Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28/03/2024, 11:07
Behavioral task
behavioral1
Sample
040ab8527db97c4c10a9b9a51a9dab1d_JaffaCakes118.pdf
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
040ab8527db97c4c10a9b9a51a9dab1d_JaffaCakes118.pdf
Resource
win10v2004-20240226-en
General
-
Target
040ab8527db97c4c10a9b9a51a9dab1d_JaffaCakes118.pdf
-
Size
33KB
-
MD5
040ab8527db97c4c10a9b9a51a9dab1d
-
SHA1
2ca6459643f581c2523234aeb641e016e2d3496d
-
SHA256
7ea5582a02bdaa599084f2b61594130367b68406550afcd4e32d2ac1da2b09a5
-
SHA512
ec737d52ea5c58838e18cd37bb5d0b16fdeaea11531881f409aa75c418bc641723f3e32ab48f2998a986fdd42bb65553b9e56d1bea776da237928088d72984d3
-
SSDEEP
768:jEvjzmGK2lJxVjgywxCWqm1qllHiVxtNxJiWfvZjnW:jOjzmX2vjgrTVxtN/iW3ZjnW
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3032 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 3032 AcroRd32.exe 3032 AcroRd32.exe 3032 AcroRd32.exe 3032 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\040ab8527db97c4c10a9b9a51a9dab1d_JaffaCakes118.pdf"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3032
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5a600a5924ed042dd8fdd66970830d2fd
SHA1afeff88d32d255393c1f3f53e5de655600d98c74
SHA256b8d6c433081cbf2769ca73a5a497225ebf89e80cb4d540c2b33f1ec6769fbb58
SHA512b0404c54facc65bab819c5de76477033ffc0c712d5eb0880161cbc1dc253cc772bcd97c58f2a093b52ec8f57541bd6909a10015a25ad8d482e399c71baa93a77