Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    131s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    14/01/2025, 16:30 UTC

General

  • Target

    JaffaCakes118_4061f9781e0c784253f160fca3be1a24.exe

  • Size

    153KB

  • MD5

    4061f9781e0c784253f160fca3be1a24

  • SHA1

    f3abbf11108685a5b84b41a4d7c8c22bdede33d2

  • SHA256

    bc08b2b0db9b2a1c5ab7c57ad88b7538c0842e39ee9bee9cc0d203a1dfaaf689

  • SHA512

    6940f9e12e06a43f290af748531446428434e8b021b851275d69bac6397c793c4cb49a0a8026ab4ef211ac77da83b0ae68dd68d9c9a02f9320e5cc2b869d55c5

  • SSDEEP

    3072:IvIJ/KhkLJgjAzjJOe4am7eFItTY7ntjdO7MzyDmvc08:IvUKh2Jjm7eItOfDpR8

Malware Config

Extracted

Family

pony

C2

http://one.myanmarsar.org/forum/viewtopic.php

http://one.photayokeking.net/forum/viewtopic.php

Attributes
  • payload_url

    http://3073.a.hostable.me/Z2U.exe

    http://85.18.21.252/PNV3Hbi.exe

Signatures

  • Pony family
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

  • Deletes itself 1 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
  • Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 32 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4061f9781e0c784253f160fca3be1a24.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4061f9781e0c784253f160fca3be1a24.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3056
    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4061f9781e0c784253f160fca3be1a24.exe
      "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4061f9781e0c784253f160fca3be1a24.exe"
      2⤵
      • Accesses Microsoft Outlook accounts
      • Accesses Microsoft Outlook profiles
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      • outlook_win_path
      PID:2060
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\abcd.bat" "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4061f9781e0c784253f160fca3be1a24.exe" "
        3⤵
        • Deletes itself
        • System Location Discovery: System Language Discovery
        PID:1640

Network

  • flag-us
    DNS
    one.myanmarsar.org
    JaffaCakes118_4061f9781e0c784253f160fca3be1a24.exe
    Remote address:
    8.8.8.8:53
    Request
    one.myanmarsar.org
    IN A
    Response
  • flag-us
    DNS
    one.myanmarsar.org
    JaffaCakes118_4061f9781e0c784253f160fca3be1a24.exe
    Remote address:
    8.8.8.8:53
    Request
    one.myanmarsar.org
    IN A
    Response
  • flag-us
    DNS
    one.photayokeking.net
    JaffaCakes118_4061f9781e0c784253f160fca3be1a24.exe
    Remote address:
    8.8.8.8:53
    Request
    one.photayokeking.net
    IN A
    Response
  • flag-us
    DNS
    3073.a.hostable.me
    JaffaCakes118_4061f9781e0c784253f160fca3be1a24.exe
    Remote address:
    8.8.8.8:53
    Request
    3073.a.hostable.me
    IN A
    Response
  • flag-us
    DNS
    3073.a.hostable.me
    JaffaCakes118_4061f9781e0c784253f160fca3be1a24.exe
    Remote address:
    8.8.8.8:53
    Request
    3073.a.hostable.me
    IN A
    Response
  • flag-us
    DNS
    3073.a.hostable.me
    JaffaCakes118_4061f9781e0c784253f160fca3be1a24.exe
    Remote address:
    8.8.8.8:53
    Request
    3073.a.hostable.me
    IN A
    Response
  • 85.18.21.252:80
    JaffaCakes118_4061f9781e0c784253f160fca3be1a24.exe
    152 B
    3
  • 8.8.8.8:53
    one.myanmarsar.org
    dns
    JaffaCakes118_4061f9781e0c784253f160fca3be1a24.exe
    128 B
    292 B
    2
    2

    DNS Request

    one.myanmarsar.org

    DNS Request

    one.myanmarsar.org

  • 8.8.8.8:53
    one.photayokeking.net
    dns
    JaffaCakes118_4061f9781e0c784253f160fca3be1a24.exe
    67 B
    140 B
    1
    1

    DNS Request

    one.photayokeking.net

  • 8.8.8.8:53
    3073.a.hostable.me
    dns
    JaffaCakes118_4061f9781e0c784253f160fca3be1a24.exe
    192 B
    192 B
    3
    3

    DNS Request

    3073.a.hostable.me

    DNS Request

    3073.a.hostable.me

    DNS Request

    3073.a.hostable.me

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\abcd.bat

    Filesize

    75B

    MD5

    0849cfe65b98ba5fcd9a9ec61a671d09

    SHA1

    9d0ccb383c32b1bc07fd9064b9324a18e1276902

    SHA256

    44f6a1e48081deccfb61075e585bcb36c6d8e8feeb6ebae50bab41677822c643

    SHA512

    afdeda8122b4cefcf7549018c40d3142985e88a6d8f13eb58e9a59aa312b73608123de5f9feebc2ce25b6ec215d23c324b9f3a9a0e97041d67d863a25e15e57a

  • memory/2060-5-0x0000000000400000-0x0000000000419000-memory.dmp

    Filesize

    100KB

  • memory/2060-11-0x0000000000400000-0x0000000000419000-memory.dmp

    Filesize

    100KB

  • memory/2060-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2060-7-0x0000000000400000-0x0000000000419000-memory.dmp

    Filesize

    100KB

  • memory/2060-3-0x0000000000400000-0x0000000000419000-memory.dmp

    Filesize

    100KB

  • memory/2060-1-0x0000000000400000-0x0000000000419000-memory.dmp

    Filesize

    100KB

  • memory/2060-16-0x0000000000400000-0x0000000000419000-memory.dmp

    Filesize

    100KB

  • memory/2060-17-0x0000000000400000-0x0000000000419000-memory.dmp

    Filesize

    100KB

  • memory/2060-40-0x0000000000400000-0x0000000000419000-memory.dmp

    Filesize

    100KB

  • memory/3056-14-0x0000000000400000-0x000000000042C000-memory.dmp

    Filesize

    176KB

  • memory/3056-0-0x0000000000400000-0x000000000042C000-memory.dmp

    Filesize

    176KB

  • memory/3056-25-0x0000000000360000-0x000000000038C000-memory.dmp

    Filesize

    176KB

  • memory/3056-15-0x0000000000360000-0x000000000038C000-memory.dmp

    Filesize

    176KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.