Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
af3395d7babb162620c8c7bc9b3ab1fc_JaffaCakes118
-
Size
674KB
-
Sample
240820-pkkw4a1enh
-
MD5
af3395d7babb162620c8c7bc9b3ab1fc
-
SHA1
b0ade23c953d27dc64140abcfc4032b845ddf57d
-
SHA256
cc2d3b9c940a81a8e9bfbfb5e0a829ab56a0878a74cb02eb0f1725f086dd09df
-
SHA512
59671b53a68c5849d7b9a3e82e90e03cf9f1be6e6df9f688680be7b3ad2d0f0a16961b66e81590d3388189de853f0a0ecaa86caf8bdf2561fe6252b2ca31a74d
-
SSDEEP
12288:n3TdtLW5WIj1YSSdFxZ3opqaBSXyMzBUWb9lx/9AgHLo8OW+rBj:3Dsj1dEYqaBcJ9nPx/igrp+1
Static task
static1
Behavioral task
behavioral1
Sample
af3395d7babb162620c8c7bc9b3ab1fc_JaffaCakes118.exe
Resource
win7-20240708-en
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Targets
-
-
Target
af3395d7babb162620c8c7bc9b3ab1fc_JaffaCakes118
-
Size
674KB
-
MD5
af3395d7babb162620c8c7bc9b3ab1fc
-
SHA1
b0ade23c953d27dc64140abcfc4032b845ddf57d
-
SHA256
cc2d3b9c940a81a8e9bfbfb5e0a829ab56a0878a74cb02eb0f1725f086dd09df
-
SHA512
59671b53a68c5849d7b9a3e82e90e03cf9f1be6e6df9f688680be7b3ad2d0f0a16961b66e81590d3388189de853f0a0ecaa86caf8bdf2561fe6252b2ca31a74d
-
SSDEEP
12288:n3TdtLW5WIj1YSSdFxZ3opqaBSXyMzBUWb9lx/9AgHLo8OW+rBj:3Dsj1dEYqaBcJ9nPx/igrp+1
-
Ardamax main executable
-
Modifies WinLogon for persistence
-
Disables RegEdit via registry modification
-
Disables Task Manager via registry modification
-
Modifies Windows Firewall
-
Executes dropped EXE
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Drops file in System32 directory
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
2Disable or Modify System Firewall
1Disable or Modify Tools
1Modify Registry
4