Analysis

  • max time kernel
    136s
  • max time network
    145s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    25-09-2024 17:33

General

  • Target

    f68334f51b8f632ed7d5f16715efaee0_JaffaCakes118.exe

  • Size

    94KB

  • MD5

    f68334f51b8f632ed7d5f16715efaee0

  • SHA1

    b9436251c5c874ea058436cbcb384c79239d6c95

  • SHA256

    d4add91aa6f9621e7503b030b88bf0537c73c97de7deed282698b200e606a612

  • SHA512

    01f643e2fa602bfbcd7738652c73c8fd4d3f30ee909aa3793ae6ca0d70da07102cf343d0599e58a8329963f212a56bf66727816f75802c101eb8e18dd932a15d

  • SSDEEP

    1536:/pA2Mo48l1ZJ/R+faqQCyTSV/xLuA86U/jhgCGsJWVr9T83utpWClqDS8:3r3l1ZJ/4SqQC6ShxzaFgCTJWVr9T83b

Malware Config

Extracted

Family

pony

C2

http://176.28.18.135:8080/pony/gate.php

http://85.214.243.87:8080/pony/gate.php

http://88.85.99.44:8080/pony/gate.php

Attributes
  • payload_url

    http://cinecolor.com.ar/GPFito.exe

    http://www.bomcreto.com.br/sWt7gc5m.exe

    http://hellenic-antiaging-academy.gr/2wY.exe

    http://www.chapliniana.com/YCjPqL.exe

Signatures

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f68334f51b8f632ed7d5f16715efaee0_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\f68334f51b8f632ed7d5f16715efaee0_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of UnmapMainImage
    PID:2704

Network

    No results found
  • 176.28.18.135:8080
    f68334f51b8f632ed7d5f16715efaee0_JaffaCakes118.exe
    152 B
    3
  • 176.28.18.135:8080
    f68334f51b8f632ed7d5f16715efaee0_JaffaCakes118.exe
    152 B
    3
  • 176.28.18.135:8080
    f68334f51b8f632ed7d5f16715efaee0_JaffaCakes118.exe
    152 B
    3
  • 176.28.18.135:8080
    f68334f51b8f632ed7d5f16715efaee0_JaffaCakes118.exe
    152 B
    3
  • 176.28.18.135:8080
    f68334f51b8f632ed7d5f16715efaee0_JaffaCakes118.exe
    152 B
    3
  • 176.28.18.135:8080
    f68334f51b8f632ed7d5f16715efaee0_JaffaCakes118.exe
    152 B
    3
No results found

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2704-0-0x00000000002C0000-0x00000000002D7000-memory.dmp

    Filesize

    92KB

  • memory/2704-1-0x00000000002E0000-0x00000000002FA000-memory.dmp

    Filesize

    104KB

  • memory/2704-2-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

  • memory/2704-3-0x00000000002E0000-0x00000000002FA000-memory.dmp

    Filesize

    104KB

  • memory/2704-4-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.