File name:

Ves' paket 07.07.7z

Full analysis: https://app.any.run/tasks/6ab5d4b9-1279-404f-a4a8-a2fb846c4e27
Verdict: Malicious activity
Threats:

Pony is a malware with two main functions — stealing information and dropping other viruses with different tasks on infected machines. It has been around since 2011, and it still actively attacks users in Europe and America.

Analysis date: July 13, 2020, 06:07:20
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
pony
fareit
stealer
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.4
MD5:

E8726799FA3BFE8439AD4DB78B169AF3

SHA1:

296909F848E375EE3EDD599679CB3EF178332472

SHA256:

F0B1A0B68D7C20D524FB19A433EC5484D0A7F9402A497368D52D64B917F781D8

SSDEEP:

3072:DPEg4flwdoNLHeldMpcCXIxVzkTOkt4qamIj5K3Ot4hX:roWdoZHEWWqaMOE

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Detected Pony/Fareit Trojan

      • Ves' paket 07.07.exe (PID: 2800)
    • Application was dropped or rewritten from another process

      • Ves' paket 07.07.exe (PID: 2800)
      • Ves' paket 07.07.exe (PID: 2100)
    • Actions looks like stealing of personal data

      • Ves' paket 07.07.exe (PID: 2800)
    • Connects to CnC server

      • Ves' paket 07.07.exe (PID: 2800)
    • PONY was detected

      • Ves' paket 07.07.exe (PID: 2800)
    • Changes settings of System certificates

      • Ves' paket 07.07.exe (PID: 2800)
  • SUSPICIOUS

    • Application launched itself

      • WinRAR.exe (PID: 128)
      • Ves' paket 07.07.exe (PID: 2100)
    • Creates files in the user directory

      • Ves' paket 07.07.exe (PID: 2800)
    • Searches for installed software

      • Ves' paket 07.07.exe (PID: 2800)
    • Connects to server without host name

      • Ves' paket 07.07.exe (PID: 2800)
    • Starts CMD.EXE for self-deleting

      • Ves' paket 07.07.exe (PID: 2800)
    • Reads Internet Cache Settings

      • Ves' paket 07.07.exe (PID: 2800)
    • Starts CMD.EXE for commands execution

      • Ves' paket 07.07.exe (PID: 2800)
    • Adds / modifies Windows certificates

      • Ves' paket 07.07.exe (PID: 2800)
  • INFO

    • Manual execution by user

      • Ves' paket 07.07.exe (PID: 2100)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (v0.4) (57.1)
.7z | 7-Zip compressed archive (gen) (42.8)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
44
Monitored processes
6
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs winrar.exe no specs ves' paket 07.07.exe #PONY ves' paket 07.07.exe cmd.exe no specs ping.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
128"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Ves' paket 07.07.7z"C:\Program Files\WinRAR\WinRAR.exeexplorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
1008cmd.exe /c ping 127.0.0.1 & del /F /Q "C:\Users\admin\Desktop\Ves' paket 07.07.exe"C:\Windows\system32\cmd.exeVes' paket 07.07.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2100"C:\Users\admin\Desktop\Ves' paket 07.07.exe" C:\Users\admin\Desktop\Ves' paket 07.07.exe
explorer.exe
User:
admin
Company:
StationPlaylist.com
Integrity Level:
MEDIUM
Description:
Track Tool
Exit code:
3221225477
Version:
5.2.0.11
Modules
Images
c:\users\admin\desktop\ves' paket 07.07.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2800"C:\Users\admin\Desktop\Ves' paket 07.07.exe" dfsrC:\Users\admin\Desktop\Ves' paket 07.07.exe
Ves' paket 07.07.exe
User:
admin
Company:
StationPlaylist.com
Integrity Level:
MEDIUM
Description:
Track Tool
Exit code:
0
Version:
5.2.0.11
Modules
Images
c:\users\admin\desktop\ves' paket 07.07.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2900"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Rar$DIb128.30770\Ves' paket 07.07.hhgge"C:\Program Files\WinRAR\WinRAR.exeWinRAR.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2964ping 127.0.0.1 C:\Windows\system32\PING.EXEcmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Ping Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ping.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\nsi.dll
Total events
4 506
Read events
915
Write events
2 406
Delete events
1 185

Modification events

(PID) Process:(128) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(128) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(128) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12F\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(128) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12F\52C64B7E
Operation:writeName:@C:\Windows\system32\NetworkExplorer.dll,-1
Value:
Network
(PID) Process:(128) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
(PID) Process:(128) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Ves' paket 07.07.7z
(PID) Process:(128) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(128) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(128) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(128) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
Executable files
0
Suspicious files
1
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
2900WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2900.31881\Ves' paket 07.07.exe
MD5:
SHA256:
2800Ves' paket 07.07.exeC:\Users\admin\AppData\Local\Temp\A76B.tmp
MD5:
SHA256:
2800Ves' paket 07.07.exeC:\Users\admin\AppData\Local\Temp\A76C.tmp
MD5:
SHA256:
128WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIb128.30770\Ves' paket 07.07.hhggecompressed
MD5:
SHA256:
2800Ves' paket 07.07.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Z5VDHYNA.txttext
MD5:
SHA256:
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
4
DNS requests
1
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2800
Ves' paket 07.07.exe
POST
91.200.102.242:80
http://91.200.102.242/p/z05857687.php
unknown
malicious
2800
Ves' paket 07.07.exe
GET
200
140.82.0.67:80
http://140.82.0.67/viewtopic.php?c790=0&a570=61646d696e&b550555345522d5043
US
binary
96.0 Kb
malicious
2800
Ves' paket 07.07.exe
POST
91.200.102.242:80
http://91.200.102.242/p/z05857687.php
unknown
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2800
Ves' paket 07.07.exe
104.16.55.3:443
blockchain.info
Cloudflare Inc
US
shared
2800
Ves' paket 07.07.exe
91.200.102.242:80
malicious
2800
Ves' paket 07.07.exe
140.82.0.67:80
US
malicious

DNS requests

Domain
IP
Reputation
blockchain.info
  • 104.16.55.3
  • 104.16.54.3
shared

Threats

PID
Process
Class
Message
2800
Ves' paket 07.07.exe
A Network Trojan was detected
MALWARE [PTsecurity] RTM.Payload.xor
2800
Ves' paket 07.07.exe
A Network Trojan was detected
ET TROJAN Fareit/Pony Downloader Checkin 2
2800
Ves' paket 07.07.exe
A Network Trojan was detected
ET TROJAN Fareit/Pony Downloader Checkin 2
No debug info