Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

e617c9f5f9...18.exe

windows7-x64

10

e617c9f5f9...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    93s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/12/2024, 11:08 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    e617c9f5f92d7ee0393ecc6fc46e5b1b_JaffaCakes118.exe

  • Size

    85KB

  • MD5

    e617c9f5f92d7ee0393ecc6fc46e5b1b

  • SHA1

    102652f882e765bc0d12bf31633c6b2d01de19f0

  • SHA256

    8d6f3b91e29e22808e3adac6da8878c54ee35acf21a494a7e25a9d0a9c2378bf

  • SHA512

    847a8960f59d50e3ef4c739df8d7e3dc7a526fb7b615246c7f9b33d069024c3e38657d4cfa96fab2e83674c5a703f14dcf43c9005db3d52aed183f2f05d7771e

  • SSDEEP

    1536:PUM5Fvgo+8rL8gGdI2zVKwGxBMzOFcuv3Z:PptVLWI2J/J3uv3Z

Score
10/10
ponycredential_accessdiscoveryratspywarestealer

Malware Config

Extracted

Family

pony

C2

http://shotthemfupa.com/msaa.php

Signatures

  • Pony family
    pony
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of AdjustPrivilegeToken 48 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e617c9f5f92d7ee0393ecc6fc46e5b1b_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\e617c9f5f92d7ee0393ecc6fc46e5b1b_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2416
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\oid.bat" "C:\Users\Admin\AppData\Local\Temp\e617c9f5f92d7ee0393ecc6fc46e5b1b_JaffaCakes118.exe" "
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4752

Network

  • flag-us
    DNS
    shotthemfupa.com
    e617c9f5f92d7ee0393ecc6fc46e5b1b_JaffaCakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    shotthemfupa.com
    IN A
    Response
  • flag-us
    DNS
    133.211.185.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    133.211.185.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    73.31.126.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    73.31.126.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    shotthemfupa.com
    e617c9f5f92d7ee0393ecc6fc46e5b1b_JaffaCakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    shotthemfupa.com
    IN A
    Response
  • flag-us
    DNS
    shotthemfupa.com
    e617c9f5f92d7ee0393ecc6fc46e5b1b_JaffaCakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    shotthemfupa.com
    IN A
    Response
  • flag-us
    DNS
    209.205.72.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    209.205.72.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    shotthemfupa.com
    e617c9f5f92d7ee0393ecc6fc46e5b1b_JaffaCakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    shotthemfupa.com
    IN A
    Response
  • flag-us
    DNS
    shotthemfupa.com
    e617c9f5f92d7ee0393ecc6fc46e5b1b_JaffaCakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    shotthemfupa.com
    IN A
    Response
  • flag-us
    DNS
    shotthemfupa.com
    e617c9f5f92d7ee0393ecc6fc46e5b1b_JaffaCakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    shotthemfupa.com
    IN A
    Response
  • flag-us
    DNS
    shotthemfupa.com
    e617c9f5f92d7ee0393ecc6fc46e5b1b_JaffaCakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    shotthemfupa.com
    IN A
    Response
  • flag-us
    DNS
    212.20.149.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    212.20.149.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    198.187.3.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    198.187.3.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    86.49.80.91.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    86.49.80.91.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    shotthemfupa.com
    e617c9f5f92d7ee0393ecc6fc46e5b1b_JaffaCakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    shotthemfupa.com
    IN A
    Response
  • flag-us
    DNS
    shotthemfupa.com
    e617c9f5f92d7ee0393ecc6fc46e5b1b_JaffaCakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    shotthemfupa.com
    IN A
    Response
  • flag-us
    DNS
    83.210.23.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    83.210.23.2.in-addr.arpa
    IN PTR
    Response
    83.210.23.2.in-addr.arpa
    IN PTR
    a2-23-210-83deploystaticakamaitechnologiescom
  • flag-us
    DNS
    172.214.232.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.214.232.199.in-addr.arpa
    IN PTR
    Response
No results found
  • 8.8.8.8:53
    shotthemfupa.com
    dns
    e617c9f5f92d7ee0393ecc6fc46e5b1b_JaffaCakes118.exe
    62 B
     135 B
     1
    1

    DNS Request

    shotthemfupa.com

  • 8.8.8.8:53
    133.211.185.52.in-addr.arpa
    dns
    73 B
     147 B
     1
    1

