Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
11/10/2023, 18:37
Behavioral task
behavioral1
Sample
NEAS.280620c1c58d75b8efd81027b53b4930_JC.pdf
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
NEAS.280620c1c58d75b8efd81027b53b4930_JC.pdf
Resource
win10v2004-20230915-en
General
-
Target
NEAS.280620c1c58d75b8efd81027b53b4930_JC.pdf
-
Size
486KB
-
MD5
280620c1c58d75b8efd81027b53b4930
-
SHA1
57b38ff0ad4d1481d4696b3a08e396f08062bb4a
-
SHA256
05d76a00dbe048b95fc221ff094e48339e43abce05a978a7d4914bf6a2391dd2
-
SHA512
11567ffa6bc610e6d9b9229e2448197343cd5774c1b0c4b6cce14b3fa519f6c7d6fbb4b81d8a3b48e312b49727dfd0c442535747bdf6ab33070e8cedb9508b85
-
SSDEEP
6144:hBSu7R8l3MQ50mDH0xIAMyPCm3LseeXbj2Xmn+aZs6JBFz5F39vUwmgWTZCz8gRT:fR810S0xIA2UkXm23ZsWBFz5Xegf+Py7
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2100 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2100 AcroRd32.exe 2100 AcroRd32.exe 2100 AcroRd32.exe 2100 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\NEAS.280620c1c58d75b8efd81027b53b4930_JC.pdf"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2100
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5a8fa7343e58d8bc43055c63899d05081
SHA1729320b507259e553f0acd077d90ded2eaf2738a
SHA256c8d5985ef60ca667d4244a7ddbe4d080511445d0c8bad05b0685b8e93123f4af
SHA51291c4802360c409456df6780d60283e04cadf7ca0a27a5417473de2b71519ed87b8a2807026e47dfc1870a7432db75d3affa2c412229d7dedeb42832b97812095