Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
16/10/2023, 15:41
Behavioral task
behavioral1
Sample
NEAS.180ee6945eba3dc169f061fdb843b9c0_JC.pdf
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
NEAS.180ee6945eba3dc169f061fdb843b9c0_JC.pdf
Resource
win10v2004-20230915-en
General
-
Target
NEAS.180ee6945eba3dc169f061fdb843b9c0_JC.pdf
-
Size
167KB
-
MD5
180ee6945eba3dc169f061fdb843b9c0
-
SHA1
a5e299e01612f35dd1ed233be65db7626bfae0ab
-
SHA256
b9362f80eb269b12bbb5cfffcfa26091c528c54142a9173023ac5085f0928c96
-
SHA512
1641471a3799ba0a02bbd338b809616330fb1d4f342fe4e2a30d39b0f2c1cc144d0650f522eed80e3ccde956f0cb223fc8d6851d66fc3b075c6c8ec4743d93bb
-
SSDEEP
3072:OIZh8jTNz1AHh3faqqj/JZvG4aO3+8f4cpkH34eIXiK2ARUky3AeqU1cxofnz7J7:OIZh8jZz16h6jJZvNFuW4D34eSiK2CUl
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2060 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2060 AcroRd32.exe 2060 AcroRd32.exe 2060 AcroRd32.exe 2060 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\NEAS.180ee6945eba3dc169f061fdb843b9c0_JC.pdf"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2060
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5199455116ddde3bec4bf8c3970064c82
SHA1aedae0d667810c3aa15afc1c57f1848b434f8e40
SHA25623534b7d2bcbb655254ed3a82528bc1fdaebbc3df4bdcd5f83561f1030c36e83
SHA512f27b0a13e297649086d6ff9a4fa1d0336076f8d26c8475e8ead817d51efbe758750e29112271a6c566bbfef3d1c88c0447906a0b82a7b6abf3c33101a3f76e86