Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
110s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
20/07/2023, 02:13
Behavioral task
behavioral1
Sample
Building a Next-Gen SOC with IBM QRadar Accelerate your security operations and detect cyber threats.pdf
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
Building a Next-Gen SOC with IBM QRadar Accelerate your security operations and detect cyber threats.pdf
Resource
win10v2004-20230703-en
General
-
Target
Building a Next-Gen SOC with IBM QRadar Accelerate your security operations and detect cyber threats.pdf
-
Size
10.1MB
-
MD5
99334d02d72aa8eef246192da5ebafba
-
SHA1
be5a9a7378c3267d6d83b2e218c217449cc78ef5
-
SHA256
631bfb50e8c8d7425b019e5bbbbe99bbdb1390c6b5d6760a8d9e9f2c454cb39e
-
SHA512
cab645ea2fa64672f5ca992847632cb0d919c4958319c5f4039fdc14b1ca60add71dde2cc92aacfafa40e3ba67bb7294ef592fab8d0ed0631faacb827462f074
-
SSDEEP
196608:xQL16+CZxvSsUshIVEeG1FjuT7GBDwCtGF4O/T:OLgZxNUsamwGCMy4O7
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2040 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2040 AcroRd32.exe 2040 AcroRd32.exe 2040 AcroRd32.exe 2040 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Building a Next-Gen SOC with IBM QRadar Accelerate your security operations and detect cyber threats.pdf"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2040
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5923cf84a9e083f6245fc9de2b28d55f2
SHA138cf8257cd65c0caf390f77c301c430739bffc4c
SHA256a4e717c3d7e5cbabbfd50b1caf62a1715892c35e19c8adead425f6a49b27abd8
SHA512769bf4eb1f29d719c8b9111446ee50904cb9e541db190ebe3dc5e829c2df67900a43bffd104924e22ca68680104eef17b21df5f547640aef482c1879f5d5a0c4