Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28/03/2024, 19:24
Behavioral task
behavioral1
Sample
0e03dd53dbbba1c1d756e8d5a1a506ef_JaffaCakes118.pdf
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0e03dd53dbbba1c1d756e8d5a1a506ef_JaffaCakes118.pdf
Resource
win10v2004-20240226-en
General
-
Target
0e03dd53dbbba1c1d756e8d5a1a506ef_JaffaCakes118.pdf
-
Size
80KB
-
MD5
0e03dd53dbbba1c1d756e8d5a1a506ef
-
SHA1
668979fe7fe73c82a4cb5d11c4bad376f58f0ddc
-
SHA256
771c49a4495fdd4e372ccecfeae59a002799ff1b768dfeced3df9825bc031552
-
SHA512
59417811e0c64077b25c4089479365c12f0cd61b10261cb762d6a235c1a9768ad5ccd5d39a4bb8bc54dc21b3fdd9f84e621182a9381b8e307741d5e63eea009f
-
SSDEEP
1536:dmsfSO90kLXP0q7XGNVVFSS7FGMXc6WOpOaZEWELv6Z1oP1W8:taMPDGrfSS7F7IaZoLv6roPj
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1460 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1460 AcroRd32.exe 1460 AcroRd32.exe 1460 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\0e03dd53dbbba1c1d756e8d5a1a506ef_JaffaCakes118.pdf"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1460
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD52fec7b1dfe5ba2570f9cc4fd71b38519
SHA14cd09c223982bdff03f57a8b90b294e697151026
SHA2563bf4340d046af28a3a2df035fb79f5bb981140d4afd4478c2f8524a31f40d4e3
SHA5128204c72ec7a90082fe9fadd6f34979c33bda204108153d0352275fc4b8843edeb3c0e6d2402f8f1b59706e924bc834fec0dee4d7054c1d484386e885dd8875c4