Overview

overview

10

Static

static

3

140774e4cc...18.exe

windows7-x64

10

140774e4cc...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04-10-2024 16:04

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    140774e4ccc0abc1d6116394bb6ffd90_JaffaCakes118.exe

  • Size

    120KB

  • MD5

    140774e4ccc0abc1d6116394bb6ffd90

  • SHA1

    8d21ef0129078a60716d72e4bb6f822005ad202d

  • SHA256

    133211f4466289bd609e5179b9ff2a1ba6e40afa2c37345255eab80a7dee5e69

  • SHA512

    00313b6ac6311366a6890aa7e7fa8d1e13578880703b360026b1314884440e210f298e014b71b1e429fdc309bc9e0d5f97cbdabfbfbfe6697ce3c9e544345461

  • SSDEEP

    1536:ZRaJLwYVtRmfwJQYhrLIsG3S6kpqlht9A5Bw9KkkfadYGsVi76ssKJNKiORY:ZXoJQYNLN6kArA5KkfadYGsM3scGY

Score
10/10
ponycollectioncredential_accessdiscoveryratspywarestealer

Malware Config

Extracted

Family

pony

C2

http://nursenextdoor.com:443/forum/viewtopic.php

http://dreamonseniorswish.org:443/forum/viewtopic.php

http://prospexleads.com:8080/forum/viewtopic.php

http://phonebillssuck.com:8080/forum/viewtopic.php
Attributes
  • payload_url

    http://atlas247.com/aetNy.exe

    http://listinopainting.com/c8BHUBf.exe

    http://lemuelacosta.com/MZQB.exe

    http://www.srlgeus.it/0zhtDRem.exe

Signatures

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
    collection
  • Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
    collection
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\140774e4ccc0abc1d6116394bb6ffd90_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\140774e4ccc0abc1d6116394bb6ffd90_JaffaCakes118.exe"
    1⤵
    • Accesses Microsoft Outlook accounts
    • Accesses Microsoft Outlook profiles
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • outlook_win_path
    PID:516

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/516-0-0x00000000001C0000-0x00000000001C1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/516-1-0x00000000001D0000-0x00000000001D1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/516-2-0x0000000000400000-0x0000000000420000-memory.dmp

    Filesize

    128KB

    Download

  • memory/516-3-0x0000000000400000-0x0000000000420000-memory.dmp

    Filesize

    128KB

    Download

  • memory/516-4-0x0000000000400000-0x0000000000420000-memory.dmp

    Filesize

    128KB

    Download

  • memory/516-5-0x00000000001C0000-0x00000000001C1000-memory.dmp

    Filesize

    4KB

    Download