Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28/03/2024, 20:45
Behavioral task
behavioral1
Sample
0f94031a4766941d9c35f36aae58b7b0_JaffaCakes118.pdf
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0f94031a4766941d9c35f36aae58b7b0_JaffaCakes118.pdf
Resource
win10v2004-20240226-en
General
-
Target
0f94031a4766941d9c35f36aae58b7b0_JaffaCakes118.pdf
-
Size
75KB
-
MD5
0f94031a4766941d9c35f36aae58b7b0
-
SHA1
53e53fd0ed3b2f4714b128f8a890a4d668f552de
-
SHA256
674cf16db1a4904abbfade799940291a4a036bbf157004ef5817a0f5a799357e
-
SHA512
ca9cceed4ed4f99549119ad4a892b67c35a567d454ca1c66c5225a770dab22c3d49dc8323f0041cd21e8a96fd441a7c4eea68e18ffeb56d41873140120e1e24f
-
SSDEEP
1536:55FrIF9JNClEU7JPrkqHA8660c4nRhk5TWOzWUpO7qWNGcYJ5e80:vxM9KTSV605n7k4Om7mh58
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 348 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 348 AcroRd32.exe 348 AcroRd32.exe 348 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\0f94031a4766941d9c35f36aae58b7b0_JaffaCakes118.pdf"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:348
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD59b020c49ce322d4e095e09a9cfeca53c
SHA1e2c3f255e649da509381e952a0738dcf422ba353
SHA2561711ab3a64a208eb57752ea94e08fff54fa541786053b793bfc9e5cd41d108ec
SHA512af7fe2cf3ebe2c10719b2b3f288af3aaed8609208b0897c18dd48bbb46fb6133426c50451a0055c0b36ab3145ae0870c54c147da61f0258b8ffa04b08c67edbb