Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
29/03/2024, 04:08
Behavioral task
behavioral1
Sample
180ae4788e8a92c78aca9ff30c026644_JaffaCakes118.pdf
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
180ae4788e8a92c78aca9ff30c026644_JaffaCakes118.pdf
Resource
win10v2004-20240319-en
General
-
Target
180ae4788e8a92c78aca9ff30c026644_JaffaCakes118.pdf
-
Size
87KB
-
MD5
180ae4788e8a92c78aca9ff30c026644
-
SHA1
2e37872978c47978a4e847ce2687fff6721de772
-
SHA256
bfae4aeb3a0ab524c9571f3ddfb3439d69e90cfef48aa366980415ac3be484bb
-
SHA512
ca91c03eaa7cf4d652530024cabbf1b83c60235dedc5f14aef1ce13f821c7fcd721aacf778b54a9200238c65f2222a8270adc1a0d0a9735611ec9029b1b76030
-
SSDEEP
1536:QabK7rFYwV8qLZVGRo2p2Z0T39bFqgl+Pws9WApO6eWi2CKnuVQWJ6:ZbK7rFYwLLZVulp2Zq3hHlWj06VCKOQN
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2684 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2684 AcroRd32.exe 2684 AcroRd32.exe 2684 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\180ae4788e8a92c78aca9ff30c026644_JaffaCakes118.pdf"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2684
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD584020716c1b583345898f2b5380e8b1d
SHA137b9ca23351fb0eea5df7a804e412cb4f22f5eab
SHA25664ddc5da14e453bd0609da2c234fd7ab3e4ea79738a002945fc4cffd0e8a3ffe
SHA5120153ac1deba5b142676af14bcacb6c688d0df7251d61e3a9bf7fd1a2a0d34110b41cc6bb56bfd49d5c1c370b2f580dd9b97bd17c44785ad0569760df8f73b6f4