Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20231025-en -
resource tags
arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system -
submitted
01/11/2023, 20:48
Behavioral task
behavioral1
Sample
NEAS.a7c66e6bbef27dfb9952a0e72d816510_JC.pdf
Resource
win7-20231025-en
Behavioral task
behavioral2
Sample
NEAS.a7c66e6bbef27dfb9952a0e72d816510_JC.pdf
Resource
win10v2004-20231025-en
General
-
Target
NEAS.a7c66e6bbef27dfb9952a0e72d816510_JC.pdf
-
Size
53KB
-
MD5
a7c66e6bbef27dfb9952a0e72d816510
-
SHA1
84347e5932ab067fcf9dfa3635d206a74d0cb029
-
SHA256
782a898834e418fb57a02f50754597a981f9ae4a3eb871603c48b189fc6ca5b1
-
SHA512
d5d1d1318917d21153c35baf20768e5b24e37820677a5a7ddf77ef9cc13f533d0b53ba6e0e9dedb6d8c473b32f82e9ec22632a733d54c846d9e3379ca2e5be2f
-
SSDEEP
768:VzuNiz1FVTVzj+OsvzjEiqzg9Bz7AY3fdE+0uft9y6rl3wJBXQaWO4XSjjFYLpRv:SOsfF9YLuFaJN92SFYLpgs4zOo93q
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1768 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1768 AcroRd32.exe 1768 AcroRd32.exe 1768 AcroRd32.exe 1768 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\NEAS.a7c66e6bbef27dfb9952a0e72d816510_JC.pdf"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1768
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5a3ec2627edcadc2f54337666b324f453
SHA19918e1188cf765f49c64c956643cf12bdb13078a
SHA2564792ffdfa2ccecb288223fee15c04a32a2d4d2d88a9388133861d2d7ab6343e8
SHA5122ccd8a2fcc9d8aba2fa94ec3802afab542764f6961db42f7e1b7e417f50af1961cd21938b7995c47b1b072d05de6047d035c910a0a8d75981dc974a86acc3b83