Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

4388df2fc2...18.exe

windows7-x64

10

4388df2fc2...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4388df2fc2175b61291872d250636c7d_JaffaCakes118

  • Size

    1.7MB

  • Sample

    240713-13q2ls1gla

  • MD5

    4388df2fc2175b61291872d250636c7d

  • SHA1

    2785816a119b8e7ac72ecd9b07ba1ac50729c140

  • SHA256

    e89bf48b850461d265b7334a711e40bffd3cf4e03fa6a077bdd4cb3317c40e82

  • SHA512

    98c68643c408bc2910fbfefaee697278d8b67db8c0f5a10873143cc6535ce02b05b2a298e5a77fc6a228e7945ca5a1d9e23d9aa1a68e2b87b7076228520475ed

  • SSDEEP

    49152:DOw0Q7JUd4vKVmENPNlgz/YQKB+wMt+SOl3qcYllMBhlHz2rE0cOZ44KjQiejD6/:DOw0Q7JMQKVphNlg0QKct+SOl6cYvMzl

Score
10/10
ardamaxdiscoveryevasionkeyloggerpersistencestealer

Malware Config

Targets

    • Target

      4388df2fc2175b61291872d250636c7d_JaffaCakes118

    • Size

      1.7MB

    • MD5

      4388df2fc2175b61291872d250636c7d

    • SHA1

      2785816a119b8e7ac72ecd9b07ba1ac50729c140

    • SHA256

      e89bf48b850461d265b7334a711e40bffd3cf4e03fa6a077bdd4cb3317c40e82

    • SHA512

      98c68643c408bc2910fbfefaee697278d8b67db8c0f5a10873143cc6535ce02b05b2a298e5a77fc6a228e7945ca5a1d9e23d9aa1a68e2b87b7076228520475ed

    • SSDEEP

      49152:DOw0Q7JUd4vKVmENPNlgz/YQKB+wMt+SOl3qcYllMBhlHz2rE0cOZ44KjQiejD6/:DOw0Q7JMQKVphNlg0QKct+SOl6cYvMzl

    Score
    10/10
    ardamaxdiscoveryevasionkeyloggerpersistencestealer

    • Ardamax

      A keylogger first seen in 2013.

      keyloggerstealerardamax

    • Ardamax main executable

    • Disables RegEdit via registry modification

      evasion

    • Disables Task Manager via registry modification

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks