Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

JaffaCakes...9a.exe

windows7-x64

10

JaffaCakes...9a.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_7bedc7ec247b28d896c99e8b561fa19a

  • Size

    568KB

  • Sample

    250316-2g932a1xh1

  • MD5

    7bedc7ec247b28d896c99e8b561fa19a

  • SHA1

    313c53259b494096a9cadc1281f59931d0d6acf3

  • SHA256

    e09e9d0b0930dcfc7c3f4f03ab779d7991ef932907d296ddf9787ddd055f815f

  • SHA512

    9f72de04f7603bbdf8e851f54f583bcd6525bd28c8cc0e796cf48cc33416d88e47b4a84416ffeb69f9fed8f32e4a76a1e828f7402b34d947ed0a09022410e2b9

  • SSDEEP

    12288:REjybmXO57JLMAagZumjZjTNBpJqjKVj8im/AnWgg8IR3N6nMzjPbnKDSTFiRl:JEcFMAasFjIKVjxm/AWgfIa6yDOF8l

Score
10/10
ardamaxdiscoverykeyloggerpersistencestealer

Malware Config

Targets

    • Target

      JaffaCakes118_7bedc7ec247b28d896c99e8b561fa19a

    • Size

      568KB

    • MD5

      7bedc7ec247b28d896c99e8b561fa19a

    • SHA1

      313c53259b494096a9cadc1281f59931d0d6acf3

    • SHA256

      e09e9d0b0930dcfc7c3f4f03ab779d7991ef932907d296ddf9787ddd055f815f

    • SHA512

      9f72de04f7603bbdf8e851f54f583bcd6525bd28c8cc0e796cf48cc33416d88e47b4a84416ffeb69f9fed8f32e4a76a1e828f7402b34d947ed0a09022410e2b9

    • SSDEEP

      12288:REjybmXO57JLMAagZumjZjTNBpJqjKVj8im/AnWgg8IR3N6nMzjPbnKDSTFiRl:JEcFMAasFjIKVjxm/AWgfIa6yDOF8l

    Score
    10/10
    ardamaxdiscoverykeyloggerpersistencestealer

    • Ardamax

      A keylogger first seen in 2013.

      keyloggerstealerardamax

    • Ardamax family

      ardamax

    • Ardamax main executable

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks