pony | 414912f394029979d4e49f1a6193a4e688e1d2400d25ab4d1872d56ae81e4310

General

Target

f3b20f6416600411e0c39b24acdf77ad_JaffaCakes118.exe
Size

279KB
MD5

f3b20f6416600411e0c39b24acdf77ad
SHA1

338eb3064e4d57b3a118739c64bd4d1b7bbe079e
SHA256

414912f394029979d4e49f1a6193a4e688e1d2400d25ab4d1872d56ae81e4310
SHA512

45a1dcbb70b784a0f7af95b959f3b90f0dc7ef9c3df527663fc93f5b8320b4e6663ceb4e9660b2d5f90c8ef7c90de0a6e58eb55e5cb5dc2ef047d50567edbd39
SSDEEP

6144:k0G2M0hFVgp+VWMufkWLIc+JXBESYW8B5:k0x5k+VWMu8WknEu8X

Score

10^/10

pony credential_access discovery persistence rat spyware stealer upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\64EBB\\21ED3.exe"	f3b20f6416600411e0c39b24acdf77ad_JaffaCakes118.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Executes dropped EXE 1 IoCs

pid	Process
2308	498E.tmp

Loads dropped DLL 2 IoCs

pid	Process
2480	f3b20f6416600411e0c39b24acdf77ad_JaffaCakes118.exe
2480	f3b20f6416600411e0c39b24acdf77ad_JaffaCakes118.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2480-2-0x0000000000400000-0x00000000004A9000-memory.dmp	upx
behavioral1/memory/1368-12-0x0000000000400000-0x00000000004A9000-memory.dmp	upx
behavioral1/memory/1368-14-0x0000000000400000-0x00000000004A9000-memory.dmp	upx
behavioral1/memory/2480-15-0x0000000000400000-0x00000000004A9000-memory.dmp	upx
behavioral1/memory/788-79-0x0000000000400000-0x00000000004A9000-memory.dmp	upx
behavioral1/memory/788-81-0x0000000000400000-0x00000000004A9000-memory.dmp	upx
behavioral1/memory/2480-97-0x0000000000400000-0x00000000004A9000-memory.dmp	upx
behavioral1/memory/2480-172-0x0000000000400000-0x00000000004A9000-memory.dmp	upx

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\LP\D3A6\498E.tmp	f3b20f6416600411e0c39b24acdf77ad_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	498E.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f3b20f6416600411e0c39b24acdf77ad_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f3b20f6416600411e0c39b24acdf77ad_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f3b20f6416600411e0c39b24acdf77ad_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2480 wrote to memory of 1368	2480	f3b20f6416600411e0c39b24acdf77ad_JaffaCakes118.exe	31
PID 2480 wrote to memory of 1368	2480	f3b20f6416600411e0c39b24acdf77ad_JaffaCakes118.exe	31
PID 2480 wrote to memory of 1368	2480	f3b20f6416600411e0c39b24acdf77ad_JaffaCakes118.exe	31
PID 2480 wrote to memory of 1368	2480	f3b20f6416600411e0c39b24acdf77ad_JaffaCakes118.exe	31
PID 2480 wrote to memory of 788	2480	f3b20f6416600411e0c39b24acdf77ad_JaffaCakes118.exe	33
PID 2480 wrote to memory of 788	2480	f3b20f6416600411e0c39b24acdf77ad_JaffaCakes118.exe	33
PID 2480 wrote to memory of 788	2480	f3b20f6416600411e0c39b24acdf77ad_JaffaCakes118.exe	33
PID 2480 wrote to memory of 788	2480	f3b20f6416600411e0c39b24acdf77ad_JaffaCakes118.exe	33
PID 2480 wrote to memory of 2308	2480	f3b20f6416600411e0c39b24acdf77ad_JaffaCakes118.exe	34
PID 2480 wrote to memory of 2308	2480	f3b20f6416600411e0c39b24acdf77ad_JaffaCakes118.exe	34
PID 2480 wrote to memory of 2308	2480	f3b20f6416600411e0c39b24acdf77ad_JaffaCakes118.exe	34
PID 2480 wrote to memory of 2308	2480	f3b20f6416600411e0c39b24acdf77ad_JaffaCakes118.exe	34

