Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
29/03/2024, 10:07
Behavioral task
behavioral1
Sample
1f3c8ef1ae2eaa1acb0413c8d26ea05f_JaffaCakes118.pdf
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
1f3c8ef1ae2eaa1acb0413c8d26ea05f_JaffaCakes118.pdf
Resource
win10v2004-20231215-en
General
-
Target
1f3c8ef1ae2eaa1acb0413c8d26ea05f_JaffaCakes118.pdf
-
Size
78KB
-
MD5
1f3c8ef1ae2eaa1acb0413c8d26ea05f
-
SHA1
f8a3f7f031bfff2bddfe814bed7a119e692b318e
-
SHA256
86a3235973a8f3eb9a6c8ff9f1acdb0297595e66dfa2f23fe05eafb0e7efc678
-
SHA512
7706b52696426b5ba01f6770beb8725a16f2f806bbd7a106517896458f3ba4990d141c4112e1c2a3d356817a43e0b1f6d2e287bdbaddce4b2fa4328dd04a1e02
-
SSDEEP
1536:sIN4hMxPkiFWafip0WlOaVzPyWHpOvIUHRPo2WYhkkjifBcaC:deaPki3iSWorvIydoQpjifW
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1712 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1712 AcroRd32.exe 1712 AcroRd32.exe 1712 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\1f3c8ef1ae2eaa1acb0413c8d26ea05f_JaffaCakes118.pdf"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1712
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5ed796671cd6500763a2b324d086977cc
SHA1e0d659ecf341a0f0efd59bc324adcd2283f02aa2
SHA256b387e272576238c2b2b8fb6e0ada534ef7dc67a3ea4006581a2aaac6e1fd1953
SHA5129c71654d001ca5569a5dea0aa6bf9b260b1e27ab15e11944c8b3f067ec831088c5761cac0c7485bae0d648db733cf1d9fc9c03c1b7777a811c80b8299d2854ca