Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
28/03/2024, 13:53
Behavioral task
behavioral1
Sample
073f26f18439b424633430dbfeba9552_JaffaCakes118.pdf
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
073f26f18439b424633430dbfeba9552_JaffaCakes118.pdf
Resource
win10v2004-20240226-en
General
-
Target
073f26f18439b424633430dbfeba9552_JaffaCakes118.pdf
-
Size
83KB
-
MD5
073f26f18439b424633430dbfeba9552
-
SHA1
3f16cd24422f8d94523d46c9cdda51145ada0ce9
-
SHA256
0aa69eb922b849f7a1d65503aeeec0545ab3fa797b06a2550f3ca00fbb1d796a
-
SHA512
699c2fcb6167e0dc1e83d50b41c28a7099ff1d5054be43c4ed4f4d164854f3dea86ecda50355490b160210b78b82a5039e132c1350bcff1dcc9f9486f7fa8618
-
SSDEEP
1536:qsuX8QZYa4/yGqsUK7TX0bha3DPamFsHdKjEsqiCVcEbdONWUpO7qW60Tzq3T1ol:tuX3mLHqsUK7obg3LDsHdKj6iB2Ow74k
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2592 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2592 AcroRd32.exe 2592 AcroRd32.exe 2592 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\073f26f18439b424633430dbfeba9552_JaffaCakes118.pdf"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2592
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5889469edea07c533f734a15cfec7d904
SHA13b35e575c8233b2a55f4287be0f6137aa8d10371
SHA256bcc3b3e2c5cd15e96a5e59984981630f525971f3dd1368e31159b701e79622d6
SHA5121d2dd73d9d37d1af693987fbe769b5ccc700e405b7e8d25d2e2b11c0ce51a68fcccb75ed314a642c671c0c0efa59b4da3fb4587fe38a6b67fcb0f32cae0ea1ca