Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28/03/2024, 18:22
Behavioral task
behavioral1
Sample
0ccc2a7d2b77abea6e869562af9d3b5a_JaffaCakes118.pdf
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0ccc2a7d2b77abea6e869562af9d3b5a_JaffaCakes118.pdf
Resource
win10v2004-20240226-en
General
-
Target
0ccc2a7d2b77abea6e869562af9d3b5a_JaffaCakes118.pdf
-
Size
87KB
-
MD5
0ccc2a7d2b77abea6e869562af9d3b5a
-
SHA1
43e988f436cfb58be3bf56ccf6331a73bbf90de1
-
SHA256
e310fc19e361e8aa46d62b30ff64f822820a7bcd92d886f4c43ac7897aad5d0f
-
SHA512
3c21b066c9773109f248f5708942d5c8cfc0fd7934c97a6465f7c96699bb5f551a8181a5d2f92e57f8a485ed947fd306ae88530f208c43bbd1af73710428df7e
-
SSDEEP
1536:QuHxGa8B97QE1/WljxQ9X7lcHWw/uqBaU8hWGWA1sIIzWxApOGc+hL9Zds6O:Wam9+ljxOeHWGBir6c3GcqLHm
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2612 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2612 AcroRd32.exe 2612 AcroRd32.exe 2612 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\0ccc2a7d2b77abea6e869562af9d3b5a_JaffaCakes118.pdf"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2612
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD58a50aeb5b375629e06c9c97af1fc6db3
SHA120bbcb6de1d0718d01370b8953edb5c6ffc1bba8
SHA25646a62481eb7916cb06a4a99cf604e7b97b29303551f07d46f95b334767bc43a4
SHA512f9affa573b007bb722fb2934a56ca4ca5a4d08c7ec3688eacdf6ffb023e679e66a9a7ce5b1f39f97da70c7b1b794d21b6f0b5e73530541366d5814d9b10c0611