Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

27/09/2024, 00:35 UTC

240927-axjr8swdkn 10

27/09/2024, 00:31 UTC

240927-avfb2awckq 10

General

  • Target

    f967a2804930393bc3234957bb0d99c3_JaffaCakes118

  • Size

    2.2MB

  • Sample

    240927-avfb2awckq

  • MD5

    f967a2804930393bc3234957bb0d99c3

  • SHA1

    6862a6b2cac87e146888901cad620d56381f115f

  • SHA256

    d47277350e6e5c15f013c2af98ae8a51fea1ebd02acb9db40417e43c017066c6

  • SHA512

    9b8c5584c5a29b003ec877efea00e18f38e95bc27e462d33007ba2eb85663ed3dbd22ec412edadad2d28d7af8a757f2f11d2572fe1d3df893fec6224933c1bda

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZj:0UzeyQMS4DqodCnoe+iitjWwwf

Malware Config

Extracted

Family

pony

C2

http://don.service-master.eu/gate.php

Attributes
  • payload_url

    http://don.service-master.eu/shit.exe

Targets

    • Target

      f967a2804930393bc3234957bb0d99c3_JaffaCakes118

    • Size

      2.2MB

    • MD5

      f967a2804930393bc3234957bb0d99c3

    • SHA1

      6862a6b2cac87e146888901cad620d56381f115f

    • SHA256

      d47277350e6e5c15f013c2af98ae8a51fea1ebd02acb9db40417e43c017066c6

    • SHA512

      9b8c5584c5a29b003ec877efea00e18f38e95bc27e462d33007ba2eb85663ed3dbd22ec412edadad2d28d7af8a757f2f11d2572fe1d3df893fec6224933c1bda

    • SSDEEP

      24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZj:0UzeyQMS4DqodCnoe+iitjWwwf

    • Modifies WinLogon for persistence

    • Modifies visiblity of hidden/system files in Explorer

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.