Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    28/10/2024, 00:54

General

  • Target

    76d580ff93cfc9abebaa1dff96c179eb_JaffaCakes118.exe

  • Size

    93KB

  • MD5

    76d580ff93cfc9abebaa1dff96c179eb

  • SHA1

    db16373a05c4e55a39cc3f08157b1a7c2b7f0019

  • SHA256

    92457aeac249c1bc3b94b60556af25778e52e9934e0da429def5efc71554171a

  • SHA512

    eb6ccd730900d75f84d53202d5b01d77aaab91dca69716aad0017b3811b47f314f01a5b42837ea63a8a160a665bec19660c7bebe27a6f7fbd2e9ab52f3c7bb1f

  • SSDEEP

    1536:7zvVL1sIdIdnpkql9CaBh4tMMgIQZQ2g+I3/+Bw5uw1xezCt66KUcSb4if79Yxuh:7zvVL1lIdnph9CaQtHn0QaIv+Bw5714I

Malware Config

Signatures

  • Pony family
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

  • Deletes itself 1 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\76d580ff93cfc9abebaa1dff96c179eb_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\76d580ff93cfc9abebaa1dff96c179eb_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2596
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\ytk.bat" "C:\Users\Admin\AppData\Local\Temp\76d580ff93cfc9abebaa1dff96c179eb_JaffaCakes118.exe" "
      2⤵
      • Deletes itself
      • System Location Discovery: System Language Discovery
      PID:2616

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\ytk.bat

    Filesize

    71B

    MD5

    e6b031b9b7d40fa332ebc6f38b2f9f64

    SHA1

    d6dbffcfcc6a26188fd8d2e5b6257af4821fb48f

    SHA256

    66a04ff993916bce61351e4c3b94ea079c806efb1723c7cd79bd32aaf6847e0b

    SHA512

    7d17655334fcda4c3326110d340fd91cd23ee284dec99c3a8bbc8408342fda5f51e27aaba75fba4cccd513c342c22f07ad2cf6e2326ba575e3cc0eba4ea91948

  • memory/2596-1-0x0000000000400000-0x0000000000415000-memory.dmp

    Filesize

    84KB

  • memory/2596-0-0x0000000000220000-0x0000000000320000-memory.dmp

    Filesize

    1024KB

  • memory/2596-2-0x0000000000220000-0x0000000000320000-memory.dmp

    Filesize

    1024KB

  • memory/2596-4-0x0000000000400000-0x0000000000415000-memory.dmp

    Filesize

    84KB

  • memory/2596-3-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB