Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    137s
  • max time network
    140s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    26/01/2025, 05:38 UTC

General

  • Target

    JaffaCakes118_32eff8081f3f30a27f40a95b11292023.exe

  • Size

    113KB

  • MD5

    32eff8081f3f30a27f40a95b11292023

  • SHA1

    ac2b1009f74d30e45b3ea92c9a4095ccf48a8fc0

  • SHA256

    35b070831664d6cf087ebaafbcc5e39189ddcac871da55db612a91859336da71

  • SHA512

    89b8b07144e2920db044b253fb1762d659395c0ae1dd5264c239a7d999c20cdf91f568666fac282aaf117cf3c8fd844075a80d35678c19078018978c8bba6af7

  • SSDEEP

    3072:kTY7VKneOqGMCi+mm1O4AtWVE6moAiQzFO7Ur:sgVHOaL+mm1O+SFzFJ

Malware Config

Extracted

Family

pony

C2

http://sam-latrilogie.com:8080/pony/gate.php

http://loceanic.fr:8080/pony/gate.php

Attributes
  • payload_url

    http://www.faraak.sk/Q6Ahxg.exe

    http://lagarenne.ke0.eu/xAoU.exe

    http://procurement.citarum.org/yqWP.exe

Signatures

  • Pony family
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

  • Deletes itself 1 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
  • Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 32 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_32eff8081f3f30a27f40a95b11292023.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_32eff8081f3f30a27f40a95b11292023.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1272
    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_32eff8081f3f30a27f40a95b11292023.exe
      "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_32eff8081f3f30a27f40a95b11292023.exe"
      2⤵
      • Accesses Microsoft Outlook accounts
      • Accesses Microsoft Outlook profiles
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      • outlook_win_path
      PID:2360
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\abcd.bat" "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_32eff8081f3f30a27f40a95b11292023.exe" "
        3⤵
        • Deletes itself
        • System Location Discovery: System Language Discovery
        PID:2032

Network

  • flag-us
    DNS
    sam-latrilogie.com
    JaffaCakes118_32eff8081f3f30a27f40a95b11292023.exe
    Remote address:
    8.8.8.8:53
    Request
    sam-latrilogie.com
    IN A
    Response
  • flag-us
    DNS
    loceanic.fr
    JaffaCakes118_32eff8081f3f30a27f40a95b11292023.exe
    Remote address:
    8.8.8.8:53
    Request
    loceanic.fr
    IN A
    Response
  • flag-us
    DNS
    www.faraak.sk
    JaffaCakes118_32eff8081f3f30a27f40a95b11292023.exe
    Remote address:
    8.8.8.8:53
    Request
    www.faraak.sk
    IN A
    Response
    www.faraak.sk
    IN A
    82.119.96.182
  • flag-sk
    GET
    http://www.faraak.sk/Q6Ahxg.exe
    JaffaCakes118_32eff8081f3f30a27f40a95b11292023.exe
    Remote address:
    82.119.96.182:80
    Request
    GET /Q6Ahxg.exe HTTP/1.0
    Host: www.faraak.sk
    Accept: */*
    Accept-Encoding: identity, *;q=0
    Connection: close
    User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows 98)
    Response
    HTTP/1.1 301 Moved Permanently
    Date: Sun, 26 Jan 2025 05:41:07 GMT
    Server: Apache
    Location: https://www.faraak.sk/Q6Ahxg.exe
    Content-Length: 240
    Connection: close
    Content-Type: text/html; charset=iso-8859-1
  • flag-sk
    GET
    http://www.faraak.sk/Q6Ahxg.exe
    JaffaCakes118_32eff8081f3f30a27f40a95b11292023.exe
    Remote address:
    82.119.96.182:443
    Request
    GET /Q6Ahxg.exe HTTP/1.0
    Host: www.faraak.sk
    Accept: */*
    Accept-Encoding: identity, *;q=0
    Connection: close
    User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows 98)
    Response
    HTTP/1.1 400 Bad Request
    Date: Sun, 26 Jan 2025 05:41:07 GMT
    Server: Apache
    Last-Modified: Sat, 07 Sep 2024 09:03:02 GMT
    ETag: "701-62183ca8ced18"
    Accept-Ranges: bytes
    Content-Length: 1793
    Connection: close
    Content-Type: text/html
  • flag-us
    DNS
    lagarenne.ke0.eu
    JaffaCakes118_32eff8081f3f30a27f40a95b11292023.exe
    Remote address:
    8.8.8.8:53
    Request
    lagarenne.ke0.eu
    IN A
    Response
  • flag-us
    DNS
    procurement.citarum.org
    JaffaCakes118_32eff8081f3f30a27f40a95b11292023.exe
    Remote address:
    8.8.8.8:53
    Request
    procurement.citarum.org
    IN A
    Response
  • flag-us
    DNS
    procurement.citarum.org
    JaffaCakes118_32eff8081f3f30a27f40a95b11292023.exe
    Remote address:
    8.8.8.8:53
    Request
    procurement.citarum.org
    IN A
    Response
  • flag-us
    DNS
    procurement.citarum.org
    JaffaCakes118_32eff8081f3f30a27f40a95b11292023.exe
    Remote address:
    8.8.8.8:53
    Request
    procurement.citarum.org
    IN A
    Response
  • 82.119.96.182:80
    http://www.faraak.sk/Q6Ahxg.exe
    http
    JaffaCakes118_32eff8081f3f30a27f40a95b11292023.exe
    405 B
    668 B
    5
    5

