Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    136s
  • max time network
    145s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    27/01/2025, 02:07 UTC

General

  • Target

    JaffaCakes118_3b121006c4bd66f60be942a67ca9ff34.exe

  • Size

    127KB

  • MD5

    3b121006c4bd66f60be942a67ca9ff34

  • SHA1

    fbe222631ac74a44e6e326005a100c0044cba56f

  • SHA256

    a4ec799189dfd7b564a2b6e03913e0c3ead687e2483a9a1f15baa25d58a05fe2

  • SHA512

    1f72be7ccb39c1f63149ede8270a6097ad313b7e0f0d3eab2fe87e15427176502de9310e993ffe0e379b31b1ed8721a7cc8f19558eafacf5ed7a2942a8f83ee1

  • SSDEEP

    1536:k+7KbB8+7qwtkO9X7vArcmqHViVpG7kyRe3tSIllysxPg6fCKUA3k6oWv3kpN0kT:OB8+g8X7vedG7Ne3vP/oWk6ok3kpN0kT

Malware Config

Extracted

Family

pony

C2

http://108.166.65.182:8080/pony/gate.php

http://aloucakbileti.com:8080/pony/gate.php

Attributes
  • payload_url

    http://hidollar.com.au/miDXkQ.exe

    http://198.106.93.136/qpLKMqs.exe

Signatures

  • Pony family
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3b121006c4bd66f60be942a67ca9ff34.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3b121006c4bd66f60be942a67ca9ff34.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of UnmapMainImage
    PID:2716

Network

    No results found
  • 108.166.65.182:8080
    JaffaCakes118_3b121006c4bd66f60be942a67ca9ff34.exe
    152 B
    3
  • 108.166.65.182:8080
    JaffaCakes118_3b121006c4bd66f60be942a67ca9ff34.exe
    152 B
    3
  • 108.166.65.182:8080
    JaffaCakes118_3b121006c4bd66f60be942a67ca9ff34.exe
    152 B
    3
  • 108.166.65.182:8080
    JaffaCakes118_3b121006c4bd66f60be942a67ca9ff34.exe
    152 B
    3
  • 108.166.65.182:8080
    JaffaCakes118_3b121006c4bd66f60be942a67ca9ff34.exe
    152 B
    3
  • 108.166.65.182:8080
    JaffaCakes118_3b121006c4bd66f60be942a67ca9ff34.exe
    152 B
    3
No results found

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2716-2-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

  • memory/2716-1-0x00000000002A0000-0x00000000002C5000-memory.dmp

    Filesize

    148KB

  • memory/2716-0-0x0000000000250000-0x0000000000267000-memory.dmp

    Filesize

    92KB

  • memory/2716-3-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.