Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    aff5c63b84a430a7c61de6c845833a35_JaffaCakes118

  • Size

    1.8MB

  • Sample

    240820-tyedpasbke

  • MD5

    aff5c63b84a430a7c61de6c845833a35

  • SHA1

    78bae340d1dce238204f1321af69f3ac7b42f620

  • SHA256

    d27e429b30898e790cd3507fc16a6f257c653279169e2acb93350226a225335e

  • SHA512

    ae62076f9faef2610de5d9cb74afaf02f3394e375c83aa62049af28e14ccd4f68cde11fbcd232883ed77af04b33647bea60193d69690ad1c4420d6376dc86d82

  • SSDEEP

    49152:cHjsdFMMSlhd9j7H3jeKoW1PjTT1v7Sr82Wap:n0MSv7Xj19PjN2v

Malware Config

Targets

    • Target

      aff5c63b84a430a7c61de6c845833a35_JaffaCakes118

    • Size

      1.8MB

    • MD5

      aff5c63b84a430a7c61de6c845833a35

    • SHA1

      78bae340d1dce238204f1321af69f3ac7b42f620

    • SHA256

      d27e429b30898e790cd3507fc16a6f257c653279169e2acb93350226a225335e

    • SHA512

      ae62076f9faef2610de5d9cb74afaf02f3394e375c83aa62049af28e14ccd4f68cde11fbcd232883ed77af04b33647bea60193d69690ad1c4420d6376dc86d82

    • SSDEEP

      49152:cHjsdFMMSlhd9j7H3jeKoW1PjTT1v7Sr82Wap:n0MSv7Xj19PjN2v

    • Ardamax

      A keylogger first seen in 2013.

    • Ardamax main executable

    • Executes dropped EXE

    • Loads dropped DLL

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks