File name: | PO NO 7328642.ace |
Full analysis: | https://app.any.run/tasks/0ed6b56e-c903-4a81-b3cc-c6f7672de1b9 |
Verdict: | Malicious activity |
Threats: | Pony is a malware with two main functions — stealing information and dropping other viruses with different tasks on infected machines. It has been around since 2011, and it still actively attacks users in Europe and America. |
Analysis date: | March 21, 2019, 12:15:19 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/octet-stream |
File info: | ACE archive data version 20, from Win/32, version 20 to extract, contains AV-String (unregistered), solid |
MD5: | 7EA3EDD14A8CF51E073BAA30A8777F6C |
SHA1: | C150B9522DAAFE15582AE1A51FCCD8427E36D9A5 |
SHA256: | 285BAAB1B57955FDB91DE69A6B43FEFFEBBC2D1875233DB73DE4CF75D36B8FDF |
SSDEEP: | 3072:Za8iyy4GRavgcY/nva47AIu0z4pOXHkhNG79XSSu1EqFvgwSIaFO5iCwJqTSKd6k:Za8iHSgdvvaUAiz4pOam9XbCNgw7aFmN |
.ace | | | ACE compressed archive (100) |
---|
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2380 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\PO NO 7328642.ace" | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.60.0 | ||||
916 | "C:\Users\admin\AppData\Local\Temp\Rar$DIa2380.4385\PO NO 7328642.scr" /S | C:\Users\admin\AppData\Local\Temp\Rar$DIa2380.4385\PO NO 7328642.scr | WinRAR.exe | |
User: admin Company: lowmasted4 Integrity Level: MEDIUM Exit code: 0 Version: 1.06.0006 | ||||
2704 | "C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\subfolder\filename.vbs" | C:\Windows\System32\WScript.exe | PO NO 7328642.scr | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft ® Windows Based Script Host Exit code: 0 Version: 5.8.7600.16385 | ||||
2748 | "C:\Users\admin\AppData\Local\Temp\subfolder\filename.scr" /S | C:\Users\admin\AppData\Local\Temp\subfolder\filename.scr | — | PO NO 7328642.scr |
User: admin Company: lowmasted4 Integrity Level: MEDIUM Exit code: 0 Version: 1.06.0006 | ||||
3616 | C:\Users\admin\AppData\Local\Temp\subfolder\filename.scr" /S | C:\Users\admin\AppData\Local\Temp\subfolder\filename.scr | filename.scr | |
User: admin Company: lowmasted4 Integrity Level: MEDIUM Exit code: 0 Version: 1.06.0006 | ||||
1428 | cmd /c ""C:\Users\admin\AppData\Local\Temp\1255687.bat" "C:\Users\admin\AppData\Local\Temp\subfolder\filename.scr" " | C:\Windows\system32\cmd.exe | — | filename.scr |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 1 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) |
(PID) Process: | (2380) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
Operation: | write | Name: | ShellExtBMP |
Value: | |||
(PID) Process: | (2380) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
Operation: | write | Name: | ShellExtIcon |
Value: | |||
(PID) Process: | (2380) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\62\52C64B7E |
Operation: | write | Name: | LanguageList |
Value: en-US | |||
(PID) Process: | (2380) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
Operation: | write | Name: | 0 |
Value: C:\Users\admin\AppData\Local\Temp\PO NO 7328642.ace | |||
(PID) Process: | (2380) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | name |
Value: 120 | |||
(PID) Process: | (2380) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | size |
Value: 80 | |||
(PID) Process: | (2380) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | type |
Value: 120 | |||
(PID) Process: | (2380) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | mtime |
Value: 100 | |||
(PID) Process: | (2380) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\ACE Compression Software\ActiveAce\2.0 |
Operation: | write | Name: | Count |
Value: 0 | |||
(PID) Process: | (2380) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\ACE Compression Software\ActiveAce\2.0 |
Operation: | write | Name: | Name |
Value: 542D4B42647265644B76737A7E794B566767537663764B5B7874767B4B43727A674B4758375958372024252F21232539767472171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171717171700 |
PID | Process | Filename | Type | |
---|---|---|---|---|
916 | PO NO 7328642.scr | C:\Users\admin\AppData\Local\Temp\subfolder\filename.vbs | text | |
MD5:2D1AC61553299818EF0BC34B3C8E0F33 | SHA256:8D17CA415490AE95CD3472B4FCF221967F432EAED8B391473441A442A5286453 | |||
2380 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DIa2380.4385\PO NO 7328642.scr | executable | |
MD5:2D55649D67D45A8490BD3AA6D4256BC6 | SHA256:0130D134ED8EA5E5C1D2879FFA05D4D1BA5A30619AC9A26BD58276213A33EA96 | |||
916 | PO NO 7328642.scr | C:\Users\admin\AppData\Local\Temp\subfolder\filename.scr | executable | |
MD5:2D55649D67D45A8490BD3AA6D4256BC6 | SHA256:0130D134ED8EA5E5C1D2879FFA05D4D1BA5A30619AC9A26BD58276213A33EA96 | |||
3616 | filename.scr | C:\Users\admin\AppData\Local\Temp\1255687.bat | text | |
MD5:3880EEB1C736D853EB13B44898B718AB | SHA256:936D9411D5226B7C5A150ECAF422987590A8870C8E095E1CAA072273041A86E7 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
3616 | filename.scr | GET | 404 | 89.41.173.149:80 | http://king-businesssell.top/house/pony/shit.exe | RO | html | 336 b | malicious |
3616 | filename.scr | POST | — | 89.41.173.149:80 | http://king-businesssell.top/house/pony/gate.php | RO | — | — | malicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3616 | filename.scr | 89.41.173.149:80 | king-businesssell.top | Ch-net S.r.l. | RO | malicious |
Domain | IP | Reputation |
---|---|---|
king-businesssell.top |
| malicious |
PID | Process | Class | Message |
---|---|---|---|
— | — | Potentially Bad Traffic | ET DNS Query to a *.top domain - Likely Hostile |
3616 | filename.scr | A Network Trojan was detected | ET TROJAN Fareit/Pony Downloader Checkin 2 |
3616 | filename.scr | Potential Corporate Privacy Violation | ET POLICY Windows 98 User-Agent Detected - Possible Malware or Non-Updated System |
3616 | filename.scr | Potential Corporate Privacy Violation | ET POLICY Unsupported/Fake Internet Explorer Version MSIE 5. |
3616 | filename.scr | A Network Trojan was detected | ET TROJAN Trojan Generic - POST To gate.php with no referer |
3616 | filename.scr | Potentially Bad Traffic | ET INFO HTTP Request to a *.top domain |
3616 | filename.scr | A Network Trojan was detected | ET TROJAN Pony Downloader HTTP Library MSIE 5 Win98 |
3616 | filename.scr | A Network Trojan was detected | MALWARE [PTsecurity] Fareit/Pony Downloader Checkin |
3616 | filename.scr | A Network Trojan was detected | ET TROJAN Fareit/Pony Downloader Checkin 3 |
3616 | filename.scr | Potential Corporate Privacy Violation | ET POLICY Windows 98 User-Agent Detected - Possible Malware or Non-Updated System |