Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

JaffaCakes...06.exe

windows7-x64

10

JaffaCakes...06.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_7c28b4f5e5ef9ce6f00e407a2ae79506

  • Size

    488KB

  • Sample

    250317-aefmvsxjv8

  • MD5

    7c28b4f5e5ef9ce6f00e407a2ae79506

  • SHA1

    afb3f897a54886824832706342e4e490d8029ea4

  • SHA256

    35f7e35cbc0454bb5fd0c1f0281286d1870fdfae1296d781e6334537ea13dd26

  • SHA512

    142df43a2b84ae6620d721cf346a3bda476ac26ebb997404f0b0a61f4d59ca07dc452aa1b2331eb1bd8ea17cddfce54119a422da15615d298e9ce78369cc991f

  • SSDEEP

    12288:lWPbHtkak9viyKYzIo94eMnAMMckn4jNdEnGm9ucQDH5f0Vp:kPK1xiKzIoDyMckoT25QT5f0f

Score
10/10
ardamaxdiscoverykeyloggerpersistencestealer

Malware Config

Targets

    • Target

      JaffaCakes118_7c28b4f5e5ef9ce6f00e407a2ae79506

    • Size

      488KB

    • MD5

      7c28b4f5e5ef9ce6f00e407a2ae79506

    • SHA1

      afb3f897a54886824832706342e4e490d8029ea4

    • SHA256

      35f7e35cbc0454bb5fd0c1f0281286d1870fdfae1296d781e6334537ea13dd26

    • SHA512

      142df43a2b84ae6620d721cf346a3bda476ac26ebb997404f0b0a61f4d59ca07dc452aa1b2331eb1bd8ea17cddfce54119a422da15615d298e9ce78369cc991f

    • SSDEEP

      12288:lWPbHtkak9viyKYzIo94eMnAMMckn4jNdEnGm9ucQDH5f0Vp:kPK1xiKzIoDyMckoT25QT5f0f

    Score
    10/10
    ardamaxdiscoverykeyloggerpersistencestealer

    • Ardamax

      A keylogger first seen in 2013.

      keyloggerstealerardamax

    • Ardamax family

      ardamax

    • Ardamax main executable

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks