Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
23/10/2023, 19:47
Behavioral task
behavioral1
Sample
NEAS.34816c95e14cc3dea73cfd48916e52a0_JC.pdf
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.34816c95e14cc3dea73cfd48916e52a0_JC.pdf
Resource
win10v2004-20231023-en
General
-
Target
NEAS.34816c95e14cc3dea73cfd48916e52a0_JC.pdf
-
Size
54KB
-
MD5
34816c95e14cc3dea73cfd48916e52a0
-
SHA1
8e56a23e6793399dbcf5199e40854c25f5056c02
-
SHA256
32da269a43655979ed75d9d8c549e3f166c1f116f5b85a877622eefe95325e35
-
SHA512
6964fa84a7da398cda08991e71e593ffeffbdcaa413ab30582d83849e05ff4973de7acef9058ae2759891ebcb6cef5098b4e4b28e032a81e1f6987445e5313c7
-
SSDEEP
768:luzdNIggou41dMV+foYlP13WBOSvCsPiulk1R0gcaFEgp8ZrK0:MzIW1dMV+foY5z4zPDlueg1FEgp840
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2492 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2492 AcroRd32.exe 2492 AcroRd32.exe 2492 AcroRd32.exe 2492 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\NEAS.34816c95e14cc3dea73cfd48916e52a0_JC.pdf"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2492
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD50aa372a8385082fcf34bb743b090c5d8
SHA141e63acb73d64fac9c8c444301d3adfae3852557
SHA256478445632a326ea5abd25bf3924980f15da60719250d42f45986790b896c1d0b
SHA5128fabf642310fcf4fbb3f6c3942d07ee37724aba6552b9f85ae82ea41b72913c75647dcc407919fc9489b309a02633c9261f07719776b7ea9d8721384a2552baa