pony | b657ca881425c85f91bd8b21a61c1743234db6dc15ee7a4d080dd0ad709c1f20

General

Target

f24074e1393d92483c661b00768dfc67_JaffaCakes118.exe
Size

274KB
MD5

f24074e1393d92483c661b00768dfc67
SHA1

8ab5b2513334d385813e49a2805199dcd22557d1
SHA256

b657ca881425c85f91bd8b21a61c1743234db6dc15ee7a4d080dd0ad709c1f20
SHA512

5cb952630e4dfed98afd2164d05fd22a35475ba1f309290c8d04c9bc8c4bda85dcd1c4f1a0fe2b7715a4cbeba34531065dfa898fa17f4c6bdca0e72e6ef15247
SSDEEP

6144:lu0qO0gI48yHKPPLWU9tVYRhJdNVauKU7bs2hT9jE:bqOe8HhGfkJPV1KU7d

Score

10^/10

pony credential_access discovery persistence rat spyware stealer upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\279A0\\62ED3.exe"	f24074e1393d92483c661b00768dfc67_JaffaCakes118.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Executes dropped EXE 1 IoCs

pid	Process
4864	5A6F.tmp

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2960-2-0x0000000000400000-0x00000000004A8000-memory.dmp	upx
behavioral2/memory/3156-12-0x0000000000400000-0x00000000004A8000-memory.dmp	upx
behavioral2/memory/3156-13-0x0000000000400000-0x00000000004A8000-memory.dmp	upx
behavioral2/memory/3156-14-0x0000000000400000-0x00000000004A8000-memory.dmp	upx
behavioral2/memory/2960-46-0x0000000000400000-0x00000000004A8000-memory.dmp	upx
behavioral2/memory/2960-107-0x0000000000400000-0x00000000004A8000-memory.dmp	upx
behavioral2/memory/3492-109-0x0000000000400000-0x00000000004A8000-memory.dmp	upx
behavioral2/memory/3492-111-0x0000000000400000-0x00000000004A8000-memory.dmp	upx
behavioral2/memory/2960-178-0x0000000000400000-0x00000000004A8000-memory.dmp	upx
behavioral2/memory/2960-181-0x0000000000400000-0x00000000004A8000-memory.dmp	upx

Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Internet Explorer\D3A2\5A6F.tmp	f24074e1393d92483c661b00768dfc67_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f24074e1393d92483c661b00768dfc67_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5A6F.tmp

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2960 wrote to memory of 3156	2960	f24074e1393d92483c661b00768dfc67_JaffaCakes118.exe	87
PID 2960 wrote to memory of 3156	2960	f24074e1393d92483c661b00768dfc67_JaffaCakes118.exe	87
PID 2960 wrote to memory of 3156	2960	f24074e1393d92483c661b00768dfc67_JaffaCakes118.exe	87
PID 2960 wrote to memory of 3492	2960	f24074e1393d92483c661b00768dfc67_JaffaCakes118.exe	94
PID 2960 wrote to memory of 3492	2960	f24074e1393d92483c661b00768dfc67_JaffaCakes118.exe	94
PID 2960 wrote to memory of 3492	2960	f24074e1393d92483c661b00768dfc67_JaffaCakes118.exe	94
PID 2960 wrote to memory of 4864	2960	f24074e1393d92483c661b00768dfc67_JaffaCakes118.exe	97
PID 2960 wrote to memory of 4864	2960	f24074e1393d92483c661b00768dfc67_JaffaCakes118.exe	97
PID 2960 wrote to memory of 4864	2960	f24074e1393d92483c661b00768dfc67_JaffaCakes118.exe	97

C:\Users\Admin\AppData\Local\Temp\f24074e1393d92483c661b00768dfc67_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f24074e1393d92483c661b00768dfc67_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2960
- C:\Users\Admin\AppData\Local\Temp\f24074e1393d92483c661b00768dfc67_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\f24074e1393d92483c661b00768dfc67_JaffaCakes118.exe startC:\Program Files (x86)\Internet Explorer\D3A2\1F6.exe%C:\Program Files (x86)\Internet Explorer\D3A2
  2⤵
  PID:3156
- C:\Users\Admin\AppData\Local\Temp\f24074e1393d92483c661b00768dfc67_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\f24074e1393d92483c661b00768dfc67_JaffaCakes118.exe startC:\Program Files (x86)\A0D0B\lvvm.exe%C:\Program Files (x86)\A0D0B
  2⤵
  PID:3492
- C:\Program Files (x86)\Internet Explorer\D3A2\5A6F.tmp
  "C:\Program Files (x86)\Internet Explorer\D3A2\5A6F.tmp"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

3

T1552

Credentials In Files

3

T1552.001

Discovery

Query Registry

1

T1012

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Internet Explorer\D3A2\5A6F.tmp

Filesize
102KB

MD5
01daef5f17f918da80fad0ae7f3cc302

SHA1
d6b838c8be6e42fdd475fce71f5e20ff3dd15bed

SHA256
b381f381fc5db03a32e60adbd5aad16e6923aa76264d2c1d96d876d43d599eaa

SHA512
730f1bb381448a9f6b32204e359d74ebbd0da8529353ec7a6a220265bfab8d1537f85bb828fd4c2c0fac5bcc002c3ddcae27ad587686fc5f0a90e2654db8e8db

Download Submit
C:\Users\Admin\AppData\Roaming\279A0\0D0B.79A

Filesize
996B

MD5
0084638e763345bf5e0012a512e93e9f

SHA1
2c8ad41652a93a3dddf2793b154aaa7a66ce10bb

SHA256
cfc8b623255a9a934c570326d089313ec3f0bb252d2d7b8024c11c853a56a33b

SHA512
07ae58289b713f9569814ed4daea54ffb405f65a998aba0223e6c85426664fc15ab15300be7190b44fdd33d870ca5a7df902adc361b100390f3c887b56e0ad30

Download Submit
C:\Users\Admin\AppData\Roaming\279A0\0D0B.79A

Filesize
600B

MD5
10902152e6d263bb65c786685cd3b42a

SHA1
112d5dbd4ff1e2e257bcb13eafa9a2c87f198b90

SHA256
65455ae954204d8ef4abf709c657a90a13cd99d3414bb5f068239ff881a20f98

SHA512
f83af6b0f4be3a4d30e65a734c3a3310313a381402616be9ddcafa16528c07faca2cdf8e2a514971fefb22b09955270d93ae87e5ec444a792041f1c7d3b3b03d

Download Submit
memory/2960-2-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/2960-181-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/2960-1-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/2960-178-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/2960-46-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/2960-107-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/3156-13-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/3156-14-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/3156-12-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/3492-111-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/3492-109-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/4864-177-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads