Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
24/10/2023, 00:23
Behavioral task
behavioral1
Sample
NEAS.6564390c54a0a577c830afdb37dd2b50_JC.pdf
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.6564390c54a0a577c830afdb37dd2b50_JC.pdf
Resource
win10v2004-20231023-en
General
-
Target
NEAS.6564390c54a0a577c830afdb37dd2b50_JC.pdf
-
Size
53KB
-
MD5
6564390c54a0a577c830afdb37dd2b50
-
SHA1
1ec629445a1a5d1c9e9bbd73f727230b45cbf55b
-
SHA256
e242bf12a68065d18e4a100227275d70b911dd51efec156b129b7124889a72cf
-
SHA512
09a5b089e59527b155dd891f5cedcf9d5689396a84abbda31920558461176c29840863887d956ed429c864b6a6fe877ef47edbabc8ac65dbf593f7af9c2fe288
-
SSDEEP
768:HuzdNIggou41dMV+foYlP133hVfjM24tytsFG8ErhUsSv1Wy+AilsWRQ3:OzIW1dMV+foY5x+iK4asSkvlty3
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2548 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2548 AcroRd32.exe 2548 AcroRd32.exe 2548 AcroRd32.exe 2548 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\NEAS.6564390c54a0a577c830afdb37dd2b50_JC.pdf"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2548
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD53759e3a0a546c9e041c6108a5644f841
SHA1a388a81b9f12cabeda3069b18ffa552d97cd8eb5
SHA256ccd77767735c83c59e7a4dc92828cc73231d0a70d9fc737f7f18f9891420b6e2
SHA512891d3dd3c94e4df1fd088db5f84a0b7e5f27a76ef4e1d0f5cff7ac225e7d546347f9e4d3bc4825445672a3bdcedb5782d69a9b45fedc1d2b78e3d71c8b7874e8