Analysis

  • max time kernel
    137s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    25-09-2024 19:52

General

  • Target

    f6bf65280550a29ab14bff85a7b4a851_JaffaCakes118.exe

  • Size

    147KB

  • MD5

    f6bf65280550a29ab14bff85a7b4a851

  • SHA1

    6f50cd533af4da7a1aa881dd64a734bc3fd67cd2

  • SHA256

    b305edb86e3d56322f524d9efba6d1e081c985b91f7b193ea53c271c027abb64

  • SHA512

    6d3c87dfd724cb798bea0e32565afeaf5fc8a2f645b9f42a84a221d783c5d3d653fc733a4d4709645e0e6aa5c5b7d9e4d17f5838b8f5eb7a6ecc4227ad3a47cb

  • SSDEEP

    3072:Xre7htdArqaBXO5Gq8fogP1a/WEl3y42N6sXRieQ05:khezBXO5aoCElC4YLgev5

Malware Config

Extracted

Family

pony

C2

http://91.121.93.178:8080/pony/gate.php

http://aurianedamez.fr:8080/pony/gate.php

Attributes
  • payload_url

    http://tradeshowshops.com/eAAht3sE.exe

    http://www.diamondtrust.com/5w2kqp.exe

    http://cpsmortgages.com/6t27yZy.exe

Signatures

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f6bf65280550a29ab14bff85a7b4a851_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\f6bf65280550a29ab14bff85a7b4a851_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of UnmapMainImage
    PID:468

Network

    No results found
  • 91.121.93.178:8080
    f6bf65280550a29ab14bff85a7b4a851_JaffaCakes118.exe
    152 B
    3
  • 91.121.93.178:8080
    f6bf65280550a29ab14bff85a7b4a851_JaffaCakes118.exe
    152 B
    3
  • 91.121.93.178:8080
    f6bf65280550a29ab14bff85a7b4a851_JaffaCakes118.exe
    152 B
    3
  • 91.121.93.178:8080
    f6bf65280550a29ab14bff85a7b4a851_JaffaCakes118.exe
    152 B
    3
  • 91.121.93.178:8080
    f6bf65280550a29ab14bff85a7b4a851_JaffaCakes118.exe
    152 B
    3
  • 91.121.93.178:8080
    f6bf65280550a29ab14bff85a7b4a851_JaffaCakes118.exe
    152 B
    3
No results found

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/468-1-0x00000000002F0000-0x0000000000318000-memory.dmp

    Filesize

    160KB

  • memory/468-0-0x00000000002D0000-0x00000000002E7000-memory.dmp

    Filesize

    92KB

  • memory/468-2-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

  • memory/468-3-0x00000000002F0000-0x0000000000318000-memory.dmp

    Filesize

    160KB

  • memory/468-4-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.