Analysis

  • max time kernel
    136s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    02-12-2024 02:24

General

  • Target

    b6556023833e3b4cac291f32aaad90f0_JaffaCakes118.exe

  • Size

    107KB

  • MD5

    b6556023833e3b4cac291f32aaad90f0

  • SHA1

    c2d1b901628b3d10756018f5bf87ee333fac964e

  • SHA256

    bc6c892e949f9d149985a7f5bbc269d751681f3bdf56a0a0e91e8480be90a6e6

  • SHA512

    03f29fa8fca25d8ce6715db8b420bc1cf12eea04d9686f34a43a2b3106f3ccc5b855580a6e61cfc187b4e379ce0cfb44af849d260c3846d9a25a16244387c73e

  • SSDEEP

    3072:QxOmfJtDnYC3NJtR/4fM/+pdxYcw8BmB0s1Z:OJVT3NJXeM3c5wv

Malware Config

Extracted

Family

pony

C2

http://91.121.84.204:8080/pony/gate.php

http://91.121.93.178:8080/pony/gate.php

Attributes
  • payload_url

    http://proyectoindio.org/7Qo.exe

    http://astronomika.com/493.exe

    http://12am.ro/0iZDFn1.exe

Signatures

  • Pony family
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b6556023833e3b4cac291f32aaad90f0_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\b6556023833e3b4cac291f32aaad90f0_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of UnmapMainImage
    PID:3016

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3016-0-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

  • memory/3016-2-0x0000000000420000-0x000000000043E000-memory.dmp

    Filesize

    120KB

  • memory/3016-1-0x00000000003D0000-0x00000000003E7000-memory.dmp

    Filesize

    92KB

  • memory/3016-3-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

  • memory/3016-4-0x00000000003D0000-0x00000000003E7000-memory.dmp

    Filesize

    92KB

  • memory/3016-5-0x0000000000420000-0x000000000043E000-memory.dmp

    Filesize

    120KB

  • memory/3016-6-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

  • memory/3016-7-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB