Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
29/03/2024, 18:42
Behavioral task
behavioral1
Sample
1deffc12720ce3057216f7557050647b93a464abf772a855f7a17302c2c15b80.pdf
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
1deffc12720ce3057216f7557050647b93a464abf772a855f7a17302c2c15b80.pdf
Resource
win10v2004-20240226-en
General
-
Target
1deffc12720ce3057216f7557050647b93a464abf772a855f7a17302c2c15b80.pdf
-
Size
34KB
-
MD5
a5ed2b95683316935024d6c84433a096
-
SHA1
b923a34341c6aeda88ec1f7acce158d10c88d7fe
-
SHA256
1deffc12720ce3057216f7557050647b93a464abf772a855f7a17302c2c15b80
-
SHA512
1852e5862be55d4d109edd3a938e2ccc63987ccbd6de1a02e92435df71a655d29128295098bdc79f4f8317dd60ec5776dfec1563bc9dcac77654f10303417562
-
SSDEEP
768:q7MCe4dHZ/jWKtG31kAOl7pGR+dJ/Zc/Fms3JsDNXtB5MKHs0B6bwl3GQ:qC4//jWKtGWAM7oRMJ/kv3JGJHsm6bwx
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1912 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1912 AcroRd32.exe 1912 AcroRd32.exe 1912 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\1deffc12720ce3057216f7557050647b93a464abf772a855f7a17302c2c15b80.pdf"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1912
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5f98984b6e0e67a776a2588e6daffacf0
SHA1049547cc87349ecc32192383fc561ee42da07510
SHA2568af36a5068f2faab3c8fc418a7c9c2b140c498e95b2f0f9f34bd8f0a704af893
SHA5123453513a5e488a348581ac94bdd84fba1ee11f858da99817ae9a32fc61a9afb128a82ce1d0033bb2e0bd4f8ac0d83fb5d01f2e8e948e48f1b67304ef25121571