Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

7

c848fd6b8b...18.exe

windows7-x64

10

c848fd6b8b...18.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c848fd6b8b324c46153f70c69546c2f1_JaffaCakes118

  • Size

    1.8MB

  • Sample

    240829-f2b6vavhpd

  • MD5

    c848fd6b8b324c46153f70c69546c2f1

  • SHA1

    c0d4c7a07d60ed2de61c24ff675204b98b5d80d3

  • SHA256

    3ef9bad8dbc9becb39a3c0242d2a835258eb4f215173065eed4f3a33fa0a8eb0

  • SHA512

    95c6a1b55c602948fb7bc5eee334abbff70476a4ab9d8f06076d00e23a5b3dec7b9baa4d8858a79c6cec1a7b82f49430d7ff3fb356dc0026cfe5265f7da94615

  • SSDEEP

    49152:qWYtqRnAbOgZeESc/ZRu2IdhoCm4E4rf07PG2Z:qpulgkEL/m/mSwbGE

Score
10/10
ardamaxdiscoveryevasionkeyloggerpersistencestealerthemida

Malware Config

Targets

    • Target

      c848fd6b8b324c46153f70c69546c2f1_JaffaCakes118

    • Size

      1.8MB

    • MD5

      c848fd6b8b324c46153f70c69546c2f1

    • SHA1

      c0d4c7a07d60ed2de61c24ff675204b98b5d80d3

    • SHA256

      3ef9bad8dbc9becb39a3c0242d2a835258eb4f215173065eed4f3a33fa0a8eb0

    • SHA512

      95c6a1b55c602948fb7bc5eee334abbff70476a4ab9d8f06076d00e23a5b3dec7b9baa4d8858a79c6cec1a7b82f49430d7ff3fb356dc0026cfe5265f7da94615

    • SSDEEP

      49152:qWYtqRnAbOgZeESc/ZRu2IdhoCm4E4rf07PG2Z:qpulgkEL/m/mSwbGE

    Score
    10/10
    ardamaxdiscoveryevasionkeyloggerpersistencestealerthemida

    • Ardamax

      A keylogger first seen in 2013.

      keyloggerstealerardamax

    • Ardamax main executable

    • Executes dropped EXE

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Loads dropped DLL

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks