pony | ea99377a1bd16dda908f4a850b0681a0aee0bb7c702d951b9251896ee66dc8e9

General

Target
590382baeebad00c1320ed21910ae1f7_JaffaCakes118.exe
Size 115KB
Sample241018-xq7baatblh
SHA256 ea99377a1bd16dda908f4a850b0681a0aee0bb7c702d951b9251896ee66dc8e9
MD5 590382baeebad00c1320ed21910ae1f7
SHA1 ac27a54b45d1b2582714767382c2a88d94419d23
SHA512 ad8a7152a3f9d3fdb7b34266a4680a5e5f841527e4008b026bfa77c09c5370cd23b2e8b1e8c3b1bf4fa60a08936764b1ef7215f81a8256a94fafce64d933e663
SSDEEP 3072:bXAtWYKBlLnmG8UOOSXMHJRd6mowYgPd6w9:DAoYKXLn+NOS256
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

C2

Attributes

payload_url
http://certidao.adv.br/UnVcLzvR/scC.exe

http://deccatanks.co.uk/4CWKRhBv/oXmSXT1s.exe

http://cfinder.dtme.net/FEDdYaMM/bzTbkvu.exe

http://imo213.com/Y0BDbt8p/GhnU.exe

http://lab.nghcc.org.tw/yMczUqoA/CtPZ.exe

http://padariaestrelasjc.com.br/76pquByi/yqc5ufFM.exe

http://drinkpilot.com/dfAqK8cD/8gR.exe

http://wiki.ehost.pl/ePb25EHR/vy4U.exe

http://hernandezmotores.cl/fhouFXAc/SWvU2uC.exe

http://praticaprojetos.com.br/fHVwaTjV/EBExe7.exe

http://ctamdq.org.ar/mr3ARzbf/5c43.exe

http://comf.com.br/qiVc6c4E/vDnU22yZ.exe

http://profitwithauctions.com/UQGXPnim/w5oG6.exe

http://www.futuremetrics.net/XmEay48n/6TmiYF.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

Email Collection

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	590382baeebad00c1320ed21910ae1f7_JaffaCakes118.exe

Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs

Email Collection

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	590382baeebad00c1320ed21910ae1f7_JaffaCakes118.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2500 set thread context of 4476	2500	590382baeebad00c1320ed21910ae1f7_JaffaCakes118.exe	94

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	590382baeebad00c1320ed21910ae1f7_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	590382baeebad00c1320ed21910ae1f7_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeImpersonatePrivilege	4476	590382baeebad00c1320ed21910ae1f7_JaffaCakes118.exe
Token: SeTcbPrivilege	4476	590382baeebad00c1320ed21910ae1f7_JaffaCakes118.exe
Token: SeChangeNotifyPrivilege	4476	590382baeebad00c1320ed21910ae1f7_JaffaCakes118.exe
Token: SeCreateTokenPrivilege	4476	590382baeebad00c1320ed21910ae1f7_JaffaCakes118.exe
Token: SeBackupPrivilege	4476	590382baeebad00c1320ed21910ae1f7_JaffaCakes118.exe
Token: SeRestorePrivilege	4476	590382baeebad00c1320ed21910ae1f7_JaffaCakes118.exe
Token: SeIncreaseQuotaPrivilege	4476	590382baeebad00c1320ed21910ae1f7_JaffaCakes118.exe
Token: SeAssignPrimaryTokenPrivilege	4476	590382baeebad00c1320ed21910ae1f7_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2500 wrote to memory of 4476	2500	590382baeebad00c1320ed21910ae1f7_JaffaCakes118.exe	94
PID 2500 wrote to memory of 4476	2500	590382baeebad00c1320ed21910ae1f7_JaffaCakes118.exe	94
PID 2500 wrote to memory of 4476	2500	590382baeebad00c1320ed21910ae1f7_JaffaCakes118.exe	94
PID 2500 wrote to memory of 4476	2500	590382baeebad00c1320ed21910ae1f7_JaffaCakes118.exe	94
PID 2500 wrote to memory of 4476	2500	590382baeebad00c1320ed21910ae1f7_JaffaCakes118.exe	94
PID 2500 wrote to memory of 4476	2500	590382baeebad00c1320ed21910ae1f7_JaffaCakes118.exe	94
PID 2500 wrote to memory of 4476	2500	590382baeebad00c1320ed21910ae1f7_JaffaCakes118.exe	94
PID 2500 wrote to memory of 4476	2500	590382baeebad00c1320ed21910ae1f7_JaffaCakes118.exe	94

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	590382baeebad00c1320ed21910ae1f7_JaffaCakes118.exe