Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
04/11/2023, 21:39
Behavioral task
behavioral1
Sample
NEAS.ae9ae096cba985b070b1bd14a9f936a0_JC.pdf
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.ae9ae096cba985b070b1bd14a9f936a0_JC.pdf
Resource
win10v2004-20231020-en
General
-
Target
NEAS.ae9ae096cba985b070b1bd14a9f936a0_JC.pdf
-
Size
66KB
-
MD5
ae9ae096cba985b070b1bd14a9f936a0
-
SHA1
11a711ad2ad2b3572d5bf98eece6f6bb9449e3bc
-
SHA256
2bb4f87c4a9dcf45be7855ade415a88e316bce4138dc942249bf0c49023b856f
-
SHA512
d5d25fe357cb2eec6a1139c28fd99908149be0067fbfba6d832e65358b661662093d4a28dc1d72d518175bfc757f69d6690efe82d9c98681c916add4895675fe
-
SSDEEP
1536:VXt9iTe4hLq1ATVvIkSTofgnbGl7kCY+23d9Om1JRWu7LSoq6T:JHiTe4hGCy5Gldu75dPSkT
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2632 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2632 AcroRd32.exe 2632 AcroRd32.exe 2632 AcroRd32.exe 2632 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\NEAS.ae9ae096cba985b070b1bd14a9f936a0_JC.pdf"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2632
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD593304aac464663ba647f3ac6b124b698
SHA12e88bfaffecac551a2491f2940b43072aa527bf9
SHA256bf9ccdc1376e03091051dde47287f5d7237a3342f962827595b0c97797f353e7
SHA5124b4ede9817517fce8fcf4d901ca95f5b2598c1bbb79ebd024fc690c2fa9da53d9ecd13737acd0860a0fc268585e03141d7a9ced53a52481affd7467aeb70876e