Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    142s
  • max time network
    146s
  • platform
    windows7_x64
  • resource
    win7-20241023-en
  • resource tags

    arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
  • submitted
    05/01/2025, 02:13 UTC

General

  • Target

    4b0eec704f0dcaac716cb941891cbf0fe66201cb454a28c889c853208c80461f.exe

  • Size

    116KB

  • MD5

    683367d4fcf71713f6a0b01ff1777180

  • SHA1

    5db25707a12ae21289e56592f5831e1fc5938142

  • SHA256

    4b0eec704f0dcaac716cb941891cbf0fe66201cb454a28c889c853208c80461f

  • SHA512

    f0bb5d0f4c67b0abc4e05d89706e5a8ae1d41fcceca10a529a8998eecddaa98c2b7bc00f52b08c9fb891a88bdf0e598179f8dd9e80a00acb1b98d60215d57c52

  • SSDEEP

    3072:yPvZC1RGnktWXQ2vwJEbBW8ywPjgnIv1jhrr7xx:d14ne8fvTbQ8y01tr

Malware Config

Extracted

Family

pony

C2

http://watertreecapital.com/ponyz/gate.php

http://attentivetodetails.com/ponyz/gate.php

http://furnishedfloorplans.com/ponyz/gate.php

http://helisovertidewater.com/ponyz/gate.php

Attributes
  • payload_url

    http://www.acmestore.it/L4cWn.exe

    http://server.autobeschriftung.at/nEjcrEA.exe

    http://test.iboitalia.org/C7oaNwB.exe

Signatures

  • Pony family
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
  • Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4b0eec704f0dcaac716cb941891cbf0fe66201cb454a28c889c853208c80461f.exe
    "C:\Users\Admin\AppData\Local\Temp\4b0eec704f0dcaac716cb941891cbf0fe66201cb454a28c889c853208c80461f.exe"
    1⤵
    • Accesses Microsoft Outlook accounts
    • Accesses Microsoft Outlook profiles
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • outlook_win_path
    PID:2312

Network

  • flag-us
    DNS
    watertreecapital.com
    4b0eec704f0dcaac716cb941891cbf0fe66201cb454a28c889c853208c80461f.exe
    Remote address:
    8.8.8.8:53
    Request
    watertreecapital.com
    IN A
    Response
    watertreecapital.com
    IN A
    198.12.234.178
  • flag-us
    DNS
    watertreecapital.com
    4b0eec704f0dcaac716cb941891cbf0fe66201cb454a28c889c853208c80461f.exe
    Remote address:
    8.8.8.8:53
    Request
    watertreecapital.com
    IN A
  • 198.12.234.178:80
    watertreecapital.com
    4b0eec704f0dcaac716cb941891cbf0fe66201cb454a28c889c853208c80461f.exe
    152 B
    3
  • 198.12.234.178:80
    watertreecapital.com
    4b0eec704f0dcaac716cb941891cbf0fe66201cb454a28c889c853208c80461f.exe
    152 B
    3
  • 198.12.234.178:80
    watertreecapital.com
    4b0eec704f0dcaac716cb941891cbf0fe66201cb454a28c889c853208c80461f.exe
    152 B
    3
  • 198.12.234.178:80
    watertreecapital.com
    4b0eec704f0dcaac716cb941891cbf0fe66201cb454a28c889c853208c80461f.exe
    152 B
    3
  • 198.12.234.178:80
    watertreecapital.com
    4b0eec704f0dcaac716cb941891cbf0fe66201cb454a28c889c853208c80461f.exe
    152 B
    3
  • 198.12.234.178:80
    watertreecapital.com
    4b0eec704f0dcaac716cb941891cbf0fe66201cb454a28c889c853208c80461f.exe
    104 B
    2
  • 8.8.8.8:53
    watertreecapital.com
    dns
    4b0eec704f0dcaac716cb941891cbf0fe66201cb454a28c889c853208c80461f.exe
    132 B
    82 B
    2
    1

    DNS Request

    watertreecapital.com

    DNS Request

    watertreecapital.com

    DNS Response

    198.12.234.178

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2312-0-0x00000000003F0000-0x00000000003F1000-memory.dmp

    Filesize

    4KB

  • memory/2312-1-0x00000000001B0000-0x00000000001B1000-memory.dmp

    Filesize

    4KB

  • memory/2312-2-0x0000000000400000-0x0000000000421000-memory.dmp

    Filesize

    132KB

  • memory/2312-3-0x0000000000400000-0x0000000000421000-memory.dmp

    Filesize

    132KB

  • memory/2312-4-0x0000000000400000-0x0000000000421000-memory.dmp

    Filesize

    132KB

  • memory/2312-5-0x00000000003F0000-0x00000000003F1000-memory.dmp

    Filesize

    4KB

  • memory/2312-6-0x0000000000400000-0x0000000000421000-memory.dmp

    Filesize

    132KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.