3911b178cb880ba7f80554155c3e7b180829e9dcff9e376d7c691164

  • SSDEEP

    1536:P4VYfD1/qTzh9NlQu9PBB/mvn9xWJ/nfaBTOzC9DhONYTvaEozkzZJXiuZlXpdbS:gy+PBYn9xWNYZhOlEo8ouZlXppS

Score
10/10
ponycollectioncredential_accessdiscoveryratspywarestealer

Malware Config

Signatures

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony
  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
    collection
  • Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
    collection
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d1398fa4e293fd5ead237e4b79e63d90_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\d1398fa4e293fd5ead237e4b79e63d90_JaffaCakes118.exe"
    1⤵
    • Accesses Microsoft Outlook accounts
    • Accesses Microsoft Outlook profiles
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • outlook_win_path
    PID:4992

Network

  • flag-us
    DNS
    8.8.8.8.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    8.8.8.8.in-addr.arpa
    IN PTR
    Response
    8.8.8.8.in-addr.arpa
    IN PTR
    dnsgoogle
  • flag-us
    DNS
    shop.smsmpi.com
    d1398fa4e293fd5ead237e4b79e63d90_JaffaCakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    shop.smsmpi.com
    IN A
    Response
  • flag-us
    DNS
    196.249.167.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    196.249.167.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    81.144.22.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    81.144.22.2.in-addr.arpa
    IN PTR
    Response
    81.144.22.2.in-addr.arpa
    IN PTR
    a2-22-144-81deploystaticakamaitechnologiescom
  • flag-us
    DNS
    140.32.126.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    140.32.126.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    shop.smsmpi.com
    d1398fa4e293fd5ead237e4b79e63d90_JaffaCakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    shop.smsmpi.com
    IN A
    Response
  • flag-us
    DNS
    149.220.183.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    149.220.183.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    shop.smsmpi.com
    d1398fa4e293fd5ead237e4b79e63d90_JaffaCakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    shop.smsmpi.com
    IN A
    Response
  • flag-us
    DNS
    shop.smsmpi.com
    d1398fa4e293fd5ead237e4b79e63d90_JaffaCakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    shop.smsmpi.com
    IN A
    Response
  • flag-us
    DNS
    shop.smsmpi.com
    d1398fa4e293fd5ead237e4b79e63d90_JaffaCakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    shop.smsmpi.com
    IN A
    Response
  • flag-us
    DNS
    shop.smsmpi.com
    d1398fa4e293fd5ead237e4b79e63d90_JaffaCakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    shop.smsmpi.com
    IN A
    Response
  • flag-us
    DNS
    shop.smsmpi.com
    d1398fa4e293fd5ead237e4b79e63d90_JaffaCakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    shop.smsmpi.com
    IN A
    Response
  • flag-us
    DNS
    183.59.114.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    183.59.114.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    18.31.95.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    18.31.95.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    240.221.184.93.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    240.221.184.93.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    shop.smsmpi.com
    d1398fa4e293fd5ead237e4b79e63d90_JaffaCakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    shop.smsmpi.com
    IN A
    Response
  • flag-us
    DNS
    shop.smsmpi.com
    d1398fa4e293fd5ead237e4b79e63d90_JaffaCakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    shop.smsmpi.com
    IN A
    Response
  • flag-us
    DNS
    shop.smsmpi.com
    d1398fa4e293fd5ead237e4b79e63d90_JaffaCakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    shop.smsmpi.com
    IN A
    Response
  • flag-us
    DNS
    shop.smsmpi.com
    d1398fa4e293fd5ead237e4b79e63d90_JaffaCakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    shop.smsmpi.com
    IN A
    Response
  • flag-us
    DNS
    smsmpi.com
    d1398fa4e293fd5ead237e4b79e63d90_JaffaCakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    smsmpi.com
    IN A
    Response
    smsmpi.com
    IN A
    51.255.21.173
  • flag-us
    DNS
    73.144.22.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    73.144.22.2.in-addr.arpa
    IN PTR
    Response
    73.144.22.2.in-addr.arpa
    IN PTR
    a2-22-144-73deploystaticakamaitechnologiescom
  • 51.255.21.173:8080
    smsmpi.com
    d1398fa4e293fd5ead237e4b79e63d90_JaffaCakes118.exe
    260 B
     5
  • 51.255.21.173:8080
    smsmpi.com
    d1398fa4e293fd5ead237e4b79e63d90_JaffaCakes118.exe
    260 B
     5
  • 51.255.21.173:8080
    smsmpi.com
    d1398fa4e293fd5ead237e4b79e63d90_JaffaCakes118.exe
    260 B
     5
  • 51.255.21.173:8080
    smsmpi.com
    d1398fa4e293fd5ead237e4b79e63d90_JaffaCakes118.exe
    260 B
     5
  • 8.8.8.8:53
    8.8.8.8.in-addr.arpa
    dns
    66 B
     90 B
     1
    1

