Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
165s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20231025-en -
resource tags
arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system -
submitted
03/11/2023, 20:11
Behavioral task
behavioral1
Sample
NEAS.dce59c533be031dc0cf4e3d7d1e197d0_JC.pdf
Resource
win7-20231025-en
Behavioral task
behavioral2
Sample
NEAS.dce59c533be031dc0cf4e3d7d1e197d0_JC.pdf
Resource
win10v2004-20231023-en
General
-
Target
NEAS.dce59c533be031dc0cf4e3d7d1e197d0_JC.pdf
-
Size
142KB
-
MD5
dce59c533be031dc0cf4e3d7d1e197d0
-
SHA1
553a2499a6ef7329f1814585ae115efee289dc57
-
SHA256
1156a29bf36a54890e9242d272b61fb9c4f43f10dca90ca6c753fa41c2092792
-
SHA512
a154002f80fe787b88473daae887d855a4557f9f9910cbc0ce007117d8695cbad729a641e76aacde410905cfc06c195c6f199c9208dbef1a45748a6bf1f02d47
-
SSDEEP
3072:NDF5Ii56CLq0bahjnvBmH7mJjZmfRkQ+ojubGxlQIEo4Xn7IS:ZQXsKjnvB+mif+noqix+
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2948 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2948 AcroRd32.exe 2948 AcroRd32.exe 2948 AcroRd32.exe 2948 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\NEAS.dce59c533be031dc0cf4e3d7d1e197d0_JC.pdf"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2948
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD56dcbcc3b1de6b021bb4fa29429f87b57
SHA19c272d9d6757ffbcd634842a3021d27e6934f8d4
SHA256f36e4058eff5545126d16fd6dc85cfe88d9f4a4ec6224918df20547e4dbcc085
SHA512b7f1434593203214a7c675164c113686ca9549cf8c311b1a1008f9d39ac7a114cce84b91f6a3fd2b0ef90bcf27f8d1e77244854d4aac6bce31cfa103e653fd93