Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
28/03/2024, 07:30
Behavioral task
behavioral1
Sample
007c13f5f99d8afe135b595d4af2e7a2_JaffaCakes118.pdf
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
007c13f5f99d8afe135b595d4af2e7a2_JaffaCakes118.pdf
Resource
win10v2004-20240226-en
General
-
Target
007c13f5f99d8afe135b595d4af2e7a2_JaffaCakes118.pdf
-
Size
70KB
-
MD5
007c13f5f99d8afe135b595d4af2e7a2
-
SHA1
cf0c93cfabaef0c683cd62c864963cf51e5fba8f
-
SHA256
59a89f7acbdb80bfb53811e33689311b046a3083fa2bc2ce53ccd6705d54cfa0
-
SHA512
e8489a68558c224ac77b03ed1fe177846c2191920dcfab2fce1184585268621317ed5d937c227fa097ffed5087875ce281de1a23b05773e423a9b362c6f3ba1b
-
SSDEEP
1536:FJ0pHb9Kt5sGSAntfPoXK+mId6Cw2SN1woL6A5WxDFi2g+W8pO+IEZd7y:F+pbYbnoa8gCwx1woL6jJi2gZ+jZQ
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1888 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1888 AcroRd32.exe 1888 AcroRd32.exe 1888 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\007c13f5f99d8afe135b595d4af2e7a2_JaffaCakes118.pdf"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1888
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5728ab1775ed4039911fabc501a18745c
SHA1b4cc095f09b797c1953e4195b15a1391a52b1386
SHA2569d78455b03c60262a4ca22c9e444376b4a80ce58436a8a6ee70a54da29beca32
SHA5123e0d25b08973cbc6f38e6ccb0e99b9d5856f84094db9e14246924d429be64e39378ee3c40a02b3a456da3eba49f205bf2946f69200c8be85ebe74e9b5e0698ba