C:\Users\Admin\AppData\Local\Temp\f3b20f6416600411e0c39b24acdf77ad_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f3b20f6416600411e0c39b24acdf77ad_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2480
- C:\Users\Admin\AppData\Local\Temp\f3b20f6416600411e0c39b24acdf77ad_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\f3b20f6416600411e0c39b24acdf77ad_JaffaCakes118.exe startC:\Program Files (x86)\LP\D3A6\187.exe%C:\Program Files (x86)\LP\D3A6
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1368
- C:\Users\Admin\AppData\Local\Temp\f3b20f6416600411e0c39b24acdf77ad_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\f3b20f6416600411e0c39b24acdf77ad_JaffaCakes118.exe startC:\Program Files (x86)\BBDB4\lvvm.exe%C:\Program Files (x86)\BBDB4
  2⤵
  - System Location Discovery: System Language Discovery
  PID:788
- C:\Program Files (x86)\LP\D3A6\498E.tmp
  "C:\Program Files (x86)\LP\D3A6\498E.tmp"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

3

T1552

Credentials In Files

3

T1552.001

Discovery

Query Registry

1

T1012

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\64EBB\BDB4.4EB

Filesize
600B

MD5
4557ef460b413a24561fe7e6d7dcf053

SHA1
45d3d3829d91a6273f05cb175893146c8a88e32f

SHA256
98a6e888380b12707ca9a6fdba77e0ea44225164317069177b551644dbd03a0f

SHA512
6450fe64a69d9f8c550b167783073858ae6b2d21cdd5597fdff79f0d60627ea592571089d09bbac59b41a034cb826fd72daac35c79689023d4d95ee2c4ce1635

Download Submit
C:\Users\Admin\AppData\Roaming\64EBB\BDB4.4EB

Filesize
996B

MD5
a19fb22a195724969f68f78e6b470bf3

SHA1
990f2777a8d19028a233ab05c8230b289f03cf36

SHA256
8a0a434cfbd1c2758f9c3a3503bae3665af1a5d1d87fa27877a43093ef8fe5ec

SHA512
b68dbc87c46f5e2b4db6b24b59bad754f3d827ab0df5ef0c3380e82bb39e5ed2a4de78f65c295ee728fde79b293607a6badd012b23b5e25fc6047586ca82a6b2

Download Submit
C:\Users\Admin\AppData\Roaming\64EBB\BDB4.4EB

Filesize
1KB

MD5
ac9ca88455905cd64ec919483259af54

SHA1
5ab302fabdd3dfc2c885d116a55a1b86d47a92cf

SHA256
c48a49b763adfe088ccbec6f3dee4bd5209718a572b5955dac58437eb6eef448

SHA512
733b4884c021576f666176141dffb90fe88cf48b949f984e98f254177f63437a324b3b70c440cba582691dfc820f190b4a69d6e05131156015a26691cf4746c3

Download Submit
\Program Files (x86)\LP\D3A6\498E.tmp

Filesize
102KB

MD5
0d45adf3b36475949d7382fa78c68258

SHA1
c3bed91e18fcd1b1a194049eabea626f486a26bc

SHA256
64e8e1cc7eecf9fde81a72ede03851b36c96d36551fe78fb335d3bc1edc49a7e

SHA512
f28c716dba65177141c0f5eb98d3e159db7fb690bb5b5e7168275e77f9cbeb2baa84435dc45979c578a4345c26aff3f8d9cad4987371643116377eaa4618bfd0

Download Submit
memory/788-79-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/788-81-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/1368-14-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/1368-12-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/2308-98-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2308-159-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2480-15-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/2480-1-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/2480-97-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/2480-2-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/2480-172-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads