Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

621540fe24...18.exe

windows7-x64

10

621540fe24...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    621540fe24ded979a6965228f0d3ab31_JaffaCakes118

  • Size

    1.1MB

  • Sample

    240722-azz71avhkn

  • MD5

    621540fe24ded979a6965228f0d3ab31

  • SHA1

    0ce5a910645b642f9c35d3ffb8c66622fd4bbf75

  • SHA256

    ff8019442e59313da64f044f6a66b852251ce25767f50f1b7a380defc6315eb5

  • SHA512

    a55fd6d9821ed8615fadf593b857e1e6ff92c643dcbe1be7ca2c9de918f40256f1293c9f9170d12ad443ee779e3989162d920101c9f0ea9f08331f7fdf9f51ca

  • SSDEEP

    24576:DrSRbZYP8nKuzFv2dUrRKV2Df/sT4adX39O7f:DrebZO8n1FAUDnsTRtOz

Score
10/10
ardamaxaspackv2discoverykeyloggerpersistencestealer

Malware Config

Targets

    • Target

      621540fe24ded979a6965228f0d3ab31_JaffaCakes118

    • Size

      1.1MB

    • MD5

      621540fe24ded979a6965228f0d3ab31

    • SHA1

      0ce5a910645b642f9c35d3ffb8c66622fd4bbf75

    • SHA256

      ff8019442e59313da64f044f6a66b852251ce25767f50f1b7a380defc6315eb5

    • SHA512

      a55fd6d9821ed8615fadf593b857e1e6ff92c643dcbe1be7ca2c9de918f40256f1293c9f9170d12ad443ee779e3989162d920101c9f0ea9f08331f7fdf9f51ca

    • SSDEEP

      24576:DrSRbZYP8nKuzFv2dUrRKV2Df/sT4adX39O7f:DrebZO8n1FAUDnsTRtOz

    Score
    10/10
    ardamaxaspackv2discoverykeyloggerpersistencestealer

    • Ardamax

      A keylogger first seen in 2013.

      keyloggerstealerardamax

    • Ardamax main executable

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

      aspackv2

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks