Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

1

JaffaCakes...71.exe

windows7-x64

10

JaffaCakes...71.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/01/2025, 21:26 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    JaffaCakes118_2fca1fc07cd8574023c45019e2197f71.exe

  • Size

    131KB

  • MD5

    2fca1fc07cd8574023c45019e2197f71

  • SHA1

    478d1aff1c3bfa8a5870dabc507a5e79d01a5868

  • SHA256

    26dc0165efedeabf965f3bc2b346797ee1906f61cc9a71119728e30a10ede799

  • SHA512

    e76df5b926bc63aa09403fc6304ff3466573def1104c6476071954f243b362b735e4121a1731fe8c95e2f41876860873e360e8deae7bd02f0e3eb37c1adabcae

  • SSDEEP

    3072:86eBa0SBz4rLirtoCU1qkX6njc1w5oPsyNJN:2BbKWatorALjc1jsyNJN

Score
10/10
ponycollectioncredential_accessdiscoveryratspywarestealer

Malware Config

Extracted

Family

pony

C2

http://q.dugongmozambique.com/forum/viewtopic.php

http://q.e-tecinnovation.co.uk/forum/viewtopic.php
Attributes
  • payload_url

    http://mulayimakca.com/LA6KuCv7.exe

    http://noralimodio.com.ar/QMG6.exe

Signatures

  • Pony family
    pony
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
    collection
  • Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
    collection
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of AdjustPrivilegeToken 48 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2fca1fc07cd8574023c45019e2197f71.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2fca1fc07cd8574023c45019e2197f71.exe"
    1⤵
    • Checks computer location settings
    • Accesses Microsoft Outlook accounts
    • Accesses Microsoft Outlook profiles
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • outlook_win_path
    PID:2840
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\abcd.bat" "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2fca1fc07cd8574023c45019e2197f71.exe" "
      2⤵
      • System Location Discovery: System Language Discovery
      PID:820

