Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
02/08/2023, 13:27
Behavioral task
behavioral1
Sample
Trivista Dodge City LLC Invoice 8095015 due May 31 2023.pdf
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
Trivista Dodge City LLC Invoice 8095015 due May 31 2023.pdf
Resource
win10v2004-20230703-en
General
-
Target
Trivista Dodge City LLC Invoice 8095015 due May 31 2023.pdf
-
Size
195KB
-
MD5
06ea22ee0616a93f9d9fcc63bbfb55f0
-
SHA1
6ae3512a6766bf1298228fdc10a6c60b45b92587
-
SHA256
a0795d3cfdf1038ff9e92eac0982131c5c8235c9751e2873dbac3b7fa5a9376f
-
SHA512
1911ce9c09e0c7213d2d5f3f93298b7dbefac8aeb031b217e134337500c5a48ce158107373784d7c740d1a2a4ebb43afb00573a2b02acea900551330a73d970d
-
SSDEEP
3072:xgKsxEOQe7lMlhGd8PDHCqbs0T5T5vRyDDtOtBPxmQ+nilX0U8xoKjFkCQhaqVs:1WCexMlhIE/I0TJmDDtOUQ+nYIx/f
Malware Config
Signatures
-
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification \??\c:\windows\installer\{ac76ba86-7ad7-1033-7b44-a90000000001}\pdffile_8.ico AcroRd32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2484 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2484 AcroRd32.exe 2484 AcroRd32.exe 2484 AcroRd32.exe 2484 AcroRd32.exe 2484 AcroRd32.exe 2484 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Trivista Dodge City LLC Invoice 8095015 due May 31 2023.pdf"1⤵
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2484
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD54de1ab4a7eb65b1c5f9b123f83af3b45
SHA1a554da582c6859a9553a95930e1ca78e05c6ea4c
SHA256ba9bf9adbf46c2dbd85ab7289fb2f09edecc21df87a8bba6612e9636721e38c3
SHA512852e644a11ec4996a5e67d8a755f7ca183f757f0b9a767379a079d805d1a630262bf38f14f5e6544d4074d36e8441627b7783054ac043453f6c024209e680e84