    HTTP Request

    GET http://www.faraak.sk/Q6Ahxg.exe

    HTTP Response

    301
  • 82.119.96.182:443
    http://www.faraak.sk/Q6Ahxg.exe
    http
    JaffaCakes118_32eff8081f3f30a27f40a95b11292023.exe
    451 B
    2.3kB
    6
    6

    HTTP Request

    GET http://www.faraak.sk/Q6Ahxg.exe

    HTTP Response

    400
  • 8.8.8.8:53
    sam-latrilogie.com
    dns
    JaffaCakes118_32eff8081f3f30a27f40a95b11292023.exe
    64 B
    137 B
    1
    1

    DNS Request

    sam-latrilogie.com

  • 8.8.8.8:53
    loceanic.fr
    dns
    JaffaCakes118_32eff8081f3f30a27f40a95b11292023.exe
    57 B
    115 B
    1
    1

    DNS Request

    loceanic.fr

  • 8.8.8.8:53
    www.faraak.sk
    dns
    JaffaCakes118_32eff8081f3f30a27f40a95b11292023.exe
    59 B
    75 B
    1
    1

    DNS Request

    www.faraak.sk

    DNS Response

    82.119.96.182

  • 8.8.8.8:53
    lagarenne.ke0.eu
    dns
    JaffaCakes118_32eff8081f3f30a27f40a95b11292023.exe
    62 B
    129 B
    1
    1

    DNS Request

    lagarenne.ke0.eu

  • 8.8.8.8:53
    procurement.citarum.org
    dns
    JaffaCakes118_32eff8081f3f30a27f40a95b11292023.exe
    207 B
    207 B
    3
    3

    DNS Request

    procurement.citarum.org

    DNS Request

    procurement.citarum.org

    DNS Request

    procurement.citarum.org

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\abcd.bat

    Filesize

    75B

    MD5

    0849cfe65b98ba5fcd9a9ec61a671d09

    SHA1

    9d0ccb383c32b1bc07fd9064b9324a18e1276902

    SHA256

    44f6a1e48081deccfb61075e585bcb36c6d8e8feeb6ebae50bab41677822c643

    SHA512

    afdeda8122b4cefcf7549018c40d3142985e88a6d8f13eb58e9a59aa312b73608123de5f9feebc2ce25b6ec215d23c324b9f3a9a0e97041d67d863a25e15e57a

  • memory/1272-0-0x0000000000DD0000-0x0000000000DEF000-memory.dmp

    Filesize

    124KB

  • memory/1272-1-0x00000000000D0000-0x00000000000EF000-memory.dmp

    Filesize

    124KB

  • memory/1272-13-0x0000000000DD0000-0x0000000000DEF000-memory.dmp

    Filesize

    124KB

  • memory/2360-4-0x0000000000400000-0x0000000000419000-memory.dmp

    Filesize

    100KB

  • memory/2360-14-0x0000000000400000-0x0000000000419000-memory.dmp

    Filesize

    100KB

  • memory/2360-10-0x0000000000400000-0x0000000000419000-memory.dmp

    Filesize

    100KB

  • memory/2360-8-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2360-6-0x0000000000400000-0x0000000000419000-memory.dmp

    Filesize

    100KB

  • memory/2360-3-0x0000000000400000-0x0000000000419000-memory.dmp

    Filesize

    100KB

  • memory/2360-2-0x0000000000400000-0x0000000000419000-memory.dmp

    Filesize

    100KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.