Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28/03/2024, 16:39
Behavioral task
behavioral1
Sample
0ab818c6a7bc02f951239a162b5e2c9e_JaffaCakes118.pdf
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0ab818c6a7bc02f951239a162b5e2c9e_JaffaCakes118.pdf
Resource
win10v2004-20240226-en
General
-
Target
0ab818c6a7bc02f951239a162b5e2c9e_JaffaCakes118.pdf
-
Size
85KB
-
MD5
0ab818c6a7bc02f951239a162b5e2c9e
-
SHA1
10317e44da8b45255b7adcd88ebf52cf863f8250
-
SHA256
2040413a29d57b5b987d84c010915f34935cdb1c369d1ee6bd21273aa384af99
-
SHA512
86d0d841d383675d1845cc9c7b6dd40fb0476a2fc93259ac160642d4ef962b387c3550a5f238aa3ba8c7de2e3d577f0b3878993e1b6e991af4696520ce298f7b
-
SSDEEP
1536:reJV7o9tADVXy4UwjBexveO8VZhhVPugIYP8EYvBWYt3Wkr3mXWcpOmErP:uK9QVi4B+WlPhx58EYbtGkCGmO
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1556 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1556 AcroRd32.exe 1556 AcroRd32.exe 1556 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\0ab818c6a7bc02f951239a162b5e2c9e_JaffaCakes118.pdf"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1556
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5d118a5a0e82d2f1f008f99d666366a8c
SHA1a242acfd49754626ec96551eece0c6a3af30aa3e
SHA256da7c46ea10b647e20f20b9f435082ec405fa0d5cb59e5f75aad85e6737f307d1
SHA512aee95a19292dcc85731a941d147ca15c230b4856ba2f67b77093cf496cb5926a15647a99d2ac6d96ec6f565b317d9ea05601ebfc6be82c51b51d755122cc54b2