Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28/03/2024, 07:06
Behavioral task
behavioral1
Sample
0024262b8b7f1c51365b0d17b07ab2e7_JaffaCakes118.pdf
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0024262b8b7f1c51365b0d17b07ab2e7_JaffaCakes118.pdf
Resource
win10v2004-20240226-en
General
-
Target
0024262b8b7f1c51365b0d17b07ab2e7_JaffaCakes118.pdf
-
Size
78KB
-
MD5
0024262b8b7f1c51365b0d17b07ab2e7
-
SHA1
ec82766f62949081f21b8a0706bbd771f1da032b
-
SHA256
1e3762545ec96125e17481465fb20fda39f28299555ef9a3fba655fbc8f91a8e
-
SHA512
5c0d8eef0956cb2aded9b571f65bdb516a610b255e5b4d1cc3ce8219c043484a89e83ff6b3ce2d59030c32093ee4989a593b5c8d1b387dc343880b5d73827d68
-
SSDEEP
1536:O0DYfbDu4yhc8aKfOLIJJEJvF16h9d+UgTWyZVNLDSt5YHrW+p1edxbWcpOmUCd0:RDYfXY28aEkIJAFA8UgTXTxDS8HV0za7
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1912 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1912 AcroRd32.exe 1912 AcroRd32.exe 1912 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\0024262b8b7f1c51365b0d17b07ab2e7_JaffaCakes118.pdf"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1912
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5f547974b941ae8f396cf0d8ef4c94a80
SHA1a7b4e53e0c5687a9692b55de774a59d77deabfc5
SHA25690ebcf69ff2c3e2991ad8d8be7c0b496fd2068d673cf5ba35dc2b611d4b7f0c5
SHA512a67ca3cfb6bb60b3ee6ef9ab05df77573c5df54d2ea6c3d51eebddc7631987bdd97b232a96dbe148663f62a43d2eb4de052ec2ce279d43d54c9d3a19b26fd7ae