Network

  • flag-us
    DNS
    8.8.8.8.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    8.8.8.8.in-addr.arpa
    IN PTR
    Response
    8.8.8.8.in-addr.arpa
    IN PTR
    dnsgoogle
  • flag-us
    DNS
    241.150.49.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    241.150.49.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    q.dugongmozambique.com
    JaffaCakes118_2fca1fc07cd8574023c45019e2197f71.exe
    Remote address:
    8.8.8.8:53
    Request
    q.dugongmozambique.com
    IN A
    Response
  • flag-us
    DNS
    182.129.81.91.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    182.129.81.91.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    167.173.78.104.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    167.173.78.104.in-addr.arpa
    IN PTR
    Response
    167.173.78.104.in-addr.arpa
    IN PTR
    a104-78-173-167deploystaticakamaitechnologiescom
  • flag-us
    DNS
    q.dugongmozambique.com
    JaffaCakes118_2fca1fc07cd8574023c45019e2197f71.exe
    Remote address:
    8.8.8.8:53
    Request
    q.dugongmozambique.com
    IN A
    Response
  • flag-us
    DNS
    q.dugongmozambique.com
    JaffaCakes118_2fca1fc07cd8574023c45019e2197f71.exe
    Remote address:
    8.8.8.8:53
    Request
    q.dugongmozambique.com
    IN A
    Response
  • flag-us
    DNS
    104.219.191.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    104.219.191.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    q.dugongmozambique.com
    JaffaCakes118_2fca1fc07cd8574023c45019e2197f71.exe
    Remote address:
    8.8.8.8:53
    Request
    q.dugongmozambique.com
    IN A
    Response
  • flag-us
    DNS
    q.dugongmozambique.com
    JaffaCakes118_2fca1fc07cd8574023c45019e2197f71.exe
    Remote address:
    8.8.8.8:53
    Request
    q.dugongmozambique.com
    IN A
    Response
  • flag-us
    DNS
    228.249.119.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    228.249.119.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    q.dugongmozambique.com
    JaffaCakes118_2fca1fc07cd8574023c45019e2197f71.exe
    Remote address:
    8.8.8.8:53
    Request
    q.dugongmozambique.com
    IN A
    Response
  • flag-us
    DNS
    q.dugongmozambique.com
    JaffaCakes118_2fca1fc07cd8574023c45019e2197f71.exe
    Remote address:
    8.8.8.8:53
    Request
    q.dugongmozambique.com
    IN A
    Response
  • flag-us
    DNS
    53.210.109.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    53.210.109.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    241.42.69.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    241.42.69.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    166.190.18.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    166.190.18.2.in-addr.arpa
    IN PTR
    Response
    166.190.18.2.in-addr.arpa
    IN PTR
    a2-18-190-166deploystaticakamaitechnologiescom
  • flag-us
    DNS
    q.dugongmozambique.com
    JaffaCakes118_2fca1fc07cd8574023c45019e2197f71.exe
    Remote address:
    8.8.8.8:53
    Request
    q.dugongmozambique.com
    IN A
    Response
  • flag-us
    DNS
    q.dugongmozambique.com
    JaffaCakes118_2fca1fc07cd8574023c45019e2197f71.exe
    Remote address:
    8.8.8.8:53
    Request
    q.dugongmozambique.com
    IN A
    Response
  • flag-us
    DNS
    q.dugongmozambique.com
    JaffaCakes118_2fca1fc07cd8574023c45019e2197f71.exe
    Remote address:
    8.8.8.8:53
    Request
    q.dugongmozambique.com
    IN A
    Response
  • flag-us
    DNS
    q.dugongmozambique.com
    JaffaCakes118_2fca1fc07cd8574023c45019e2197f71.exe
    Remote address:
    8.8.8.8:53
    Request
    q.dugongmozambique.com
    IN A
    Response
  • flag-us
    DNS
    q.e-tecinnovation.co.uk
    JaffaCakes118_2fca1fc07cd8574023c45019e2197f71.exe
    Remote address:
    8.8.8.8:53
    Request
    q.e-tecinnovation.co.uk
    IN A
    Response
  • flag-us
    DNS
    q.e-tecinnovation.co.uk
    JaffaCakes118_2fca1fc07cd8574023c45019e2197f71.exe
    Remote address:
    8.8.8.8:53
    Request
    q.e-tecinnovation.co.uk
    IN A
    Response
  • flag-us
    DNS
    q.e-tecinnovation.co.uk
    JaffaCakes118_2fca1fc07cd8574023c45019e2197f71.exe
    Remote address:
    8.8.8.8:53
    Request
    q.e-tecinnovation.co.uk
    IN A
    Response
  • flag-us
    DNS
    81.144.22.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    81.144.22.2.in-addr.arpa
    IN PTR
    Response
    81.144.22.2.in-addr.arpa
    IN PTR
    a2-22-144-81deploystaticakamaitechnologiescom
  • flag-us
    DNS
    q.e-tecinnovation.co.uk
    JaffaCakes118_2fca1fc07cd8574023c45019e2197f71.exe
    Remote address:
    8.8.8.8:53
    Request
    q.e-tecinnovation.co.uk
    IN A
    Response
  • flag-us
    DNS
    q.e-tecinnovation.co.uk
    JaffaCakes118_2fca1fc07cd8574023c45019e2197f71.exe
    Remote address:
    8.8.8.8:53
    Request
    q.e-tecinnovation.co.uk
    IN A
    Response
  • flag-us
    DNS
    q.e-tecinnovation.co.uk
    JaffaCakes118_2fca1fc07cd8574023c45019e2197f71.exe
    Remote address:
    8.8.8.8:53
    Request
    q.e-tecinnovation.co.uk
    IN A
    Response
  • flag-us
    DNS
    q.e-tecinnovation.co.uk
    JaffaCakes118_2fca1fc07cd8574023c45019e2197f71.exe
    Remote address:
    8.8.8.8:53
    Request
    q.e-tecinnovation.co.uk
    IN A
    Response
  • flag-us
    DNS
    q.e-tecinnovation.co.uk
    JaffaCakes118_2fca1fc07cd8574023c45019e2197f71.exe
    Remote address:
    8.8.8.8:53
    Request
    q.e-tecinnovation.co.uk
    IN A
    Response
  • flag-us
    DNS
    q.e-tecinnovation.co.uk
    JaffaCakes118_2fca1fc07cd8574023c45019e2197f71.exe
    Remote address:
    8.8.8.8:53
    Request
    q.e-tecinnovation.co.uk
    IN A
    Response
  • flag-us
    DNS
    172.214.232.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.214.232.199.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    30.243.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    30.243.111.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    q.e-tecinnovation.co.uk
    JaffaCakes118_2fca1fc07cd8574023c45019e2197f71.exe
    Remote address:
    8.8.8.8:53
    Request
    q.e-tecinnovation.co.uk
    IN A
    Response
  • flag-us
    DNS
    q.e-tecinnovation.co.uk
    JaffaCakes118_2fca1fc07cd8574023c45019e2197f71.exe
    Remote address:
    8.8.8.8:53
    Request
    q.e-tecinnovation.co.uk
    IN A
    Response
  • flag-us
    DNS
    mulayimakca.com
    JaffaCakes118_2fca1fc07cd8574023c45019e2197f71.exe
    Remote address:
    8.8.8.8:53
    Request
    mulayimakca.com
    IN A
    Response
  • flag-us
    DNS
    noralimodio.com.ar
    JaffaCakes118_2fca1fc07cd8574023c45019e2197f71.exe
    Remote address:
    8.8.8.8:53
    Request
    noralimodio.com.ar
    IN A
    Response
  • flag-us
    DNS
    noralimodio.com.ar
    JaffaCakes118_2fca1fc07cd8574023c45019e2197f71.exe
    Remote address:
    8.8.8.8:53
    Request
    noralimodio.com.ar
    IN A
    Response
No results found
  • 8.8.8.8:53
    8.8.8.8.in-addr.arpa
    dns
    66 B
     90 B
     1
    1

