Overview

overview

10

Static

static

1

JaffaCakes...f2.exe

windows7-x64

10

JaffaCakes...f2.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    140s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/01/2025, 15:12 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    JaffaCakes118_36adab1c502a93f9264971034f3f13f2.exe

  • Size

    149KB

  • MD5

    36adab1c502a93f9264971034f3f13f2

  • SHA1

    b5f389ab473a68d28ef5a829a752d9cd45aa187d

  • SHA256

    383807fb6d99118e18c51d9cef3931721f893ff7dd06be5cca284653a46c11af

  • SHA512

    602b99de4cbf5f5b784a3fab1cd082170ceaa2dae6aafef3a611c67fb14919630ecdebb9fb8b601792b59cdd5e5131db4137b1ef2cc39d95da2283bc54a5451d

  • SSDEEP

    3072:tuaYhZgLRxkstm6fE1TuU8A5Y3lO0GRKS:tdYwR2stF8SUY3lrS

Score
10/10
ponycredential_accessdiscoveryratspywarestealer

Malware Config

Extracted

Family

pony

C2

http://panthers-frohnleiten.at:8080/pony/gate.php

http://ks384721.kimsufi.com:81/pony/gate.php
Attributes
  • payload_url

    http://ftp.irpiniaoggi.it/iztD.exe

    http://www.w3haus.com.br/28wio.exe

Signatures

  • Pony family
    pony
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of AdjustPrivilegeToken 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_36adab1c502a93f9264971034f3f13f2.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_36adab1c502a93f9264971034f3f13f2.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    PID:4188

Network

  • flag-us
    DNS
    panthers-frohnleiten.at
    JaffaCakes118_36adab1c502a93f9264971034f3f13f2.exe
    Remote address:
    8.8.8.8:53
    Request
    panthers-frohnleiten.at
    IN A
    Response
    panthers-frohnleiten.at
    IN A
    52.215.95.29
  • flag-us
    DNS
    154.239.44.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    154.239.44.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    172.214.232.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.214.232.199.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    5.114.82.104.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    5.114.82.104.in-addr.arpa
    IN PTR
    Response
    5.114.82.104.in-addr.arpa
    IN PTR
    a104-82-114-5deploystaticakamaitechnologiescom
  • flag-us
    DNS
    133.32.126.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    133.32.126.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    104.219.191.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    104.219.191.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    200.163.202.172.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    200.163.202.172.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    15.164.165.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    15.164.165.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    24.139.73.23.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    24.139.73.23.in-addr.arpa
    IN PTR
    Response
    24.139.73.23.in-addr.arpa
    IN PTR
    a23-73-139-24deploystaticakamaitechnologiescom
  • flag-us
    DNS
    panthers-frohnleiten.at
    JaffaCakes118_36adab1c502a93f9264971034f3f13f2.exe
    Remote address:
    8.8.8.8:53
    Request
    panthers-frohnleiten.at
    IN A
    Response
    panthers-frohnleiten.at
    IN A
    3.255.48.233
  • flag-us
    DNS
    20.49.80.91.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    20.49.80.91.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    panthers-frohnleiten.at
    JaffaCakes118_36adab1c502a93f9264971034f3f13f2.exe
    Remote address:
    8.8.8.8:53
    Request
    panthers-frohnleiten.at
    IN A
    Response
    panthers-frohnleiten.at
    IN A
    3.255.48.233
  • flag-us
    DNS
    19.229.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    19.229.111.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    panthers-frohnleiten.at
    JaffaCakes118_36adab1c502a93f9264971034f3f13f2.exe
    Remote address:
    8.8.8.8:53
    Request
    panthers-frohnleiten.at
    IN A
    Response
    panthers-frohnleiten.at
    IN A
    3.255.48.233
  • flag-us
    DNS
    panthers-frohnleiten.at
    JaffaCakes118_36adab1c502a93f9264971034f3f13f2.exe
    Remote address:
    8.8.8.8:53
    Request
    panthers-frohnleiten.at
    IN A
    Response
    panthers-frohnleiten.at
    IN A
    52.215.95.29
  • 52.215.95.29:8080
    panthers-frohnleiten.at
    JaffaCakes118_36adab1c502a93f9264971034f3f13f2.exe
    260 B
     5
  • 52.215.95.29:8080
    panthers-frohnleiten.at
    JaffaCakes118_36adab1c502a93f9264971034f3f13f2.exe
    260 B
     5
  • 3.255.48.233:8080
    panthers-frohnleiten.at
    JaffaCakes118_36adab1c502a93f9264971034f3f13f2.exe
    260 B
     5
  • 3.255.48.233:8080
    panthers-frohnleiten.at
    JaffaCakes118_36adab1c502a93f9264971034f3f13f2.exe
    260 B
     5
  • 3.255.48.233:8080
    panthers-frohnleiten.at
    JaffaCakes118_36adab1c502a93f9264971034f3f13f2.exe
    260 B
     5
  • 52.215.95.29:8080
    panthers-frohnleiten.at
    JaffaCakes118_36adab1c502a93f9264971034f3f13f2.exe
    260 B
     5
  • 8.8.8.8:53
    panthers-frohnleiten.at
    dns
    JaffaCakes118_36adab1c502a93f9264971034f3f13f2.exe
    69 B
     85 B
     1
    1

