Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
c848fd6b8b324c46153f70c69546c2f1_JaffaCakes118
-
Size
1.8MB
-
Sample
240829-f2b6vavhpd
-
MD5
c848fd6b8b324c46153f70c69546c2f1
-
SHA1
c0d4c7a07d60ed2de61c24ff675204b98b5d80d3
-
SHA256
3ef9bad8dbc9becb39a3c0242d2a835258eb4f215173065eed4f3a33fa0a8eb0
-
SHA512
95c6a1b55c602948fb7bc5eee334abbff70476a4ab9d8f06076d00e23a5b3dec7b9baa4d8858a79c6cec1a7b82f49430d7ff3fb356dc0026cfe5265f7da94615
-
SSDEEP
49152:qWYtqRnAbOgZeESc/ZRu2IdhoCm4E4rf07PG2Z:qpulgkEL/m/mSwbGE
Behavioral task
behavioral1
Sample
c848fd6b8b324c46153f70c69546c2f1_JaffaCakes118.exe
Resource
win7-20240705-en
Malware Config
Targets
-
-
Target
c848fd6b8b324c46153f70c69546c2f1_JaffaCakes118
-
Size
1.8MB
-
MD5
c848fd6b8b324c46153f70c69546c2f1
-
SHA1
c0d4c7a07d60ed2de61c24ff675204b98b5d80d3
-
SHA256
3ef9bad8dbc9becb39a3c0242d2a835258eb4f215173065eed4f3a33fa0a8eb0
-
SHA512
95c6a1b55c602948fb7bc5eee334abbff70476a4ab9d8f06076d00e23a5b3dec7b9baa4d8858a79c6cec1a7b82f49430d7ff3fb356dc0026cfe5265f7da94615
-
SSDEEP
49152:qWYtqRnAbOgZeESc/ZRu2IdhoCm4E4rf07PG2Z:qpulgkEL/m/mSwbGE
-
Ardamax main executable
-
Executes dropped EXE
-
Identifies Wine through registry keys
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory
-