    DNS Request

    8.8.8.8.in-addr.arpa

  • 8.8.8.8:53
    241.150.49.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    241.150.49.20.in-addr.arpa

  • 8.8.8.8:53
    q.dugongmozambique.com
    dns
    JaffaCakes118_2fca1fc07cd8574023c45019e2197f71.exe
    68 B
     129 B
     1
    1

    DNS Request

    q.dugongmozambique.com

  • 8.8.8.8:53
    182.129.81.91.in-addr.arpa
    dns
    72 B
     147 B
     1
    1

    DNS Request

    182.129.81.91.in-addr.arpa

  • 8.8.8.8:53
    167.173.78.104.in-addr.arpa
    dns
    73 B
     139 B
     1
    1

    DNS Request

    167.173.78.104.in-addr.arpa

  • 8.8.8.8:53
    q.dugongmozambique.com
    dns
    JaffaCakes118_2fca1fc07cd8574023c45019e2197f71.exe
    68 B
     129 B
     1
    1

    DNS Request

    q.dugongmozambique.com

  • 8.8.8.8:53
    q.dugongmozambique.com
    dns
    JaffaCakes118_2fca1fc07cd8574023c45019e2197f71.exe
    68 B
     129 B
     1
    1

    DNS Request

    q.dugongmozambique.com

  • 8.8.8.8:53
    104.219.191.52.in-addr.arpa
    dns
    73 B
     147 B
     1
    1

    DNS Request

    104.219.191.52.in-addr.arpa

  • 8.8.8.8:53
    q.dugongmozambique.com
    dns
    JaffaCakes118_2fca1fc07cd8574023c45019e2197f71.exe
    68 B
     129 B
     1
    1

