Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
15-09-2024 05:28
General
-
Target
e1ca6f61c23df9799053446fa05d8ef4_JaffaCakes118.doc
-
Size
158KB
-
MD5
e1ca6f61c23df9799053446fa05d8ef4
-
SHA1
77f70d6b160537099f96736749f461417def33a9
-
SHA256
6438a69ffb139cff501e2f669abb517715dea485fe9a591a2e5545fd4430a1a8
-
SHA512
627f71f98fc2f99c71f19795f350caee63b505eee4fcdc485c323ed9e5bc0568e85f25a01a839b1c4ae0da0872418d31d9b063e82d6b7ece77b061a53cc3b05f
-
SSDEEP
3072:O6IBe4V8VwlbE7OEYrL9J0hLaGTC3jvg/kVa1U:eBsmlwOPrL9J06M/kVa1U
Malware Config
Extracted
pony
http://henratronrol.com/zapoy/gate.php
http://arletaltont.ru/zapoy/gate.php
http://woserinde.ru/zapoy/gate.php
-
payload_url
http://knnew.webri.ru/system/logs/ztool.exe
http://mf-shop.ru/system/logs/ztool.exe
http://elstore.ml/system/logs/ztool.exe
Signatures
-
Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Windows directory 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Office loads VBA resources, possible macro or embedded object present
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 8 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of SendNotifyMessage 64 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\e1ca6f61c23df9799053446fa05d8ef4_JaffaCakes118.doc"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
-
C:\Users\Admin\AppData\Local\Temp\f4.tmpC:\Users\Admin\AppData\Local\Temp\f4.tmp2⤵
- Executes dropped EXE
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- outlook_office_path
- outlook_win_path
-
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD59e93c25028290ed27c190beba24f371e
SHA1b0388d5310a669aaa0399c4a061fbb46a9d501ad
SHA256a548eeb99161b0c130c9d6c29e656c95c8b66062f1361d5582d74dfce0035b82
SHA512cc67ceaa9f1fc65e181522e56fb3129c66634208c0ab2f4301163a26a14668950837fe3c49a8213228b1ec7ca70cc7d8387b94677817ac07785172eecf114cd4
-
Filesize
110KB
MD549259230ec1327f9e0659c71065a23e2
SHA1b9c5276b711aa3719556a84b24b7b516bd71bcd6
SHA25682cc68f7568fd0c9ecb5d81ff65baa6e0799579d2e538e328abc64b41a76f005
SHA512931bfd681e88af955eb3bdedbda8015a6d67c48476430350a8c1dc19fe9fe2ff058fff761ae264af3cd7b2595f2d81173c2817827be8d858f2d95b00ff281216
-
Filesize
688KB
MD578f620c55c79e3202d0f4ce340cbb508
SHA174305f23ec5f54960e4fd783e3ce140b9ecc7f00
SHA2564617fd6f429d51c9b981ced40628dac240f5db25ab614f9c8319d251c6c1f2b7
SHA512100f9ae4024ac745f03a8a9888b1eaa1c88c05a5c2f102c6287c45d487a892e9c8b09c004f903ce921755f616964b7c645dd66dfb6bfb81e1b57f992f38b924b
-
Filesize
688KB
MD505f22a04088daa5824f66c56b88a6756
SHA19b17170f1813ba86c360df2cd471cb648f76770f
SHA25607e0161e0825d4ffe7858bd3982383fd213bf877d3e0104471c7c59e8a5fc2e2
SHA512e796ed068a145f31756f0cab7d2bc92560c960258a1e2ca67201ee1f113b42f8b205d8b11cc368ec0d6fd09df1d3c9d50602308a9b59078214af0dc366c1db94
-
Filesize
375B
MD5cc62f3fede0dff7fbc800d3b3443c765
SHA14241a8eb29dab0a37ddb16b249f6fd570709c98b
SHA2561eb251b75df189c89f5acfd89347f2d3621351b9cdad569842f5ddd71aa0540a
SHA51227656ce5b8aa4fae9de57d1a138c1428cb1ff97f07f3e1bafd427927822f204fff4646ed3e0f53b0c2078550c6b724ae9058cc53e81d6338faa37f683334fa3f
-
Filesize
19KB
MD54b6e6990c1715decae38a3f7b9cb3c21
SHA1a59b47d6fd7d8e351750d00e833056a2627ff9e0
SHA256fc704f4adacc70b525987922151d6df12ff0da7cb53e54a9b7a8ec6289eb547c
SHA512cfe321ee3cef81ca6e93ea3a9f1135efc8dd0dc5d1b234a99b6fc9badb59e214eca34cd8e1768057ae11b110fb3a8b6a01edc43aee4a8db0d67a73874c353b61
-
Filesize
120KB
-
Filesize
120KB
-
Filesize
64KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
4KB
-
Filesize
44KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
4KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
44KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
44KB
-
Filesize
64KB
-
Filesize
44KB