Analysis

  • max time kernel
    122s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    28/09/2024, 07:13 UTC

General

  • Target

    fbc4c76efcac6ffd2ce0bc4b6ec9465a_JaffaCakes118.exe

  • Size

    90KB

  • MD5

    fbc4c76efcac6ffd2ce0bc4b6ec9465a

  • SHA1

    fd7081571cf8aaeb169b233caea6e57ea25c9e32

  • SHA256

    9f2e6e721c5df62c3d7e3b900cac96d2d41be637b8ed0588a688be777eaee368

  • SHA512

    4d842f6819534470fe01f554b09aeb1ffc836e295ff1215a217d05c5b33e3e4015d6846116d6c69afbf31aea9ff16acdb873d482af344e5d57ce4f435a72a5d3

  • SSDEEP

    1536:wfyloaPqT5Wuo5mfimo8PrY/hW5KYH+XGUt5hqkSKaLUotOYQHnHTv1EwYkzmpx/:5tAoIfi5JWPcbYOXH5Ewkpp

Malware Config

Signatures

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
  • Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 32 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fbc4c76efcac6ffd2ce0bc4b6ec9465a_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\fbc4c76efcac6ffd2ce0bc4b6ec9465a_JaffaCakes118.exe"
    1⤵
    • Accesses Microsoft Outlook accounts
    • Accesses Microsoft Outlook profiles
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • outlook_win_path
    PID:2288

Network

  • flag-us
    DNS
    bl4k2.zapto.org
    fbc4c76efcac6ffd2ce0bc4b6ec9465a_JaffaCakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    bl4k2.zapto.org
    IN A
    Response
    bl4k2.zapto.org
    IN A
    0.0.0.0
No results found
  • 8.8.8.8:53
    bl4k2.zapto.org
    dns
    fbc4c76efcac6ffd2ce0bc4b6ec9465a_JaffaCakes118.exe
    61 B
    77 B
    1
    1

    DNS Request

    bl4k2.zapto.org

    DNS Response

    0.0.0.0

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.