    DNS Request

    q.dugongmozambique.com

  • 8.8.8.8:53
    q.dugongmozambique.com
    dns
    JaffaCakes118_2fca1fc07cd8574023c45019e2197f71.exe
    68 B
     129 B
     1
    1

    DNS Request

    q.dugongmozambique.com

  • 8.8.8.8:53
    228.249.119.40.in-addr.arpa
    dns
    73 B
     159 B
     1
    1

    DNS Request

    228.249.119.40.in-addr.arpa

  • 8.8.8.8:53
    q.dugongmozambique.com
    dns
    JaffaCakes118_2fca1fc07cd8574023c45019e2197f71.exe
    68 B
     129 B
     1
    1

    DNS Request

    q.dugongmozambique.com

  • 8.8.8.8:53
    q.dugongmozambique.com
    dns
    JaffaCakes118_2fca1fc07cd8574023c45019e2197f71.exe
    68 B
     129 B
     1
    1

    DNS Request

    q.dugongmozambique.com

  • 8.8.8.8:53
    53.210.109.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    53.210.109.20.in-addr.arpa

  • 8.8.8.8:53
    241.42.69.40.in-addr.arpa
    dns
    71 B
     145 B
     1
    1

    DNS Request

    241.42.69.40.in-addr.arpa

  • 8.8.8.8:53
    166.190.18.2.in-addr.arpa
    dns
    71 B
     135 B
     1
    1

    DNS Request

    166.190.18.2.in-addr.arpa

  • 8.8.8.8:53
    q.dugongmozambique.com
    dns
    JaffaCakes118_2fca1fc07cd8574023c45019e2197f71.exe
    68 B
     129 B
     1
    1

    DNS Request

    q.dugongmozambique.com

  • 8.8.8.8:53
    q.dugongmozambique.com
    dns
    JaffaCakes118_2fca1fc07cd8574023c45019e2197f71.exe
    68 B
     129 B
     1
    1

    DNS Request

    q.dugongmozambique.com

  • 8.8.8.8:53
    q.dugongmozambique.com
    dns
    JaffaCakes118_2fca1fc07cd8574023c45019e2197f71.exe
    68 B
     129 B
     1
    1

    DNS Request

    q.dugongmozambique.com

  • 8.8.8.8:53
    q.dugongmozambique.com
    dns
    JaffaCakes118_2fca1fc07cd8574023c45019e2197f71.exe
    68 B
     129 B
     1
    1

    DNS Request

    q.dugongmozambique.com

  • 8.8.8.8:53
    q.e-tecinnovation.co.uk
    dns
    JaffaCakes118_2fca1fc07cd8574023c45019e2197f71.exe
    69 B
     156 B
     1
    1

    DNS Request

    q.e-tecinnovation.co.uk

  • 8.8.8.8:53
    q.e-tecinnovation.co.uk
    dns
    JaffaCakes118_2fca1fc07cd8574023c45019e2197f71.exe
    69 B
     156 B
     1
    1

    DNS Request

    q.e-tecinnovation.co.uk

  • 8.8.8.8:53
    q.e-tecinnovation.co.uk
    dns
    JaffaCakes118_2fca1fc07cd8574023c45019e2197f71.exe
    69 B
     156 B
     1
    1

    DNS Request

    q.e-tecinnovation.co.uk

  • 8.8.8.8:53
    81.144.22.2.in-addr.arpa
    dns
    70 B
     133 B
     1
    1

    DNS Request

    81.144.22.2.in-addr.arpa

  • 8.8.8.8:53
    q.e-tecinnovation.co.uk
    dns
    JaffaCakes118_2fca1fc07cd8574023c45019e2197f71.exe
    69 B
     156 B
     1
    1

    DNS Request

    q.e-tecinnovation.co.uk

  • 8.8.8.8:53
    q.e-tecinnovation.co.uk
    dns
    JaffaCakes118_2fca1fc07cd8574023c45019e2197f71.exe
    69 B
     156 B
     1
    1

