Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
05/04/2024, 02:14
Behavioral task
behavioral1
Sample
c80a2b2022ab5e8706dc013b2868dee2_JaffaCakes118.pdf
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
c80a2b2022ab5e8706dc013b2868dee2_JaffaCakes118.pdf
Resource
win10v2004-20240226-en
General
-
Target
c80a2b2022ab5e8706dc013b2868dee2_JaffaCakes118.pdf
-
Size
34KB
-
MD5
c80a2b2022ab5e8706dc013b2868dee2
-
SHA1
089db5accc8d670038e6aa0aa74320eb14bffe11
-
SHA256
2763a2f81fe661a63d7d14668ded9b5a0e6b61a918b89e07c8ae50cfe42e6c20
-
SHA512
ce3a25eb5954eaa8f71cfb51d5a66573a2c43522ca47bd373d0d216fc0f82efa78664b8ff6a332a9d809aced42a2cb6f9e4b46fdac4740c74259510b8c788988
-
SSDEEP
768:A41K0CJ+GrG9sK7LiuAiFdFJl0fY4EfOZ6fWoRvsSHolQ8Ce0llYC9KT:FcJ+nb7jAihj8YaZ6uoRv/HoCMzC9KT
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1376 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1376 AcroRd32.exe 1376 AcroRd32.exe 1376 AcroRd32.exe 1376 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\c80a2b2022ab5e8706dc013b2868dee2_JaffaCakes118.pdf"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1376
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD528df3992223a869bc2d329a0962842e3
SHA13cbf9a41e3120ed64c68a0dade96b1f57330db0b
SHA256cf1435ae3bad976a6e060c66c33dfbe8be608d122e7541f5f82c0f99605ff6c8
SHA5125c479d236e93a37687c4a8ba7d1d261486bf025430267c9e42d906c3b79189196e513fc13db854f8db9718dd851044cfc3560d5b42ecfbac5c136eda954ead53