Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
04/04/2024, 17:10
Behavioral task
behavioral1
Sample
bdff097ea1b74d144bca369148d5d349_JaffaCakes118.pdf
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
bdff097ea1b74d144bca369148d5d349_JaffaCakes118.pdf
Resource
win10v2004-20240226-en
General
-
Target
bdff097ea1b74d144bca369148d5d349_JaffaCakes118.pdf
-
Size
88KB
-
MD5
bdff097ea1b74d144bca369148d5d349
-
SHA1
751920c5bcfa8ad7794fa42a7ba9aad3f6a52773
-
SHA256
2c4bad473ef250be530251e5ce4483f1e2226ae475e243de564b2baf05c8b8b3
-
SHA512
bb0d315eb53d01bc57185e865bfc746f3a72567369c8ae5807f84c1715ebedbeb6fe7cb91d0927099b7c806f9d9d5593a62d86e022ce0c8426b74235dda1d851
-
SSDEEP
1536:mGv5C/ppC4ALGq9Q13J9QyXs2MayYuUyRWJtT5eq6EGXniWapOtQHWMPVCl1ceVC:NeppCts9QWTRuUyRAtoTtvtQvVacwC
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2128 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2128 AcroRd32.exe 2128 AcroRd32.exe 2128 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\bdff097ea1b74d144bca369148d5d349_JaffaCakes118.pdf"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2128
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5d6f87b82ce91236f3fbecd6623736db8
SHA1ad7ace1b2279eeb74654b7c4819377cff9b67a3f
SHA25613fba9df213bf1ac3f220eab99ee37d6932897f07696a697e0f74bc77a7b4918
SHA512dcd42167f2f670d367a5b4906ff6947fb64e8769375e83f964c414c727c716be362d33b3cf1027ad8448bc19f6f447416937c3bee3cb505b6b33c3720127ddce