Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28/03/2024, 07:26
Behavioral task
behavioral1
Sample
006e03371fb3da1449da30048fae6de5_JaffaCakes118.pdf
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
006e03371fb3da1449da30048fae6de5_JaffaCakes118.pdf
Resource
win10v2004-20240226-en
General
-
Target
006e03371fb3da1449da30048fae6de5_JaffaCakes118.pdf
-
Size
80KB
-
MD5
006e03371fb3da1449da30048fae6de5
-
SHA1
27d4211dccb7b366a6bf1deb29f499b1eabf1d60
-
SHA256
c1448931f3672506c57325e91f371deaaa40b47b03881a4bbf5fde463a62bcdc
-
SHA512
9c82a1a492e6ba75571e82ccf4ab04b7f6c8137db7fcbfbfe8c99ac719cee2405791b30ab4c5d48501153c4f7388dbeba6cbbb324cabf17277edc0efa36e4888
-
SSDEEP
1536:uFuZ7IlbAzODKucss7zJwE7RCWIWSPQaM3QSZ5MI7VXP0HWRl5JWepOySlZM:IuZ7IVA8xsfJwIRCWC3sMI7SS5yyn
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1220 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1220 AcroRd32.exe 1220 AcroRd32.exe 1220 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\006e03371fb3da1449da30048fae6de5_JaffaCakes118.pdf"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1220
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD58e64fa85a71267a0987202c1ea269c9b
SHA170b7e14c86f33577671dc0f567959eac6f57a568
SHA2564f01b5be3db1db638772975f4f560a9b1fafe7f65b38ed0842c08f6e553bc601
SHA5122beb18be8f365b757d033993d39e9730d4c6fc42a26b0a5b4ad015f5b6be962ad06065d45f57044ac357e83e4ba994006d912aa8924bdcc830824f6676c6d9e0