Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    ac147a8e19565297726ec203023de2f3_JaffaCakes118

  • Size

    2.2MB

  • Sample

    240819-w1wf4asgpj

  • MD5

    ac147a8e19565297726ec203023de2f3

  • SHA1

    9472ef5fb2085ec626cf2bfdb87b513c43cec9f1

  • SHA256

    1a14552d5f54ee921bde1ada59b19b9168bae5352ba0ab18a05b3b0883f0c881

  • SHA512

    367e7dbf32ac1f9f31f7f2264f60f6fbbb08b0511738e69c4762e1e235e047194ee7ae72e05c25dcdb9b666480b58df91a2844c3f3431adc580240e71c4109f9

  • SSDEEP

    49152:N8r5x/XREgpueaHS9m2FcpeIAPbG05UtroxEGh:CHZEgMDy9tXGiUCxEw

Malware Config

Targets

    • Target

      ac147a8e19565297726ec203023de2f3_JaffaCakes118

    • Size

      2.2MB

    • MD5

      ac147a8e19565297726ec203023de2f3

    • SHA1

      9472ef5fb2085ec626cf2bfdb87b513c43cec9f1

    • SHA256

      1a14552d5f54ee921bde1ada59b19b9168bae5352ba0ab18a05b3b0883f0c881

    • SHA512

      367e7dbf32ac1f9f31f7f2264f60f6fbbb08b0511738e69c4762e1e235e047194ee7ae72e05c25dcdb9b666480b58df91a2844c3f3431adc580240e71c4109f9

    • SSDEEP

      49152:N8r5x/XREgpueaHS9m2FcpeIAPbG05UtroxEGh:CHZEgMDy9tXGiUCxEw

    • Ardamax

      A keylogger first seen in 2013.

    • Ardamax main executable

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks