Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
29/03/2024, 11:59
Behavioral task
behavioral1
Sample
216e9a5b19d946852f0d825b5ea1c9e9_JaffaCakes118.pdf
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
216e9a5b19d946852f0d825b5ea1c9e9_JaffaCakes118.pdf
Resource
win10v2004-20240226-en
General
-
Target
216e9a5b19d946852f0d825b5ea1c9e9_JaffaCakes118.pdf
-
Size
88KB
-
MD5
216e9a5b19d946852f0d825b5ea1c9e9
-
SHA1
b9a4acb134de0195eaea2215eeec70f769162ef5
-
SHA256
29b48ddbc7075451f24fb26e576335b3818347b7eb30237b605bc75fe172f9b4
-
SHA512
58f384a72766e7df143104295bde6ea98f4cdad006f4eae1619bc4d3095aa95ba3c31295152ac74baee55cb3c4b3fd07d48c6466bbb2963979a338f06b8e2f4e
-
SSDEEP
1536:4JL1cWEADYIB4tDhWa8A8kf06eZI08MtFNVdcb0bQ016Qz5b1/WHpOvBM69xEvfI:1JADjeFcMFf06QI08MtFZ6Qdx9vBME6I
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 824 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 824 AcroRd32.exe 824 AcroRd32.exe 824 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\216e9a5b19d946852f0d825b5ea1c9e9_JaffaCakes118.pdf"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:824
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD56d71390fda2d52bc85852ff364569d21
SHA18cfaa2c20895f5d99319d092cd252764a8a3cd54
SHA256570724a4938c1150650071967da75605995086701a2e9f1ef2fd203bf804ce7e
SHA512ea75922615d85e71a27248db9e42ac563d3d31221c7842ee970ae050460792284716194679545cdd6dce0cf60c377bf68b173f53edd92e730fb82ba44c03f7f7