Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
169s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
16/10/2023, 16:14
Behavioral task
behavioral1
Sample
NEAS.1d04caab911dcaa5c9886649c9a9f2c0_JC.pdf
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
NEAS.1d04caab911dcaa5c9886649c9a9f2c0_JC.pdf
Resource
win10v2004-20230915-en
General
-
Target
NEAS.1d04caab911dcaa5c9886649c9a9f2c0_JC.pdf
-
Size
62KB
-
MD5
1d04caab911dcaa5c9886649c9a9f2c0
-
SHA1
d511ea06e6f541f4bbd5abf1913d9ddc79692df6
-
SHA256
c81d26df41c1b14a62f274ac79fd23afe86170a17e3b03ee41d5792a27fa6048
-
SHA512
15c33f32efd26c0201fbd014f6427dff9188a1af323ca0821ec64d25eade2ae968a05e1215cac97223b476166dbaf9698f3c312117062c0fcf8d4d6e68331b32
-
SSDEEP
768:Vzvz1fLMz+olzgN6HEKhSduZd3BWi8kf2smqfYsuft9y6rl3wJRTgN6T4XSjjFYk:PLqFRuFaJqg2SFYLpgMbPCr5mZopSSp
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3016 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 3016 AcroRd32.exe 3016 AcroRd32.exe 3016 AcroRd32.exe 3016 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\NEAS.1d04caab911dcaa5c9886649c9a9f2c0_JC.pdf"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3016
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD52997256214abef83728b4ead8113145c
SHA1ed5d95e3e2340f5beb6b6dea40a94a8f0a941169
SHA2569f254ea9c48cc9d8d9a90dba71cdd0815c9682c04fbd44d6c04a704322a1ea33
SHA512a8d4800fa2c820a88a30429b2e2ae7776e6e39a0619d9351f3654b6b89c926b6e8d8dc13164ba2ebb5741455d8f594210dc5c09910d323c82eab0ff56cb84e77