Analysis
-
max time kernel
81s -
max time network
85s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
29/03/2025, 18:53
General
-
Target
JaffaCakes118_93131ff24484d8d307deef0536a93d0e.exe
-
Size
81KB
-
MD5
93131ff24484d8d307deef0536a93d0e
-
SHA1
3160cd9c452958549303fc1e87f129be237371e7
-
SHA256
4ac35d2952f37ca2efc8f804b12059c4a86b4c64ae364b931d7202ce1f5d6c2b
-
SHA512
94d661d686b719369b5370c8479ab18ecfe1704798c52a1b4d8a347573baf5174160d509e6f30b2fbc136c5fa728252a4ce93047c617c35904c06eabd42de25a
-
SSDEEP
1536:yyYiaMURqLZRBm7NBgzG5MyH9J1NR1Oyzg4mKcKqToBgZo2gIuvT93D+yKZy:naQlq7n0whYcHEvIApuvhyyK
Malware Config
Extracted
pony
http://salips.info:2346/pony/mac.php
http://i5stat.info:2346/pony/mac.php
Signatures
-
Pony family
-
Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious use of AdjustPrivilegeToken 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_93131ff24484d8d307deef0536a93d0e.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_93131ff24484d8d307deef0536a93d0e.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c at 02:54:00 cmd.exe /c copy %TEMP%\259511298FdOh %WINDIR%\system32\drivers\etc\hosts /Y && rename %WINDIR%\system32\drivers\etc\hosts hosts.sys2⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\windows\CurrentVersion\Run /v 259511344 /t REG_SZ /d "cmd.exe /c copy %TEMP%\259511298FdOh %WINDIR%\system32\drivers\etc\hosts /Y && attrib +H %WINDIR%\system32\drivers\etc\hosts /f2⤵
- Hide Artifacts: Hidden Files and Directories
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
20KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
20KB
-
Filesize
176KB