Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    d83694ffb89d5fab272840e5c70be39a_JaffaCakes118

  • Size

    2.6MB

  • Sample

    240910-nwwbjasdpp

  • MD5

    d83694ffb89d5fab272840e5c70be39a

  • SHA1

    af79c576ec840ab0041e63447f0f4c8988cc7df7

  • SHA256

    082a4f099e9324a6b09d4c6f2124e0a3a7ea8f35f6c7f8be6d1bcc90ddc5fbd0

  • SHA512

    37dabdaa35d450c347a2471c7d7cc87d6a4fc3a5b2402ce4a55bb303c735a40b082b747fad49c6f47b4c7dcfe49e1bd3efca30f46b2c69ef2130d01b9b1361f6

  • SSDEEP

    49152:8coQxSBeKeiOSiFmoJggggLo40KDi3gp0XhCjyrli:86SIROiFJiwp0xlrli

Malware Config

Extracted

Family

pony

C2

http://don.service-master.eu/gate.php

Attributes
  • payload_url

    http://don.service-master.eu/shit.exe

Targets

    • Target

      d83694ffb89d5fab272840e5c70be39a_JaffaCakes118

    • Size

      2.6MB

    • MD5

      d83694ffb89d5fab272840e5c70be39a

    • SHA1

      af79c576ec840ab0041e63447f0f4c8988cc7df7

    • SHA256

      082a4f099e9324a6b09d4c6f2124e0a3a7ea8f35f6c7f8be6d1bcc90ddc5fbd0

    • SHA512

      37dabdaa35d450c347a2471c7d7cc87d6a4fc3a5b2402ce4a55bb303c735a40b082b747fad49c6f47b4c7dcfe49e1bd3efca30f46b2c69ef2130d01b9b1361f6

    • SSDEEP

      49152:8coQxSBeKeiOSiFmoJggggLo40KDi3gp0XhCjyrli:86SIROiFJiwp0xlrli

    • Modifies WinLogon for persistence

    • Modifies visiblity of hidden/system files in Explorer

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.