Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
29/03/2024, 01:11
Behavioral task
behavioral1
Sample
14bf487aa337127ac277537b92531faf_JaffaCakes118.pdf
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
14bf487aa337127ac277537b92531faf_JaffaCakes118.pdf
Resource
win10v2004-20231215-en
General
-
Target
14bf487aa337127ac277537b92531faf_JaffaCakes118.pdf
-
Size
82KB
-
MD5
14bf487aa337127ac277537b92531faf
-
SHA1
0e83abdb8ab94eae8366ae4f078497ae1800d6b9
-
SHA256
0c5d59ea357be37cbb48dd1c555b947faca4684aed10897c271596b4ab7c472d
-
SHA512
5c099b71eb4fb8f1a69e4901191038c4a739dfd38a56851503e51dfab51bd24de6177b5e215b4370cc55e32e4ef09d7c366528331545f31fdab3857efffe9114
-
SSDEEP
1536:oBbUsbGBA409o3lBRsIeaCJF82KRjcMC3A1Y6uTDWzQvwvWLBDfnW8pO76vo:gbGZP3lBRsdamZKRjnCN62wQvoWL9f6X
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2192 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2192 AcroRd32.exe 2192 AcroRd32.exe 2192 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\14bf487aa337127ac277537b92531faf_JaffaCakes118.pdf"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2192
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5d05ccf47a65959e4fc4c8631ff604dbf
SHA1b236cda6d3907facb5512b8eff7ed6bc14809649
SHA25646e3d3b42a15091ebebeea90bce37eca0c1775f6a4a558e8c8144175780d514a
SHA51262d0ea7d4f23ceed306e3fc375c6660598ba4223c97313d09755beecb51107655cb664c5c602b126696433504d704f27afe1f467c3b488a64f212c3707ab9115