| File name: | Ves' paket 07.07.7z |
| Full analysis: | https://app.any.run/tasks/6ab5d4b9-1279-404f-a4a8-a2fb846c4e27 |
| Verdict: | Malicious activity |
| Threats: | Pony is a malware with two main functions — stealing information and dropping other viruses with different tasks on infected machines. It has been around since 2011, and it still actively attacks users in Europe and America. |
| Analysis date: | July 13, 2020, 06:07:20 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-7z-compressed |
| File info: | 7-zip archive data, version 0.4 |
| MD5: | E8726799FA3BFE8439AD4DB78B169AF3 |
| SHA1: | 296909F848E375EE3EDD599679CB3EF178332472 |
| SHA256: | F0B1A0B68D7C20D524FB19A433EC5484D0A7F9402A497368D52D64B917F781D8 |
| SSDEEP: | 3072:DPEg4flwdoNLHeldMpcCXIxVzkTOkt4qamIj5K3Ot4hX:roWdoZHEWWqaMOE |
| .7z | | | 7-Zip compressed archive (v0.4) (57.1) |
|---|---|---|
| .7z | | | 7-Zip compressed archive (gen) (42.8) |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 128 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Ves' paket 07.07.7z" | C:\Program Files\WinRAR\WinRAR.exe | — | explorer.exe | |||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.60.0 Modules
| |||||||||||||||
| 1008 | cmd.exe /c ping 127.0.0.1 & del /F /Q "C:\Users\admin\Desktop\Ves' paket 07.07.exe" | C:\Windows\system32\cmd.exe | — | Ves' paket 07.07.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 2100 | "C:\Users\admin\Desktop\Ves' paket 07.07.exe" | C:\Users\admin\Desktop\Ves' paket 07.07.exe | explorer.exe | ||||||||||||
User: admin Company: StationPlaylist.com Integrity Level: MEDIUM Description: Track Tool Exit code: 3221225477 Version: 5.2.0.11 Modules
| |||||||||||||||
| 2800 | "C:\Users\admin\Desktop\Ves' paket 07.07.exe" dfsr | C:\Users\admin\Desktop\Ves' paket 07.07.exe | Ves' paket 07.07.exe | ||||||||||||
User: admin Company: StationPlaylist.com Integrity Level: MEDIUM Description: Track Tool Exit code: 0 Version: 5.2.0.11 Modules
| |||||||||||||||
| 2900 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Rar$DIb128.30770\Ves' paket 07.07.hhgge" | C:\Program Files\WinRAR\WinRAR.exe | — | WinRAR.exe | |||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.60.0 Modules
| |||||||||||||||
| 2964 | ping 127.0.0.1 | C:\Windows\system32\PING.EXE | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: TCP/IP Ping Command Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| (PID) Process: | (128) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtBMP |
Value: | |||
| (PID) Process: | (128) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtIcon |
Value: | |||
| (PID) Process: | (128) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\12F\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (128) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\12F\52C64B7E |
| Operation: | write | Name: | @C:\Windows\system32\NetworkExplorer.dll,-1 |
Value: Network | |||
| (PID) Process: | (128) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface |
| Operation: | write | Name: | ShowPassword |
Value: 0 | |||
| (PID) Process: | (128) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\AppData\Local\Temp\Ves' paket 07.07.7z | |||
| (PID) Process: | (128) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | name |
Value: 120 | |||
| (PID) Process: | (128) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
| (PID) Process: | (128) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | type |
Value: 120 | |||
| (PID) Process: | (128) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | mtime |
Value: 100 | |||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2900 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa2900.31881\Ves' paket 07.07.exe | — | |
MD5:— | SHA256:— | |||
| 2800 | Ves' paket 07.07.exe | C:\Users\admin\AppData\Local\Temp\A76B.tmp | — | |
MD5:— | SHA256:— | |||
| 2800 | Ves' paket 07.07.exe | C:\Users\admin\AppData\Local\Temp\A76C.tmp | — | |
MD5:— | SHA256:— | |||
| 128 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DIb128.30770\Ves' paket 07.07.hhgge | compressed | |
MD5:— | SHA256:— | |||
| 2800 | Ves' paket 07.07.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Z5VDHYNA.txt | text | |
MD5:— | SHA256:— | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
2800 | Ves' paket 07.07.exe | POST | — | 91.200.102.242:80 | http://91.200.102.242/p/z05857687.php | unknown | — | — | malicious |
2800 | Ves' paket 07.07.exe | GET | 200 | 140.82.0.67:80 | http://140.82.0.67/viewtopic.php?c790=0&a570=61646d696e&b550555345522d5043 | US | binary | 96.0 Kb | malicious |
2800 | Ves' paket 07.07.exe | POST | — | 91.200.102.242:80 | http://91.200.102.242/p/z05857687.php | unknown | — | — | malicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
2800 | Ves' paket 07.07.exe | 104.16.55.3:443 | blockchain.info | Cloudflare Inc | US | shared |
2800 | Ves' paket 07.07.exe | 91.200.102.242:80 | — | — | — | malicious |
2800 | Ves' paket 07.07.exe | 140.82.0.67:80 | — | — | US | malicious |
Domain | IP | Reputation |
|---|---|---|
blockchain.info |
| shared |
PID | Process | Class | Message |
|---|---|---|---|
2800 | Ves' paket 07.07.exe | A Network Trojan was detected | MALWARE [PTsecurity] RTM.Payload.xor |
2800 | Ves' paket 07.07.exe | A Network Trojan was detected | ET TROJAN Fareit/Pony Downloader Checkin 2 |
2800 | Ves' paket 07.07.exe | A Network Trojan was detected | ET TROJAN Fareit/Pony Downloader Checkin 2 |