    DNS Request

    q.e-tecinnovation.co.uk

  • 8.8.8.8:53
    q.e-tecinnovation.co.uk
    dns
    JaffaCakes118_2fca1fc07cd8574023c45019e2197f71.exe
    69 B
     156 B
     1
    1

    DNS Request

    q.e-tecinnovation.co.uk

  • 8.8.8.8:53
    q.e-tecinnovation.co.uk
    dns
    JaffaCakes118_2fca1fc07cd8574023c45019e2197f71.exe
    69 B
     156 B
     1
    1

    DNS Request

    q.e-tecinnovation.co.uk

  • 8.8.8.8:53
    q.e-tecinnovation.co.uk
    dns
    JaffaCakes118_2fca1fc07cd8574023c45019e2197f71.exe
    69 B
     156 B
     1
    1

    DNS Request

    q.e-tecinnovation.co.uk

  • 8.8.8.8:53
    q.e-tecinnovation.co.uk
    dns
    JaffaCakes118_2fca1fc07cd8574023c45019e2197f71.exe
    69 B
     156 B
     1
    1

    DNS Request

    q.e-tecinnovation.co.uk

  • 8.8.8.8:53
    172.214.232.199.in-addr.arpa
    dns
    74 B
     128 B
     1
    1

    DNS Request

    172.214.232.199.in-addr.arpa

  • 8.8.8.8:53
    30.243.111.52.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    30.243.111.52.in-addr.arpa

  • 8.8.8.8:53
    q.e-tecinnovation.co.uk
    dns
    JaffaCakes118_2fca1fc07cd8574023c45019e2197f71.exe
    69 B
     156 B
     1
    1

    DNS Request

    q.e-tecinnovation.co.uk

  • 8.8.8.8:53
    q.e-tecinnovation.co.uk
    dns
    JaffaCakes118_2fca1fc07cd8574023c45019e2197f71.exe
    69 B
     156 B
     1
    1

    DNS Request

    q.e-tecinnovation.co.uk

  • 8.8.8.8:53
    mulayimakca.com
    dns
    JaffaCakes118_2fca1fc07cd8574023c45019e2197f71.exe
    61 B
     134 B
     1
    1

    DNS Request

    mulayimakca.com

  • 8.8.8.8:53
    noralimodio.com.ar
    dns
    JaffaCakes118_2fca1fc07cd8574023c45019e2197f71.exe
    128 B
     236 B
     2
    2

    DNS Request

    noralimodio.com.ar

    DNS Request

    noralimodio.com.ar

  • 8.8.8.8:53

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\abcd.bat
    Filesize

    75B

    MD5

    0849cfe65b98ba5fcd9a9ec61a671d09

    SHA1

    9d0ccb383c32b1bc07fd9064b9324a18e1276902

    SHA256

    44f6a1e48081deccfb61075e585bcb36c6d8e8feeb6ebae50bab41677822c643

    SHA512

    afdeda8122b4cefcf7549018c40d3142985e88a6d8f13eb58e9a59aa312b73608123de5f9feebc2ce25b6ec215d23c324b9f3a9a0e97041d67d863a25e15e57a

    Download Submit

  • memory/2840-0-0x00000000006C0000-0x00000000006D9000-memory.dmp

    Filesize

    100KB

    Download

  • memory/2840-1-0x0000000000400000-0x0000000000419000-memory.dmp

    Filesize

    100KB

    Download

  • memory/2840-2-0x00000000006C0000-0x00000000006D9000-memory.dmp

    Filesize

    100KB

    Download

  • memory/2840-4-0x0000000000400000-0x0000000000419000-memory.dmp

    Filesize

    100KB

    Download

  • memory/2840-19-0x0000000000400000-0x0000000000419000-memory.dmp

    Filesize

    100KB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.