Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
25/03/2024, 13:32
Behavioral task
behavioral1
Sample
d451ff56765a9c5492832f143b5c6613fbca57972b4b73df415a5998331a45af.pdf
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
d451ff56765a9c5492832f143b5c6613fbca57972b4b73df415a5998331a45af.pdf
Resource
win10v2004-20240226-en
General
-
Target
d451ff56765a9c5492832f143b5c6613fbca57972b4b73df415a5998331a45af.pdf
-
Size
176KB
-
MD5
c44215325441991b0649ff55c5c8ba16
-
SHA1
84d5b9987c7a52244433fa8713952fe3683e8ca4
-
SHA256
d451ff56765a9c5492832f143b5c6613fbca57972b4b73df415a5998331a45af
-
SHA512
5fdc62308aec36add38adf0627e27ecede81a77010f0a694d56a005f01d7241586110d8adef97fd7e67d63c393bc60fae6df3f91f58828e3684fa82e993b8573
-
SSDEEP
3072:tE62C0sWcqnTVPQDUG/6vPJl99ed7xJJVXD3AcBHTG8ZxL2LyFhrH:AcWVPQYQcPJf9ed//cyHTXE0hrH
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2884 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 2884 AcroRd32.exe 2884 AcroRd32.exe 2884 AcroRd32.exe 2884 AcroRd32.exe 2884 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\d451ff56765a9c5492832f143b5c6613fbca57972b4b73df415a5998331a45af.pdf"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2884
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5176327945effd0482990ad6b64108fc8
SHA1ec51c9db0220aca21e0dda273ea1680cadb7ae1a
SHA2563f6d04b1eb26d1962b3b27935a7e1c226dd765073ae9b29b7728f053c2d161eb
SHA5123eb7c8449547b0e7da7f566290c19a3751c705521fc972a76bc8c81a5af9aa68edc57c4b7ce1b923f2e0c627ffbc77f7a4684b55ebbe0e4a2e1f468cbd8d2ea7