Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28/03/2024, 18:00
Behavioral task
behavioral1
Sample
0c583786e88fee506d1c3c40ff2b1a81_JaffaCakes118.pdf
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0c583786e88fee506d1c3c40ff2b1a81_JaffaCakes118.pdf
Resource
win10v2004-20240226-en
General
-
Target
0c583786e88fee506d1c3c40ff2b1a81_JaffaCakes118.pdf
-
Size
82KB
-
MD5
0c583786e88fee506d1c3c40ff2b1a81
-
SHA1
ec66afe7ceae1ac7b82fe5e758ede3a798969bc3
-
SHA256
38782ad3a7a9543bdeed45c04b44682204847fe8c64685142ea9dcc1cc56329a
-
SHA512
b1742f719936d41dd7449497db7bd8c766481e505a8f2580aa4d075f4979676002b892795686e30dbabfcdd044c2cc82e61849312a354f19c21b52d829752551
-
SSDEEP
1536:utiRK8WzlfuASKBUe62KzuYwObDVqssAExgWOpOZyW40Ep10cLnQ:zsfk2auYDDVqs/IdZW0cM
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1460 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1460 AcroRd32.exe 1460 AcroRd32.exe 1460 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\0c583786e88fee506d1c3c40ff2b1a81_JaffaCakes118.pdf"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1460
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5ee43c7c88e6de80b89fbbd9e1b107866
SHA12f6bc11c8fbd0c158cbb1908cb4638a2bf37f56b
SHA256a341398a0923c3eef08d01f5278786b6b723a81d49bf498688cbfa320eabcff3
SHA5128aa32757ff3bd3934bbd613f1f05a73519cc4a6a8af0c7f45097d6495a41094aedf02e3824023511c6aa89212e4d7afc50c3a1461bf7b89f538c8fe1468e4766