Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
04-01-2025 22:06
General
-
Target
JaffaCakes118_7c1c369ed1388e96789cabf1ddc333b0.exe
-
Size
118KB
-
MD5
7c1c369ed1388e96789cabf1ddc333b0
-
SHA1
27a23fe75816f957615fe4a03a3acac34153647b
-
SHA256
c0451b37d7a8cc852a8bced0d2ff3e6b93858f7d89630c5885e462fd4d3a9d7b
-
SHA512
ec8929471e6f82cf9dbddb7ea87ff538449e788c69cbcb165b7b6163bb91d3549c3cc9353577233e291b1b56d98288fe388f5b5596fb5baa2a5799d2168c94d0
-
SSDEEP
1536:Juk4z8aAbLnIyCajwyHhrFixeqE38kshKOPd1l6czF3oNCqGqo6Fodbhi9pMXJSC:JdhgFE6hXPd/F8C56FIhi9GXJuZs
Malware Config
Extracted
pony
http://supportquilting.com/forum/viewtopic.php
http://eaglebay-eb5.com/forum/viewtopic.php
http://eaglebay5.com/forum/viewtopic.php
http://wcaband.org/forum/viewtopic.php
-
payload_url
http://ftp.ixcenter.com/juA3j.exe
http://www.movimento5stellesorrento.com/s2w.exe
http://newsouthdental.com/4JX.exe
http://hkcps.com.cn/duFpAk.exe
Signatures
-
Pony family
-
Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
-
Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 8 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7c1c369ed1388e96789cabf1ddc333b0.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7c1c369ed1388e96789cabf1ddc333b0.exe"1⤵
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- outlook_win_path
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
136KB
-
Filesize
136KB
-
Filesize
136KB
-
Filesize
136KB
-
Filesize
4KB
-
Filesize
136KB