    DNS Request

    133.211.185.52.in-addr.arpa

  • 8.8.8.8:53
    73.31.126.40.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    73.31.126.40.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
     144 B
     1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    shotthemfupa.com
    dns
    e617c9f5f92d7ee0393ecc6fc46e5b1b_JaffaCakes118.exe
    62 B
     135 B
     1
    1

    DNS Request

    shotthemfupa.com

  • 8.8.8.8:53
    shotthemfupa.com
    dns
    e617c9f5f92d7ee0393ecc6fc46e5b1b_JaffaCakes118.exe
    62 B
     135 B
     1
    1

    DNS Request

    shotthemfupa.com

  • 8.8.8.8:53
    209.205.72.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    209.205.72.20.in-addr.arpa

  • 8.8.8.8:53
    shotthemfupa.com
    dns
    e617c9f5f92d7ee0393ecc6fc46e5b1b_JaffaCakes118.exe
    62 B
     135 B
     1
    1

    DNS Request

    shotthemfupa.com

  • 8.8.8.8:53
    shotthemfupa.com
    dns
    e617c9f5f92d7ee0393ecc6fc46e5b1b_JaffaCakes118.exe
    62 B
     135 B
     1
    1

    DNS Request

    shotthemfupa.com

  • 8.8.8.8:53
    shotthemfupa.com
    dns
    e617c9f5f92d7ee0393ecc6fc46e5b1b_JaffaCakes118.exe
    62 B
     135 B
     1
    1

    DNS Request

    shotthemfupa.com

  • 8.8.8.8:53
    shotthemfupa.com
    dns
    e617c9f5f92d7ee0393ecc6fc46e5b1b_JaffaCakes118.exe
    62 B
     135 B
     1
    1

    DNS Request

    shotthemfupa.com

  • 8.8.8.8:53
    212.20.149.52.in-addr.arpa
    dns
    72 B
     146 B
     1
    1

    DNS Request

    212.20.149.52.in-addr.arpa

  • 8.8.8.8:53
    198.187.3.20.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    198.187.3.20.in-addr.arpa

  • 8.8.8.8:53
    86.49.80.91.in-addr.arpa
    dns
    70 B
     145 B
     1
    1

    DNS Request

    86.49.80.91.in-addr.arpa

  • 8.8.8.8:53
    shotthemfupa.com
    dns
    e617c9f5f92d7ee0393ecc6fc46e5b1b_JaffaCakes118.exe
    62 B
     135 B
     1
    1

    DNS Request

    shotthemfupa.com

  • 8.8.8.8:53
    shotthemfupa.com
    dns
    e617c9f5f92d7ee0393ecc6fc46e5b1b_JaffaCakes118.exe
    62 B
     135 B
     1
    1

    DNS Request

    shotthemfupa.com

  • 8.8.8.8:53
    83.210.23.2.in-addr.arpa
    dns
    70 B
     133 B
     1
    1

    DNS Request

    83.210.23.2.in-addr.arpa

  • 8.8.8.8:53
    172.214.232.199.in-addr.arpa
    dns
    74 B
     128 B
     1
    1

    DNS Request

    172.214.232.199.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\oid.bat
    Filesize

    71B

    MD5

    e6b031b9b7d40fa332ebc6f38b2f9f64

    SHA1

    d6dbffcfcc6a26188fd8d2e5b6257af4821fb48f

    SHA256

    66a04ff993916bce61351e4c3b94ea079c806efb1723c7cd79bd32aaf6847e0b

    SHA512

    7d17655334fcda4c3326110d340fd91cd23ee284dec99c3a8bbc8408342fda5f51e27aaba75fba4cccd513c342c22f07ad2cf6e2326ba575e3cc0eba4ea91948

    Download Submit

  • memory/2416-0-0x0000000002160000-0x000000000216E000-memory.dmp

    Filesize

    56KB

    Download

  • memory/2416-1-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

    Download

  • memory/2416-2-0x0000000002160000-0x000000000216E000-memory.dmp

    Filesize

    56KB

    Download

  • memory/2416-3-0x0000000000400000-0x0000000000419000-memory.dmp

    Filesize

    100KB

    Download

  • memory/2416-4-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

    Download

  • memory/2416-11-0x0000000000400000-0x0000000000419000-memory.dmp

    Filesize

    100KB

    Download

  • memory/2416-12-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.