Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28/03/2024, 19:15
Behavioral task
behavioral1
Sample
0dcf7ff602008f59a91a87a737408514_JaffaCakes118.pdf
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0dcf7ff602008f59a91a87a737408514_JaffaCakes118.pdf
Resource
win10v2004-20240226-en
General
-
Target
0dcf7ff602008f59a91a87a737408514_JaffaCakes118.pdf
-
Size
86KB
-
MD5
0dcf7ff602008f59a91a87a737408514
-
SHA1
52a438304f1f253fc884905adc55401626703896
-
SHA256
52f6a1f4f155b5a60aa05a1408e671365e61e17908e263494fe6c37ffca4fd2e
-
SHA512
3c944dbdb85b91d755597ec2badf216d7cf17e78b2f94808efc11968ca56958890705c509f5121f1ca0fd9dd11a8fd1eb2e0cb9f4d3b9e3a628c6a84ac67eef6
-
SSDEEP
1536:+0Jf+olt+eBG9+5ZgEiHUYqg/dB1BFLretJIOMJWeS/SOaY8WQpOChStpNFLG8:pJf+ob+P9YCEi0Y5dvXLrdVRS6OaY7CM
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1400 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1400 AcroRd32.exe 1400 AcroRd32.exe 1400 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\0dcf7ff602008f59a91a87a737408514_JaffaCakes118.pdf"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1400
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5cb650a02c433dc78a39120b7e7a7ea73
SHA18079a0bb804e0a6ee615348bc216c203b04c9c9e
SHA2568d6868eb62f679195ba0c906406839b6521d1271a32e2e306b8054a2994a40c1
SHA512aeaf8ffb8fe82999a1bb4f940f5292b0be5e37d830806a7aa8644656a39539ac72bd87853f9fc441e18c4ce22ee4e563219855be6d3b351ce05feabe365b1ec4