Analysis
- max time kernel
135s - max time network
143s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
22/09/2024, 12:18
General
- Target f2019f444ad33e9288904a0e04a335af_JaffaCakes118.exe
- Size 128KB
- Sample240922-pgsgrsygrj
- SHA256 84b811ba4c356d1e00f6f80716665412539ef20b87e1f41476bc41e12b0fd08b
Malware Config
Extracted
-
pony
-
http://67.215.225.205:8080/forum/viewtopic.php
-
http://216.231.139.111/forum/viewtopic.php
-
payload_url
http://jenisegreggcouture.com/i3AnbAV.exe
http://gelerter.com/x1AZobA.exe
http://www.northeasttreeremoval.com/VDYHGMfH.exe
Signatures
- Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
- Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
- Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
- Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of SetThreadContext 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 8 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f2019f444ad33e9288904a0e04a335af_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f2019f444ad33e9288904a0e04a335af_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f2019f444ad33e9288904a0e04a335af_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f2019f444ad33e9288904a0e04a335af_JaffaCakes118.exe"2⤵
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- outlook_win_path
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2008-1-0x0000000000400000-0x0000000000419000-memory.dmp
memory/2008-5-0x0000000000400000-0x0000000000419000-memory.dmp
memory/2008-6-0x0000000000400000-0x0000000000419000-memory.dmp
memory/4848-0-0x0000000000BA0000-0x0000000000BC4000-memory.dmp
memory/4848-4-0x0000000000BA0000-0x0000000000BC4000-memory.dmp