Analysis

  • max time kernel
    15s
  • max time network
    19s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    13-12-2024 17:48

General

  • Target

    ecaa4d16119e30336c67051880ff40df_JaffaCakes118.exe

  • Size

    93KB

  • MD5

    ecaa4d16119e30336c67051880ff40df

  • SHA1

    0a9ef9f9496b41c157f2435a98f224d064185212

  • SHA256

    d9a5a0c7e959d75be1bcd0eed2e90e18abf644019ff2861a4faec783279e8c4c

  • SHA512

    ab644936d600bdb1453dc89239409aa451c0be83008630f46df6bc4628ee276756f1020ccea73b4d3c06c55d6a370cdf3b11f555d725582a7f556c8b74c77685

  • SSDEEP

    1536:D+oM7G2uQNV/0rc6sdC3CYI9sdMZmMVF3iYVs9UngGr/sAzFPEUIWnUoya5bcu:D+BQ5sETIyKfiYVJv/sABNIWUNyb/

Malware Config

Signatures

  • Pony family
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

  • Deletes itself 1 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ecaa4d16119e30336c67051880ff40df_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\ecaa4d16119e30336c67051880ff40df_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2496
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\ytk.bat" "C:\Users\Admin\AppData\Local\Temp\ecaa4d16119e30336c67051880ff40df_JaffaCakes118.exe" "
      2⤵
      • Deletes itself
      • System Location Discovery: System Language Discovery
      PID:2872

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\ytk.bat

    Filesize

    71B

    MD5

    e6b031b9b7d40fa332ebc6f38b2f9f64

    SHA1

    d6dbffcfcc6a26188fd8d2e5b6257af4821fb48f

    SHA256

    66a04ff993916bce61351e4c3b94ea079c806efb1723c7cd79bd32aaf6847e0b

    SHA512

    7d17655334fcda4c3326110d340fd91cd23ee284dec99c3a8bbc8408342fda5f51e27aaba75fba4cccd513c342c22f07ad2cf6e2326ba575e3cc0eba4ea91948

  • memory/2496-1-0x0000000000400000-0x0000000000415000-memory.dmp

    Filesize

    84KB

  • memory/2496-0-0x0000000001C30000-0x0000000001D30000-memory.dmp

    Filesize

    1024KB

  • memory/2496-2-0x0000000001C30000-0x0000000001D30000-memory.dmp

    Filesize

    1024KB

  • memory/2496-3-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/2496-4-0x0000000000400000-0x0000000000415000-memory.dmp

    Filesize

    84KB