Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
28/03/2024, 19:55
Behavioral task
behavioral1
Sample
0ea0e33b8a0fa3babecdcc3c9c0e6188_JaffaCakes118.pdf
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
0ea0e33b8a0fa3babecdcc3c9c0e6188_JaffaCakes118.pdf
Resource
win10v2004-20240226-en
General
-
Target
0ea0e33b8a0fa3babecdcc3c9c0e6188_JaffaCakes118.pdf
-
Size
80KB
-
MD5
0ea0e33b8a0fa3babecdcc3c9c0e6188
-
SHA1
bb251bce2bc5e7ab3b04e3f66aad7b1e04031c23
-
SHA256
d46cd5eea2aa8a12fbd5940ddc66ac8fd0e74d23eb662b46f7a615f961c1bc89
-
SHA512
e00ea57ccaf3ab579efdc7c7f89a52814aac49ccef11d2c34cbe90676e61bf31de4b28a3fb15618b2fa49a238ecbafca94bd76991bbf473cd0a88dbbe1783d13
-
SSDEEP
1536:RC4zXowlaEaqqiQRDrgOC0EdrcjoCMVkMMMaWCpOViIWtUMJS40KASD/ysC:YKo+aqbQ1puAsCMVb9XVijS40Kn/ysC
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2964 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2964 AcroRd32.exe 2964 AcroRd32.exe 2964 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\0ea0e33b8a0fa3babecdcc3c9c0e6188_JaffaCakes118.pdf"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2964
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD507b5e8de0ac284d3b1174ae073472883
SHA1ef023614766b92a8f3e91afdc5aed044adfa1335
SHA256a118c4dba98a48986af8e71a595034d3f5036591850458cfa2ab941d045448fa
SHA5120b117e553f8c8dcf68d27fab7f103eb40d9bce16c3e6218f56a367155b42e67aa00c972253e8991bf89efa07464288416c367e5575c077aa68dc8bed8691942f