Overview

overview

10

Static

static

3

fc7f63ccd8...18.exe

windows7-x64

10

fc7f63ccd8...18.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fc7f63ccd826f0bed675aac69a0969d3_JaffaCakes118

  • Size

    1.9MB

  • Sample

    240928-rwce7stbla

  • MD5

    fc7f63ccd826f0bed675aac69a0969d3

  • SHA1

    8bb1e89f1080e272cd77e2a08933a9daf3d9db85

  • SHA256

    ccd9dd1098157c884c04bc46825b296607774534e5c4200b856b28a13e03f365

  • SHA512

    1f661e13ccf40e8321abdf9344a8dc3600c2ec41fbac7be301eaeb381e8d8302565570383c226b34b71a3e020ed5a13a93018a8729db7e8f3e67e52d1019b192

  • SSDEEP

    49152:6/H9zPqoEUP/QsGDFxUGXET3pb2uQUr3ZAK6SQKS:gHZhgFxUfT3gu3r3ZAn

Score
10/10
ponycredential_accessdiscoveryevasionpersistenceratspywarestealerupx

Malware Config

Targets

    • Target

      fc7f63ccd826f0bed675aac69a0969d3_JaffaCakes118

    • Size

      1.9MB

    • MD5

      fc7f63ccd826f0bed675aac69a0969d3

    • SHA1

      8bb1e89f1080e272cd77e2a08933a9daf3d9db85

    • SHA256

      ccd9dd1098157c884c04bc46825b296607774534e5c4200b856b28a13e03f365

    • SHA512

      1f661e13ccf40e8321abdf9344a8dc3600c2ec41fbac7be301eaeb381e8d8302565570383c226b34b71a3e020ed5a13a93018a8729db7e8f3e67e52d1019b192

    • SSDEEP

      49152:6/H9zPqoEUP/QsGDFxUGXET3pb2uQUr3ZAK6SQKS:gHZhgFxUfT3gu3r3ZAn

    Score
    10/10
    ponycredential_accessdiscoveryevasionpersistenceratspywarestealerupx

    • Modifies security service

      evasion

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

      ratspywarestealerpony

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Disables taskbar notifications via registry modification

      evasion

    • Drops file in Drivers directory

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

      credential_accessstealer

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2
T1547

Active Setup

1
T1547.014

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Active Setup

1
T1547.014

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Defense Evasion

Modify Registry

4
T1112

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

3
T1552

Credentials In Files

3
T1552.001

Discovery

Query Registry

2
T1012

System Information Discovery

1
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Data from Local System

2
T1005

Command and Control

Exfiltration

Impact

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.