    DNS Request

    panthers-frohnleiten.at

    DNS Response

    52.215.95.29

  • 8.8.8.8:53
    154.239.44.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    154.239.44.20.in-addr.arpa

  • 8.8.8.8:53
    172.214.232.199.in-addr.arpa
    dns
    74 B
     128 B
     1
    1

    DNS Request

    172.214.232.199.in-addr.arpa

  • 8.8.8.8:53
    133.32.126.40.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    133.32.126.40.in-addr.arpa

  • 8.8.8.8:53
    5.114.82.104.in-addr.arpa
    dns
    71 B
     135 B
     1
    1

    DNS Request

    5.114.82.104.in-addr.arpa

  • 8.8.8.8:53
    104.219.191.52.in-addr.arpa
    dns
    73 B
     147 B
     1
    1

    DNS Request

    104.219.191.52.in-addr.arpa

  • 8.8.8.8:53
    200.163.202.172.in-addr.arpa
    dns
    74 B
     160 B
     1
    1

    DNS Request

    200.163.202.172.in-addr.arpa

  • 8.8.8.8:53
    15.164.165.52.in-addr.arpa
    dns
    72 B
     146 B
     1
    1

    DNS Request

    15.164.165.52.in-addr.arpa

  • 8.8.8.8:53
    24.139.73.23.in-addr.arpa
    dns
    71 B
     135 B
     1
    1

    DNS Request

    24.139.73.23.in-addr.arpa

  • 8.8.8.8:53
    panthers-frohnleiten.at
    dns
    JaffaCakes118_36adab1c502a93f9264971034f3f13f2.exe
    69 B
     85 B
     1
    1

    DNS Request

    panthers-frohnleiten.at

    DNS Response

    3.255.48.233

  • 8.8.8.8:53
    20.49.80.91.in-addr.arpa
    dns
    70 B
     145 B
     1
    1

    DNS Request

    20.49.80.91.in-addr.arpa

  • 8.8.8.8:53
    panthers-frohnleiten.at
    dns
    JaffaCakes118_36adab1c502a93f9264971034f3f13f2.exe
    69 B
     85 B
     1
    1

    DNS Request

    panthers-frohnleiten.at

    DNS Response

    3.255.48.233

  • 8.8.8.8:53
    19.229.111.52.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    19.229.111.52.in-addr.arpa

  • 8.8.8.8:53
    panthers-frohnleiten.at
    dns
    JaffaCakes118_36adab1c502a93f9264971034f3f13f2.exe
    69 B
     85 B
     1
    1

    DNS Request

    panthers-frohnleiten.at

    DNS Response

    3.255.48.233

  • 8.8.8.8:53
    panthers-frohnleiten.at
    dns
    JaffaCakes118_36adab1c502a93f9264971034f3f13f2.exe
    69 B
     85 B
     1
    1

    DNS Request

    panthers-frohnleiten.at

    DNS Response

    52.215.95.29

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4188-1-0x00000000004E0000-0x000000000050D000-memory.dmp

    Filesize

    180KB

    Download

  • memory/4188-0-0x00000000004C0000-0x00000000004D7000-memory.dmp

    Filesize

    92KB

    Download

  • memory/4188-2-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

    Download

  • memory/4188-3-0x00000000004E0000-0x000000000050D000-memory.dmp

    Filesize

    180KB

    Download

  • memory/4188-5-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.