Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
29-11-2024 17:17
General
-
Target
b2baa33eac977bfa8488880d5ff838b0_JaffaCakes118.exe
-
Size
137KB
-
MD5
b2baa33eac977bfa8488880d5ff838b0
-
SHA1
757b4dd465fb8dbf79c2c959c80e44776610d7e0
-
SHA256
070d539abde2dfb5f406c2903d213ad8d17450be586cde1b4bf71645565a8358
-
SHA512
2606652e94159d26eb1d5b491dd4b34beef84ffa94fb27719d1edb902588163ccb8186f3f67c4efdac499ccf8a75a147be51bbf6f6b906522f79ea9fa317839c
-
SSDEEP
1536:i9iraBoJhSd0AocqjYnjZApb+OF03Xu+rCi2jtU/hIzcCIqAkx20nWwgvIq/jMXm:Qira8CHQsNTOObGteyzzAkA0nW5/sM
Malware Config
Extracted
pony
http://www.alberghi.com:8080/pony/gate.php
http://buyandsmile.atomclick.co:8080/pony/gate.php
-
payload_url
http://caribbeanlifestyles.com/AUYxFT2V/BnP4.exe
http://www.skeyndor.in/N0qQeQuK/R3wb.exe
Signatures
-
Pony family
-
Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b2baa33eac977bfa8488880d5ff838b0_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b2baa33eac977bfa8488880d5ff838b0_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
144KB
-
Filesize
92KB
-
Filesize
92KB
-
Filesize
144KB
-
Filesize
92KB