Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    fbafeeef36ceef3331541881fecee40e_JaffaCakes118

  • Size

    2.2MB

  • Sample

    240928-g5224stdnd

  • MD5

    fbafeeef36ceef3331541881fecee40e

  • SHA1

    d4fdc2475eb7772e28227db83a1524fdf1cb0dd3

  • SHA256

    3ffc393a0d913ebebe341d4cb38775a334ba5f75e5c3d3bf9ec76e2ae8c02c3b

  • SHA512

    3b87c6e078238348904d38a01b1f9c3ee5ecdfcf2ea60a25ab70a5bbae944ede6dee5bf3d98919cdf0aa51568c1ac3aef84aefd83412684d2cad199afb654396

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZh:0UzeyQMS4DqodCnoe+iitjWwwd

Malware Config

Extracted

Family

pony

C2

http://don.service-master.eu/gate.php

Attributes
  • payload_url

    http://don.service-master.eu/shit.exe

Targets

    • Target

      fbafeeef36ceef3331541881fecee40e_JaffaCakes118

    • Size

      2.2MB

    • MD5

      fbafeeef36ceef3331541881fecee40e

    • SHA1

      d4fdc2475eb7772e28227db83a1524fdf1cb0dd3

    • SHA256

      3ffc393a0d913ebebe341d4cb38775a334ba5f75e5c3d3bf9ec76e2ae8c02c3b

    • SHA512

      3b87c6e078238348904d38a01b1f9c3ee5ecdfcf2ea60a25ab70a5bbae944ede6dee5bf3d98919cdf0aa51568c1ac3aef84aefd83412684d2cad199afb654396

    • SSDEEP

      24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZh:0UzeyQMS4DqodCnoe+iitjWwwd

    • Modifies WinLogon for persistence

    • Modifies visiblity of hidden/system files in Explorer

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks