Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    93s
  • max time network
    94s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/11/2024, 03:35 UTC

General

  • Target

    0731218a708f1caed8a253a98e4269444ff45f3f378511a50a434968afaa98a4N.exe

  • Size

    261KB

  • MD5

    af5f75a75ee0dd29b36b1d6a225d7b40

  • SHA1

    63c64b735e4b45d99205d05b1a69a3ab65dd1447

  • SHA256

    0731218a708f1caed8a253a98e4269444ff45f3f378511a50a434968afaa98a4

  • SHA512

    08b83ca3eb396e8c714c6e05f4c52359e3e2eb6514eda5ca57024b2cf9bb72b0e8700941067c0daf9ff9782b24c183216b05c564a82718e5278c63fa80c16262

  • SSDEEP

    3072:YQXWydZFSHrDurD45T7NBteYwAe7iJKIxfTiMehVqLPLLLLLDLLLLLL3LLLLLLLH:wG38t1wAe79IZG2YcKk

Malware Config

Extracted

Family

pony

C2

http://al-shifaa.com/cubby/gate.php

Signatures

  • Pony family
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Uses the VBS compiler for execution 1 TTPs
  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
  • Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 49 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0731218a708f1caed8a253a98e4269444ff45f3f378511a50a434968afaa98a4N.exe
    "C:\Users\Admin\AppData\Local\Temp\0731218a708f1caed8a253a98e4269444ff45f3f378511a50a434968afaa98a4N.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2056
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\\vbc.exe"
      2⤵
      • Accesses Microsoft Outlook accounts
      • Accesses Microsoft Outlook profiles
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      • outlook_win_path
      PID:1632
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\240624453.bat" "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" "
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1936

Network

  • flag-us
    DNS
    209.205.72.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    209.205.72.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    68.159.190.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    68.159.190.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    al-shifaa.com
    vbc.exe
    Remote address:
    8.8.8.8:53
    Request
    al-shifaa.com
    IN A
    Response
    al-shifaa.com
    IN A
    15.197.148.33
    al-shifaa.com
    IN A
    3.33.130.190
  • flag-us
    GET
    http://al-shifaa.com/cubby/gate.php
    vbc.exe
    Remote address:
    15.197.148.33:80
    Request
    GET /cubby/gate.php HTTP/1.0
    Host: al-shifaa.com
    Accept: */*
    Accept-Encoding: identity, *;q=0
    Connection: close
    User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows 98)
    Response
    HTTP/1.1 200 OK
    Server: openresty
    Date: Mon, 25 Nov 2024 03:35:50 GMT
    Content-Type: text/html
    Content-Length: 114
    Connection: close
  • flag-us
    DNS
    33.148.197.15.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    33.148.197.15.in-addr.arpa
    IN PTR
    Response
    33.148.197.15.in-addr.arpa
    IN PTR
    a2aa9ff50de748dbeawsglobalacceleratorcom
  • flag-us
    DNS
    196.249.167.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    196.249.167.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    104.219.191.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    104.219.191.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    212.20.149.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    212.20.149.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    18.31.95.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    18.31.95.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    240.221.184.93.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    240.221.184.93.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    172.214.232.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.214.232.199.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    30.243.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    30.243.111.52.in-addr.arpa
    IN PTR
    Response
  • 15.197.148.33:80
    http://al-shifaa.com/cubby/gate.php
    http
    vbc.exe
    455 B
    506 B
    6
    6

    HTTP Request

    GET http://al-shifaa.com/cubby/gate.php

    HTTP Response

    200
  • 8.8.8.8:53
    209.205.72.20.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    209.205.72.20.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
    144 B
    1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    68.159.190.20.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    68.159.190.20.in-addr.arpa

  • 8.8.8.8:53
    al-shifaa.com
    dns
    vbc.exe
    59 B
    91 B
    1
    1

    DNS Request

    al-shifaa.com

    DNS Response

    15.197.148.33
    3.33.130.190

  • 8.8.8.8:53
    33.148.197.15.in-addr.arpa
    dns
    72 B
    128 B
    1
    1

    DNS Request

    33.148.197.15.in-addr.arpa

  • 8.8.8.8:53
    196.249.167.52.in-addr.arpa
    dns
    73 B
    147 B
    1
    1

    DNS Request

    196.249.167.52.in-addr.arpa

  • 8.8.8.8:53
    104.219.191.52.in-addr.arpa
    dns
    73 B
    147 B
    1
    1

    DNS Request

    104.219.191.52.in-addr.arpa

  • 8.8.8.8:53
    212.20.149.52.in-addr.arpa
    dns
    72 B
    146 B
    1
    1

    DNS Request

    212.20.149.52.in-addr.arpa

  • 8.8.8.8:53
    18.31.95.13.in-addr.arpa
    dns
    70 B
    144 B
    1
    1

    DNS Request

    18.31.95.13.in-addr.arpa

  • 8.8.8.8:53
    240.221.184.93.in-addr.arpa
    dns
    73 B
    144 B
    1
    1

    DNS Request

    240.221.184.93.in-addr.arpa

  • 8.8.8.8:53
    172.214.232.199.in-addr.arpa
    dns
    74 B
    128 B
    1
    1

    DNS Request

    172.214.232.199.in-addr.arpa

  • 8.8.8.8:53
    30.243.111.52.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    30.243.111.52.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\240624453.bat

    Filesize

    94B

    MD5

    3880eeb1c736d853eb13b44898b718ab

    SHA1

    4eec9d50360cd815211e3c4e6bdd08271b6ec8e6

    SHA256

    936d9411d5226b7c5a150ecaf422987590a8870c8e095e1caa072273041a86e7

    SHA512

    3eaa3dddd7a11942e75acd44208fbe3d3ff8f4006951cd970fb9ab748c160739409803450d28037e577443504707fc310c634e9dc54d0c25e8cfe6094f017c6b

  • memory/1632-4-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

  • memory/1632-7-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

  • memory/1632-9-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

  • memory/1632-15-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

  • memory/2056-0-0x0000000074CF2000-0x0000000074CF3000-memory.dmp

    Filesize

    4KB

  • memory/2056-1-0x0000000074CF0000-0x00000000752A1000-memory.dmp

    Filesize

    5.7MB

  • memory/2056-2-0x0000000074CF0000-0x00000000752A1000-memory.dmp

    Filesize

    5.7MB

  • memory/2056-3-0x0000000074CF0000-0x00000000752A1000-memory.dmp

    Filesize

    5.7MB

  • memory/2056-10-0x0000000074CF0000-0x00000000752A1000-memory.dmp

    Filesize

    5.7MB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.