Analysis
-
max time kernel
140s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
30-09-2024 06:52
General
-
Target
000cbb278e4f0194e7c693160d7975bb_JaffaCakes118.exe
-
Size
148KB
-
MD5
000cbb278e4f0194e7c693160d7975bb
-
SHA1
37816b3dd863e3b706c72cd783107ac795332647
-
SHA256
3f8e6cbdb5b689a149346ad692ff53e92520497b61c1737fc721fc86b95a5e09
-
SHA512
a83280dc965d92553270e7468c72cc9e49f75ad78041bdae6f9264119cf8b3fe254c8667c81930dcba93eba9bc44325c33b32a1c293968d4704588b1ccd04c8e
-
SSDEEP
3072:BDE1UYk4Vz9QXoiTmKnxoTFnWQyuTFslBgpuT/PTN6:9skoimKGnWQyucfk
Malware Config
Extracted
pony
http://178.32.160.255:8080/pony/gate.php
http://91.121.178.156:8080/pony/gate.php
-
payload_url
http://tatui.sp.gov.br/ipxb.exe
http://indonesiatravelnow.com/TMJY6.exe
Signatures
-
Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\000cbb278e4f0194e7c693160d7975bb_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\000cbb278e4f0194e7c693160d7975bb_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
176KB
-
Filesize
92KB
-
Filesize
92KB
-
Filesize
92KB
-
Filesize
176KB
-
Filesize
92KB