    DNS Request

    8.8.8.8.in-addr.arpa

  • 8.8.8.8:53
    shop.smsmpi.com
    dns
    d1398fa4e293fd5ead237e4b79e63d90_JaffaCakes118.exe
    61 B
     116 B
     1
    1

    DNS Request

    shop.smsmpi.com

  • 8.8.8.8:53
    196.249.167.52.in-addr.arpa
    dns
    73 B
     147 B
     1
    1

    DNS Request

    196.249.167.52.in-addr.arpa

  • 8.8.8.8:53
    81.144.22.2.in-addr.arpa
    dns
    70 B
     133 B
     1
    1

    DNS Request

    81.144.22.2.in-addr.arpa

  • 8.8.8.8:53
    140.32.126.40.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    140.32.126.40.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
     144 B
     1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    shop.smsmpi.com
    dns
    d1398fa4e293fd5ead237e4b79e63d90_JaffaCakes118.exe
    61 B
     116 B
     1
    1

    DNS Request

    shop.smsmpi.com

  • 8.8.8.8:53
    149.220.183.52.in-addr.arpa
    dns
    73 B
     147 B
     1
    1

    DNS Request

    149.220.183.52.in-addr.arpa

  • 8.8.8.8:53
    shop.smsmpi.com
    dns
    d1398fa4e293fd5ead237e4b79e63d90_JaffaCakes118.exe
    61 B
     116 B
     1
    1

    DNS Request

    shop.smsmpi.com

  • 8.8.8.8:53
    shop.smsmpi.com
    dns
    d1398fa4e293fd5ead237e4b79e63d90_JaffaCakes118.exe
    61 B
     116 B
     1
    1

    DNS Request

    shop.smsmpi.com

  • 8.8.8.8:53
    shop.smsmpi.com
    dns
    d1398fa4e293fd5ead237e4b79e63d90_JaffaCakes118.exe
    61 B
     116 B
     1
    1

    DNS Request

    shop.smsmpi.com

  • 8.8.8.8:53
    shop.smsmpi.com
    dns
    d1398fa4e293fd5ead237e4b79e63d90_JaffaCakes118.exe
    61 B
     116 B
     1
    1

    DNS Request

    shop.smsmpi.com

  • 8.8.8.8:53
    shop.smsmpi.com
    dns
    d1398fa4e293fd5ead237e4b79e63d90_JaffaCakes118.exe
    61 B
     116 B
     1
    1

    DNS Request

    shop.smsmpi.com

  • 8.8.8.8:53
    183.59.114.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    183.59.114.20.in-addr.arpa

  • 8.8.8.8:53
    18.31.95.13.in-addr.arpa
    dns
    70 B
     144 B
     1
    1

    DNS Request

    18.31.95.13.in-addr.arpa

  • 8.8.8.8:53
    240.221.184.93.in-addr.arpa
    dns
    73 B
     144 B
     1
    1

    DNS Request

    240.221.184.93.in-addr.arpa

  • 8.8.8.8:53
    shop.smsmpi.com
    dns
    d1398fa4e293fd5ead237e4b79e63d90_JaffaCakes118.exe
    61 B
     116 B
     1
    1

    DNS Request

    shop.smsmpi.com

  • 8.8.8.8:53
    shop.smsmpi.com
    dns
    d1398fa4e293fd5ead237e4b79e63d90_JaffaCakes118.exe
    61 B
     116 B
     1
    1

    DNS Request

    shop.smsmpi.com

  • 8.8.8.8:53
    shop.smsmpi.com
    dns
    d1398fa4e293fd5ead237e4b79e63d90_JaffaCakes118.exe
    61 B
     116 B
     1
    1

    DNS Request

    shop.smsmpi.com

  • 8.8.8.8:53
    shop.smsmpi.com
    dns
    d1398fa4e293fd5ead237e4b79e63d90_JaffaCakes118.exe
    61 B
     116 B
     1
    1

    DNS Request

    shop.smsmpi.com

  • 8.8.8.8:53
    smsmpi.com
    dns
    d1398fa4e293fd5ead237e4b79e63d90_JaffaCakes118.exe
    56 B
     72 B
     1
    1

    DNS Request

    smsmpi.com

    DNS Response

    51.255.21.173

  • 8.8.8.8:53
    73.144.22.2.in-addr.arpa
    dns
    70 B
     133 B
     1
    1

    DNS Request

    73.144.22.2.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.