Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
04/04/2024, 16:33
Behavioral task
behavioral1
Sample
bd2c6b30cdd150249e1b22e418fd849b_JaffaCakes118.pdf
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
bd2c6b30cdd150249e1b22e418fd849b_JaffaCakes118.pdf
Resource
win10v2004-20240226-en
General
-
Target
bd2c6b30cdd150249e1b22e418fd849b_JaffaCakes118.pdf
-
Size
82KB
-
MD5
bd2c6b30cdd150249e1b22e418fd849b
-
SHA1
ae813d14732ec1f1574b8e52b27188f58bb5e38f
-
SHA256
6f954217a8b0a1afd24c3933a3f06db05b510b5303ce6029586abc999abfa9f0
-
SHA512
a4fa8ffaadbbd4b05abc4d18fbe0608f772f9161c1b79b43f67c08c4985e9a6d927b1256036fd2ab4a425ca7008cfa94c6b0179a1e08b912dc296f3cfb0f02b6
-
SSDEEP
1536:yQBOdK/SnqITjydg8WVo/gWtCqaPUrv7hopG8ystWOpOaZtMTsYWzkosyv+i:fI/lydBWVo/JCqaPUrv7r8ysmaZGTsz5
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1860 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1860 AcroRd32.exe 1860 AcroRd32.exe 1860 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\bd2c6b30cdd150249e1b22e418fd849b_JaffaCakes118.pdf"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1860
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD58d799ef5a22b0cbea9d9e66f8e225f6f
SHA12249030d28fbb773874573e3bc83e82474757cf5
SHA256bdd6daac535d5902cfd3228fcdb2c0df363439f85f6a08e110b916dd8c7343c1
SHA5129c317ec1b6d866ea04b194454711f4e4374c4447e1aee2470d829f1cf00066acc8ab0f1ccbbc5e53b35c1420a76ea9ecf77046bdcfb5636e6a0ceca73b5c84d0