Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

JaffaCakes...a0.exe

windows7-x64

10

JaffaCakes...a0.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_82a10c3d88bde601bbe9dc598278bba0

  • Size

    299KB

  • Sample

    250320-nfs68s1xhs

  • MD5

    82a10c3d88bde601bbe9dc598278bba0

  • SHA1

    fe9d6b9b41ce6043046e1422fa8fe1ef293f74ed

  • SHA256

    47e2aa2d9c93a000c634f4cf3b8f2f9fb84d04f8ecf21e79adac912bc8578257

  • SHA512

    dfbf515c46e7ac33ff3c5cca30dfbfa41ce080790ced2e3a741b54860cccf5a280f026b797f056b4a17f85f501c19143e37375c6ccefc50f8734e73c85797252

  • SSDEEP

    6144:0RXe6tGa25QPQ3LFLF1Tp55/SzS74etBNbc88eYYTeuw0JBOmtb/RSxQwXzQ8R97:0RXeKQbVV5hkgHbhQYT5w0POkpSSwXh

Score
10/10
ardamaxdiscoverykeyloggerpersistencestealerupx

Malware Config

Targets

    • Target

      JaffaCakes118_82a10c3d88bde601bbe9dc598278bba0

    • Size

      299KB

    • MD5

      82a10c3d88bde601bbe9dc598278bba0

    • SHA1

      fe9d6b9b41ce6043046e1422fa8fe1ef293f74ed

    • SHA256

      47e2aa2d9c93a000c634f4cf3b8f2f9fb84d04f8ecf21e79adac912bc8578257

    • SHA512

      dfbf515c46e7ac33ff3c5cca30dfbfa41ce080790ced2e3a741b54860cccf5a280f026b797f056b4a17f85f501c19143e37375c6ccefc50f8734e73c85797252

    • SSDEEP

      6144:0RXe6tGa25QPQ3LFLF1Tp55/SzS74etBNbc88eYYTeuw0JBOmtb/RSxQwXzQ8R97:0RXeKQbVV5hkgHbhQYT5w0POkpSSwXh

    Score
    10/10
    ardamaxdiscoverykeyloggerpersistencestealerupx

    • Ardamax

      A keylogger first seen in 2013.

      keyloggerstealerardamax

    • Ardamax family

      ardamax

    • Ardamax main executable

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks